Qualys PCI Compliance Release 6.4 API
February 03, 2026
Before understanding the API release highlights, learn more about the API server URL to be used in your API requests by referring to the Know Your Qualys API Server URL section. For these API Release Notes, <qualys_base_url> is mentioned in the sample API requests.
License Enforcement for DNS Scans
We have introduced DNS license enforcement in PCI Compliance to align DNS scanning with Quantity License Unit (QLU) requirements and existing IP-based licensing behavior.
This enhancement impacts both new and existing PCI users.
To learn more about this feature, refer to PCI Compliance 6.4 Release Notes.
To support this feature, we have updated the following PCI Admin APIs.
PCI Admin — Save Merchant API
| New or Updated API | Updated |
| API Endpoint | /api/save_merchant.php |
| Method | POST |
| DTD or XSD Changes | No |
To support the DNS License Enforcement, we have added a new parameter, enable_dns={0|1}, to the Save Merchant API. While enabling the DNS, the purchased_dns parameter is mandatory.
Sample: Create New Merchant User with DNS EnabledSample: Create New Merchant User with DNS Enabled
This sample illustartes creating new merchant user with DNS enabled.
API Request
https://pci.qualys.com/api/save_merchant.php?company=Acme%20Stars&
addr1=Hillsdale%20Blvd&addr2=4th%20Floor&city=Foster%20City&state=
CA&country=United%20States%20of%20America&zipcode=94404&type=C&pre
fix=Mr&firstname=John&lastname=Smith&title=CFO&phone=16508006121&u
sername=jsmith@acme&purchased_ips=10&is_pps=1&enable_dns=1&purchased_dns=10&ema
[email protected]&ip_list=10.10.10.1&bank_name_1=Worldwide%20Bank
&bank_ac_num_vis_mc_1=123123123123123123123&comment_tag_1=domain%2
0is%20corp1.us.com
API Response
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE GENERIC_RETURN SYSTEM "/static/dtd/generic_return.dtd">
<GENERIC_RETURN>
<API name="save_merchant.php" username="erin@qualys" at="2026-10
02T19:28:46Z"/>
<RETURN status="SUCCESS" number="" account_id="3442"
account_username="jsmith@acme">User jsmith@acme has been
successfully created.</RETURN>
</GENERIC_RETURN>
PCI Admin — Update Merchant API
| New or Updated API | Updated |
| API Endpoint | /api/update_merchant.php |
| Method | POST |
| DTD or XSD Changes | No |
To support the DNS License Enforcement, we have added a new parameter, enable_dns={0|1}, to the Update Merchant API. While enabling the DNS, the purchased_dns parameter is mandatory.
Sample: Enable DNS for an Existing Merchant UserSample: Enable DNS for an Existing Merchant User
This sample illustartes creating new merchant user with DNS enabled.
API Request
https://pci.qualys.com/api/update_merchant.php?merchant_id=574&exp
iration_date=2026-12-31&comments=extending+expiration+date+to+December 2026&
&enable_dns=1&purchased_dns=10 API Response
<?xml version="1.0" encoding="UTF-8" ?>
<GENERIC_RETURN>
<API name="update_merchant.php" username="erin@qualys" at="2017 12-03T03:34:42Z" />
<RETURN status="SUCCESS" number="" merchant_id="574">
Merchant 574 has been successfully updated.
</RETURN>
</GENERIC_RETURN>
Configure OIDC Authentication with API External ID
The PCI Compliance APIs support IdP-based authentication using OpenID Connect (OIDC). We have optimized this authentication process.
With this release of PCI Merchant, we are introducing a new parameter, API External ID, to manage the user permissions. The API External ID is a unique identifier used to implement role-based API access. Also, you can enable the OIDC authentication independently, without enabling the SAML-based authentication.
Only the Super Admin user can enable the API External ID for a merchant or bank user, and only Point of Contact users can edit it.
To learn more about configuring OIDC authentication, refer to the Token-based Authentication using IdP.
The Prerequisites section of the Token-based Authentication using IdP mention External ID as the prerequisites. For PCI Merchant, you can provide API External ID.
Sample: Generate Authentication Token for API AccessSample: Generate Authentication Token for API Access
API Request
curl --location '<<token generation url>>' JWT Token
--header 'Content-Type: application/x-www-form-urlencoded' JWT Token
--data-urlencode 'grant_type=password' JWT Token
--data-urlencode 'username=<<Qualys_okta_sandbox_user_id>>' JWT Token
--data-urlencode 'password=<<Qualys_okta_sandbox_password>>' \
--data-urlencode 'client_id=<<Qualys_okta_sandbox_application_client_id>>' \
--data-urlencode 'scope=openid profile'
The token generation URL may vary based on the IdP application you are using.The sample below illustrates the request and response for Okta.
API Response
{
"token_type": "Bearer",
"expires_in": 3600,
"access_token": "<JWT token value",
"scope": "profile openid",
"id_token": "<JWT token value>"
}
Sample: Access PCI Merchant API using JWT TokenSample: Access PCI Merchant API using JWT Token
API Request
curl --location --globoff 'https://qualysapi.p01.eng.sjc01.qualys.com/pci/scan/list?limit=10' \
--header 'Content-Type: application/json' \
--header 'X-Requested-With: test' \
--header 'Authorization: Bearer eyJraWQiOiJnbGhramRmc2F.......OqUA_r4hhg'
API Response
{
"responseApiVersion": "LATEST",
"data":
{
"totalCount": 1267,
"fetchRange": "1-10",
"scanInfoList":
[ {
"scanId": 9094,
"title": "a",
"status": "Failed",
"date": "December 18, 2020 at 07:54 AM GMT",
"scanType": "DNS",
"compliance": "Fail"
},
{
"scanId": 9093,
"title": "a",
"status": "Running",
"date": "December 18, 2020 at 07:54 AM GMT",
"scanType": "DNS",
"compliance": "Fail"
},
{
"scanId": 9092,
"title": "a",
"status": "Failed",
"date": "December 18, 2020 at 07:50 AM GMT",
"scanType": "DNS",
"compliance": "Fail"
},
{
"scanId": 9091,
"title": "a",
"status": "Failed",
"date": "December 18, 2020 at 07:50 AM GMT",
"scanType": "IP",
"compliance": "Fail"
},
{
"scanId": 9090,
"title": "a",
"status": "Launch Requested",
"date": "December 18, 2020 at 07:44 AM GMT",
"scanType": "DNS",
"compliance": "Fail"
}
]
}
}