Release 1.2 API

March 04, 2025

Before understanding the API release highlights, learn more about the API server URL to be used in your API requests by referring to the Know Your Qualys API Server URL section. For this API Release Notes, <qualys_base_url> is mentioned in the sample API requests.

What's New?

Asynchronous API Support

With this release, we have introduced ETM Report APIs designed for asynchronous operations. You can now request services and receive responses later, ensuring non-blocking execution.

Benefits
  • Parallel Execution

    Enhanced the execution capabilities to allow statements to run in parallel without interrupting the overall program flow.

  • Performance Enhancements

    Improvements in the asynchronous processing speed make it more suitable for CPU-intensive tasks that need to be executed simultaneously.

Submit a Finding Report Request API

New or Updated API  New
API Endpoint  /etm/api/rest/v1/reports/findings
Method  POST
DTD or XSD changes Not Applicable

Use this API to request finding reports in JSON, CSV, or Parquet formats. Currently, only JSON format is supported.

Input ParametersInput Parameters

Parameter

Mandatory/Optional

Data Type

Description
name Mandatory String Provide name of the report.
description Optional String Provide description of the report.
reportFormat Mandatory String Use JSON as report format.
assetQql Optional String Filter assets based on asset QQL query.
findingsQql Optional String Filter the Findings based of findings QQL query.

Authorization 

Mandatory

String

Authorization token to authenticate to the Qualys Enterprise TruRisk Platform

Prepend token with Bearer and one space.

For example - Bearer authToken

SampleSample

API Request

curl -X POST '<qualys_base_url>/etm/api/rest/v1/reports/findings'
--header 'Content-Type: application/json'
--header 'Authorization: Bearer <JWT Token>'
--data '{
    "name": "Finding Report2123Report1234567report8",
    "description": "Test Report description",
    "reportFormat": "JSON",
    "assetQql" : "asset.assetID:341133",
    "findingsQql": "finding.vendorProductName: `Spotlight`"
}'

Response

{
  "id":"283593f9-b295-45d1-a37c-e04dd26b02e9",
  "name":"Finding Report",
  "description":"Test Report description",
  "reportFormat":"JSON",
  "assetQql":"",
  "findingsQql":"(finding.type: Vulnerability) and ((finding.severity:`1` and finding.riskFactor.rti:`Easy_Exploit`) and (finding.typeDetected: [`Confirmed`, `Potential`, `Sensitive Content`] and finding.status: [`NEW`, `ACTIVE`, `REOPENED`] and finding.disabled: FALSE and finding.ignored: FALSE))",
  "status":"REQUESTED",
  "created":"2024-12-17T15:15:58.5426457",
  "createdBy":{
    "id":"e254d3ed-0dbf-7207-81c9-790785f0f2a5",
    "firstName":"Automation",
    "lastName":"User",
    "username":"john_doe"
  },
  "updated":"2024-12-17T15:15:58.5426457",
  "updatedBy":{
    "id":"e254d3ed-0dbf-7207-81c9-790785f0f2a5",
    "firstName":"Automation",
    "lastName":"User",
    "username":"john_doe"
  },
  "expirationDate":"2026-01-17T15:15:58.2899838"
}

Get Report Details API

New or Updated API  New
API Endpoint  /etm/api/rest/v1/reports/{report-id}
Method  GET
DTD or XSD changes Not Applicable

Use this API to get the details of the requested report.

Input ParametersInput Parameters

Parameter

Mandatory/Optional

Data Type

Description
id Mandatory String Provide a unique ID of the report.

Authorization 

Mandatory

String

Authorization token to authenticate to the Qualys Enterprise TruRisk Platform

Prepend token with Bearer and one space.

For example - Bearer authToken

SampleSample

API Request

curl -X GET
'<qualys_base_url>/etm/api/rest/v1/reports/0b127284-e128-4d02-a720-2748240c9f1a'  
--header 'Content-Type: application/json' 
--header 'Authorization: Bearer <JWT Token>'

Response

{
   "id":"3dcbd5b3-e27e-4595-acd3-25ddb371ce33",
   "name":"New_Report_7da6a00c-203e-4524-b290-822a2a3a74a9",
   "description":"Test Report description",
   "reportFormat":"JSON",
   "findingsQql":"(finding.type: Vulnerability) and ((finding.severity:`1` and finding.riskFactor.rti:`Easy_Exploit`) and (finding.typeDetected: [`Confirmed`, `Potential`, `Sensitive Content`] and finding.status: [`NEW`, `ACTIVE`, `REOPENED`] and finding.disabled: FALSE and finding.ignored: FALSE))",
   "status":"COMPLETED",
   "created":"2024-12-17T14:44:46",
   "createdBy":{
       "id":"e254d3ed-0dbf-7207-81c9-790785f0f2a5",
       "firstName":"Automation",
       "lastName":"User",
       "username":"john_doe" 
  },
   "updated":"2024-12-17T14:44:46",
   "updatedBy":{
       "id":"e254d3ed-0dbf-7207-81c9-790785f0f2a5",
       "firstName":"Automation",
       "lastName":"User",
       "username":"john_doe" 
  },
   "expirationDate":"2026-01-17T14:44:45",
   "resources":[
       "part_13620991802218968.json",
       "part_13214481074804456.json",
       "part_13214481075841998.json",
       "part_13621018353956655.json",
       "part_13621018354659556.json" 
  ]
}

Download Report Using Resource Name API

New or Updated API  New
API Endpoint  /etm/api/rest/v1/reports/{report-id}/resources/{resource-name}
Method  GET
DTD or XSD changes Not Applicable

Use this API to download reports using resource ID. The Byte stream file is downloaded.

Input ParametersInput Parameters

Parameter

Mandatory/Optional

Data Type

Description
id Mandatory String Provide a unique ID of the report.
resource-name Mandatory String Provide resource name of the report.

Authorization 

Mandatory

String

Authorization token to authenticate to the Qualys Enterprise TruRisk Platform

Prepend token with Bearer and one space.

For example - Bearer authToken

SampleSample

API Request

curl -X GET '<qualys_base_url>/etm/api/rest/v1/reports/20ce9e32-fe6e-4172-b5ee-ef770591c56b/resources/part_15097524224131306.json'
--header 'Content-Type: application/json' 
--header 'Authorization: Bearer <JWT Token>'

Response

The Byte stream file is downloaded.

Download All Resources as a Zip API

New or Updated API  New
API Endpoint  /etm/api/rest/v1/reports/{report-id}/download
Method  GET
DTD or XSD changes Not Applicable

Use this API to download all resources in zip format.

Input ParametersInput Parameters

Parameter

Mandatory/Optional

Data Type

Description
id Mandatory String Provide unique id of the report.

Authorization 

Mandatory

String

Authorization token to authenticate to the Qualys Enterprise TruRisk Platform

Prepend token with Bearer and one space.

For example - Bearer authToken

SampleSample

API Request

curl -X GET '<qualys_base_url>/etm/api/rest/v1/reports/20ce9e32-fe6e-4172-b5ee-ef770591c56b/download'
--header 'Content-Type: application/json'
--header 'Authorization: Bearer <JWT Token>"

Response

The Byte stream .zip file is downloaded.
         

List of Active Reports API

New or Updated API  New
API Endpoint  /etm/api/rest/v1/reports/list
Method  POST
DTD or XSD changes Not Applicable

Use this API to get the list of active reports.

Input ParametersInput Parameters

Parameter

Mandatory/Optional

Data Type

Description

offset

Optional

Integer

Provide offset value to paginate reports.

Default value 0
limit Optional Integer Provide a number of reports to be fetched in the response. 

Authorization 

Mandatory

String

Authorization token to authenticate to the Qualys Enterprise TruRisk Platform

Prepend token with Bearer and one space.

For example - Bearer authToken

SampleSample 

API Request

curl -X POST
'<qualys_base_url>/etm/api/rest/v1/reports/list'
--header 'Content-Type: application/json'
--header 'Authorization: Bearer <JWT Token>'
--data '{
    "offset": 0,
    "limit": 50
}'

Response

[
  {
    "id":"fa6cfeab-cb31-4fe8-918b-327ae6014536",
    "name":"Test Report 3",
    "description":"Test Report description",
    "reportFormat":"JSON",
    "assetQql":"asset.criticality: 5",
    "findingsQql":"finding.severity: 2",
    "status":"REQUESTED",
    "created":"2024-11-23T21:27:03",
    "createdBy":{
      "id":"e254d3ed-0dbf-7207-81c9-790785f0f2a5",
      "firstName":"Automation",
      "lastName":"User",
      "username":"john_doe"
    },
    "updated":"2024-11-23T21:27:03",
    "updatedBy":{
      "id":"e254d3ed-0dbf-7207-81c9-790785f0f2a5",
      "firstName":"Automation",
      "lastName":"User",
      "username":"john_doe"
    },
    "expirationDate":"2025-12-23T21:27:02"
  }
]
         

Delete Report by Report ID API

New or Updated API  New
API Endpoint  etm/api/rest/v1/reports/{report-id}
Method  DELETE 
DTD or XSD changes Not Applicable

Use this API to delete reports using report ID.

Input ParametersInput Parameters

Parameter

Mandatory/Optional

Data Type

Description
id Mandatory String Provide a unique ID of the report.

Authorization 

Mandatory

String

Authorization token to authenticate to the Qualys Enterprise TruRisk Platform

Prepend token with Bearer and one space.

For example - Bearer authToken

SampleSample

API Request

curl -X DELETE '<qualys_base_url>/etm/api/rest/v1/reports/0b127284-e128-4d02-a720-2748240c9f1a'
--header 'Content-Type: application/json' 
--header 'Authorization: Bearer <JWT Token>'

Response

Report is deleted.

Bulk Delete Reports API

New or Updated API  New
API Endpoint  /etm/api/rest/v1/reports
Method  DELETE
DTD or XSD changes Not Applicable

Use this API to delete reports in bulk.

Input ParametersInput Parameters

Parameter

Mandatory/Optional

Data Type

Description

id

Mandatory

String

Provide a unique ID of the report. Enter IDs separated by comma in [ ] brackets.

For example,["{report-id1}","{report-id2}","{report-id3}"]

Authorization 

Mandatory

String

Authorization token to authenticate to the Qualys Enterprise TruRisk Platform

Prepend token with Bearer and one space.

For example - Bearer authToken

SampleSample

API Request

curl -X DELETE 
'<qualys_base_url>/etm/api/rest/v1/reports'
 --header 'Content-Type: application/json'
 --header 'Authorization: Bearer <JWT Token>'
 --data '[
    "dbc34b32-b957-449a-a357-27cf27df7eab"
   ]'

Response

[
  {
    "statusCode":204,
    "message":"Report deleted with id - 49fed5ab-19bc-4907-a18f-ae4ae486e07d and hard delete as false."
  }
]

For more details on APIs, refer to API User Guide.

© 2025 Qualys, Inc. All rights reserved. Privacy Policy.