Qualys Managed API Authentication
You can access the Qualys APIs with basic authentication using user ID and password, IdP-managed access tokens, or with a Qualys-managed access token.
This section describes the detailed workflow for implementing and using Qualys-managed API authentication.
What is Auth ID Token Management
Qualys Auth ID Token Management option helps you create a client. The clients are mapped to a merchant user. Once you create a client, the Client ID and Client secret are generated. You need these details to generate an API access token.
To learn more about creating a Client, refer to the PCI Merchant Online Help.
Once you get the Client ID and Client Secret, perform the following steps to generate an API authentication token (JWT token).
The Auth ID Token Management feature has limited availability. Contact your Technical Account Manager or Qualys Support to enable it for your account.
How to Generate an API Authentication Token
We have introduced the following new API to generate an authentication token.
Use this API to generate a JWT token to access the Qualys Merchant API.
Permissions Required - You must have an active PCI merchant account and PCI Merchant API access.
Input ParametersInput Parameters
The following table lists the input parameters required for generating an authentication token.
| Input Parameter | Mandatory/Optional | Data Type | Description |
|---|---|---|---|
| clientId | Mandatory | String | This is a unique identifier for a user-level or subscription-level client. Client ID is generated when you create a new client. |
| clientSecret | Mandatory | String | Client secret is a key associated with each Client ID. In the API request, you must provide a client secret for the respective Client ID. |
| authType | Mandatory | String | This parameter specifies the authentication type. Valid value: oidc |
Sample - Generate API Authentication TokenSample - Generate API Authentication Token
The following sample illustrates generating a Qualys-managed authentication token. Provide client ID, client secret, and authentication type in the API request to get the authentication in response.
API Request
curl --location --request POST 'https://pci-api.qualys.com/pci/client/token?clientId=<client_id_value>
clientSecret=<client_secret_value>authType=oidc' \
--header 'Content-Type: application/x-www-form-urlencoded' \
--header 'X-Requested-With: test'
API Response
eyJhbGciOiJIUzUxMiIsInR5cCI6IkpXVCJ9.eyJxxxxxxxxxxxxxxxxxx........
........................xxxxxxxxxxxxxxxxx_ro5VTw6l3Yf2Ri7DyPsg
How to Access Qualys APIs with an Authentication Token
Once the authentication token is generated, you can use it to authenticate your API requests. Include the token in the Authorization header of API requests.
The system validates the authentication token and authorizes the request based on the user's permissions.
Sample - Access PCI Merchant API with Qualys Managed TokenSample - Access PCI Merchant API with Qualys Managed Token
The following sample illustrates using a Qualys-managed authentication token to access PCI Merchant APIs.
API Request
curl --location 'https://pci-api.qualys.com/pci/scan/list?limit=2&offset=1' \
--header 'X-Requested-With: test' \
--header 'Authorization: Bearer YWRpdHlhX3BjaUBwb2Q0OlFhdGVtcDEyMyM='
API Response
{
"responseApiVersion": "LATEST - V1",
"data": {
"totalCount": 96,
"fetchRange": "1-2",
"scanInfoList": [
{
"scanId": 364093,
"title": "IP Scan 19032026",
"status": "Failed",
"date": null,
"scanType": "IP",
"compliance": "Fail",
"scanModule": "PCI"
},
{
"scanId": 365206,
"title": "PCI_scan-02jan2026",
"status": "Failed",
"date": null,
"scanType": "IP",
"compliance": "Fail",
"scanModule": "PCI"
}
]
}
}