File Integrity Monitoring Release 4.9.3 API

July 22, 2026

Before understanding the API release highlights, learn more about the API server URL to be used in your API requests by referring to the Know Your Qualys API Server URL section. For this API Release Notes, <qualys_base_url> is mentioned in the sample API requests.

Support for Approval Record ID in FIM Correlation Rule and Incident APIs

You can now associate an Approval ID with an incident during the review process, making it easier to correlate incidents with approved changes and maintain audit traceability. For example, you can link an incident to a ServiceNow Change Request or another IT Service Management (ITSM) approval record. The Approval ID field is optional and does not impact the existing flow of API execution. This field can be set while creating a correlation rule or approving an incident, and retrieved when fetching incidents.

Impacted APIs

The following APIs are updated to support the Approval Record ID:

  • Create Correlation Rules
  • Fetch Incidents
  • Approve Incidents

New Response Parameter

The response of the impacted APIs includes the Approval Record ID:

Response Parameter Description
approvalRecordId Provides the ID of the approval or audit record associated with the correlation rule/incident.

Updated API: Create Correlation Rules

New or Updated API Updated
API Endpoint /fim/v3/autocorrelation/rules/create
Method POST
DTD or XSD changes Not Applicable

Use this API to create a correlation rule with an associated Approval ID. To support this capability, we have introduced the following input parameter:

Parameter Mandatory/Optional Data Type Description
approvalRecordId Optional String Specifies the ID of the approval or audit record, such as a ServiceNow Change Request or another ITSM approval record, to be associated with the correlation rule.

Sample: Create a correlation rule with Approval Record ID fieldSample: Create a correlation rule with Approval Record ID field

API Request

curl -X POST
<qualys_base_url>/fim/v3/autocorrelation/rules/create 
-H 'authorization: Bearer <token>' 
-H 'content-type: application/json' 
-d @request.json

API Request body with new filter

{
    "fixDate": "2026-07-26",
    "approvalStatus": "PENDING",
    "changeType": "NORMAL_CHANGE",
    "approvalType": "AUTOMATED",
    "description": "test reviewer",
    "approvalRecordId":"23232323",
    "reviewers": [
      "[email protected]"
    ],
    "scheduleType": "ONETIME",
    "ruleName": "rule creation through public api FIM 493 with approval id ",
    "startTime": "1:30:00",
    "dispositionCategory": "DISREGARD_OF_ORGANIZATIONAL_POLICY",
    "comment": "some comment ",
    "endTime": "11:00:00",
    "filterQuery": "action:`Create`"
}

API Response

{
  "customerId": "<CUSTOMER ID>",
  "id": "<RULE ID>",
  "ruleName": "<CORRELATION RULE NAME>",
  "filterQuery": "action:Create",
  "description": "<CORRELATION RULE DESCRIPTION>",
  "startTime": "12:00:00",
  "endTime": "23:59:00",
  "scheduleType": "ONETIME",
  "days": [],
  "fixDate": "2023-06-04",
  "changeType": "NORMAL_CHANGE",
  "dispositionCategory": "DISREGARD_OF_ORGANIZATIONAL_POLICY",
  "approvalType": "AUTOMATED",
  "approvalStatus": "PENDING",
  "approvalRecordId": "23232323",
  "reviewers": [
    "<USERNAME>",
    "USER EMAIL ID"
  ],
  "comment": "<COMMENT>",
  "createdBy": {
    "user": {
      "id": "<USER ID>",
      "name": "<USER NAME>"
    },
    "date": 1671187879859
  },
  "updatedBy": {
    "user": {
      "id": "<USER ID>",
      "name": "<USER NAME>"
    },
    "date": 1671187879859
  }
}

Updated API: Fetch Incidents

New or Updated API Updated
API Endpoint /fim/v3/incidents/search
Method POST
DTD or XSD changes Not Applicable

Use this API to fetch FIM incidents, including the associated Approval Record ID.

There is no change to the input parameters of this API.

Sample: Fetch incidents with Approval Record IDSample: Fetch incidents with Approval Record ID

API Request

curl -X POST 
'<qualys_base_url>/fim/v3/incidents/search 
--header 'Authorization: Bearer <authToken>'
--header 'content-type: application/json' 
--data-raw 
'{
          "filter":"status:CLOSED",
          "sort":"[\{\"dateTime\":\"desc\"}
]'

API Response

{
  "customerId": "<CUSTOMER ID>",
  "type": "DEFAULT",
  "id": "<ID>",
  "filterFromDate": "2022-11-15T16:07:00.000+0000",
  "filterToDate": "2022-12-15T16:07:00.000+0000",
  "name": "TEST WITH SPECIAL CHARS",
  "filters": [
    "dateTime:['2022-11-15T16:07:00.000Z'..'2022-12-15T16:07:00.000Z'] AND (action:Content)"
  ],
  "status": "CLOSED",
  "reviewers": [
    "<REVIEWER USERNAME OR EMAIL ID>"
  ],
  "comment": "With additional approval values",
  "assignDate": "2022-12-15T16:08:19.560+0000",
  "approvalDate": "2022-12-16T06:33:19.224+0000",
  "approvalStatus": "PENDING",
  "approvalRecordId": "<APPROVAL RECORD ID>",
  "dispositionCategory": "DISREGARD_OF_ORGANIZATIONAL_POLICY",
  "changeType": "NORMAL_CHANGE",
  "approvalType": "MANUAL",
  "createdById": "<USER ID>",
  "createdByName": "<USER NAME>",
  "createdDate": "2022-12-15T16:08:19.560+0000",
  "lastUpdatedById": "<USER ID>",
  "lastUpdatedByName": "USER NAME",
  "lastUpdatedDate": "2022-12-16T06:17:36.953+0000",
  "filterUpdatedDate": "2022-12-15T16:08:19.560+0000",
  "deleted": false,
  "marked": true,
  "moved": null,
  "markupStatus": "COMPLETED",
  "ruleId": null,
  "ruleName": null
}

Updated API: Approve Incidents

New or Updated API Updated
API Endpoint /fim/v3/incidents/{incidentId}/approve
Method POST
DTD or XSD changes Not Applicable

Use this API to approve an incident with an associated Approval ID.

There is no change to the input parameters of this API.

Sample: Approve an incident with Approval Record IDSample: Approve an incident with Approval Record ID
 

API Request

curl -X POST
<qualys_base_url>/fim/v3/incidents/{incidentId}/approve
-H 'authorization: Bearer <token>'
-H 'content-type: application/json'
-d @request.json

API Request body with new filter

{
    "approvalStatus": "PENDING",
    "changeType": "NORMAL_CHANGE",
    "comment": "With additional approval values",
    "dispositionCategory": "DISREGARD_OF_ORGANIZATIONAL_POLICY",
    "approvalRecordId": "23232323"
}

API Response

{
  "customerId": "<CUSTOMER ID>",
  "type": "DEFAULT",
  "id": "<ID>",
  "filterFromDate": "2022-11-15T16:07:00.000+0000",
  "filterToDate": "2022-12-15T16:07:00.000+0000",
  "name": "TEST WITH SPECIAL CHARS",
  "filters": [
    "dateTime:['2022-11-15T16:07:00.000Z'..'2022-12-15T16:07:00.000Z'] AND (action:Content)"
  ],
  "status": "CLOSED",
  "reviewers": [
    "<REVIEWER USERNAME OR EMAIL ID>"
  ],
  "comment": "With additional approval values",
  "assignDate": "2022-12-15T16:08:19.560+0000",
  "approvalDate": "2022-12-16T06:33:19.224+0000",
  "approvalStatus": "PENDING",
  "approvalRecordId": "23232323",
  "dispositionCategory": "DISREGARD_OF_ORGANIZATIONAL_POLICY",
  "changeType": "NORMAL_CHANGE",
  "approvalType": "MANUAL",
  "createdById": "<USER ID>",
  "createdByName": "<USER NAME>",
  "createdDate": "2022-12-15T16:08:19.560+0000",
  "lastUpdatedById": "<USER ID>",
  "lastUpdatedByName": "USER NAME",
  "lastUpdatedDate": "2022-12-16T06:17:36.953+0000",
  "filterUpdatedDate": "2022-12-15T16:08:19.560+0000",
  "deleted": false,
  "marked": true,
  "moved": null,
  "markupStatus": "COMPLETED",
  "ruleId": null,
  "ruleName": null
}

© 2026 Qualys, Inc. All rights reserved. Privacy Policy.