PCI Compliance Release 1.8 API
June 15, 2026
Before understanding the API release highlights, learn more about the API server URL to be used in your API requests by referring to the Know Your Qualys API Server URL section. For these API Release Notes, <qualys_base_url> is mentioned in the sample API requests.
New API: Generate Qualys Managed Authentication Token
| New or Updated API | New |
| API Endpoint | /pci/client/token |
| Method | POST |
| DTD or XSD Changes | No |
PCI Compliance now supports authentication using Qualys-managed access tokens. To generate an authentication token, we have introduced the following new API endpoint. To learn more about this feature, refer to Qualys Managed API Authentication.
Input ParametersInput Parameters
The following table lists the input parameters required for generating an authentication token.
| Input Parameter | Mandatory/Optional | Data Type | Description |
|---|---|---|---|
| clientId | Mandatory | String | This is a unique identifier for a user-level or subscription-level client. Client ID is generated when you create a new client. |
| clientSecret | Mandatory | String | Client secret is a key associated with each Client ID. In the API request, you must provide a client secret for the respective Client ID. |
| authType | Mandatory | String | This parameter specifies the authentication type. Valid value: oidc |
Sample: Generate Authentication TokenSample: Generate Authentication Token
The following sample illustrates generating a Qualys-managed authentication token. Provide client ID, client secret, and authentication type in the API request to get the authentication in response.
API Request
curl --location --request POST 'https://pci-api.qualys.com/pci/client/token?clientId=<client_id_value>
clientSecret=<client_secret_value>authType=oidc' \
--header 'Content-Type: application/x-www-form-urlencoded' \
--header 'X-Requested-With: test'
API Response
eyJhbGciOiJIUzUxMiIsInR5cCI6IkpXVCJ9.eyJxxxxxxxxxxxxxxxxxx........
........................xxxxxxxxxxxxxxxxx_ro5VTw6l3Yf2Ri7DyPsg
Access PCI Merchant API with Qualys Managed Tokens
Once the authentication token is generated, you can use it to authenticate your API requests. Include the token in the Authorization header of API requests.
The system validates the authentication token and authorizes the request based on the user's permissions.
Sample: Access PCI Merchant API with Qualys Managed TokensSample: Access PCI Merchant API with Qualys Managed Tokens
The following sample illustrates using a Qualys managed authentication token to access PCI Merchant APIs.
API Request
curl --location 'https://pci-api.qualys.com/pci/scan/list?limit=2&offset=1' \
--header 'X-Requested-With: test' \
--header 'Authorization: Bearer YWRpdHlhX3BjaUBwb2Q0OlFhdGVtcDEyMyM='
API Response
{
"responseApiVersion": "LATEST - V1",
"data": {
"totalCount": 96,
"fetchRange": "1-2",
"scanInfoList": [
{
"scanId": 364093,
"title": "IP Scan 19032026",
"status": "Failed",
"date": null,
"scanType": "IP",
"compliance": "Fail",
"scanModule": "PCI"
},
{
"scanId": 365206,
"title": "PCI_scan-02jan2026",
"status": "Failed",
"date": null,
"scanType": "IP",
"compliance": "Fail",
"scanModule": "PCI"
}
]
}
}
New API: Generate and Download Consolidated Vulnerability Data
| New or Updated API | New |
| API Endpoint | /pci/vuln/consolidated |
| Method | GET |
| DTD or XSD Changes | No |
We are introducing a new API endpoint to generate and download the consolidated vulnerability data. Previously, you could only generate details for one vulnerability at a time. Now you can generate a consolidated data report for all vulnerabilities, including all details, in a single API request. The vulnerability reports are generated in CSV (regular) and CSV (detailed) formats.
Input ParametersInput Parameters
The following are the input parameters required for generating and exporting consolidated vulnerability data.
| Input Parameter | Mandatory/Optional | Data Type | Description |
|---|---|---|---|
| offset | Optional | Integer | Specify the start record number of a scan to be considered for the request. Valid values: Greater than 1 Default value: 1 |
| limit | Optional | Integer | The maximum number of records processed for the request, starting at the record number specified by the offset parameter. Limit value must always be greater than 0. If you specify a value 0 for the parameter, the request fails. Valid values: Between 1-1000 Default value: 100 |
| sortBy | Optional | String | Specify the criterion to sort the vulnerabilities. Valid values:
|
| sortOrder | Optional | String | Specify the order to sort the vulnerabilities. Valid values: DESC and ASC (For descending order) Default value: ASC (For ascending order) |
| ip | Optional | String | Specify the valid IP address, IP range to view related vulnerabilities. |
| dns | Optional | String | Specify the DNS hostname to view the related vulnerabilities. |
| qid | Optional | String | Specify the vulnerability ID (QID) to view the associated vulnerabilities. |
| title | Optional | String | Specify the vulnerability title to search for vulnerabilities. The vulnerability titles are case sensitive. This parameter returns all vulnerabilities that exactly or partially match the specified title. |
| severity | Optional | String | Provide a comma-separated list of severity values to search for vulnerabilities at certain severity levels. Valid values: CONFIRMED_HIGH, CONFIRMED_MED, CONFIRMED_LOW, POTENTIAL_HIGH, POTENTIAL_MED, POTENTIAL_LOW |
| falsePositive | Optional | String | Specify the false positive status view the associated vulnerabilities. Valid values: Requested, Rejected, Expired |
| pciFailVulns | Optional | Boolean | Search for vulnerabilities by PCI compliance status. Valid values: true, false Default value: false. By default, it lists all the vulnerabilities irrespective of their PCI compliance status. When set to true, it lists vulnerabilities with failed PCI compliance status. |
| fpSubmissionList | Optional | Boolean | Specify this value to generate a list of QIDs for which you can submit false positive requests. Valid values: true, false Default value: False. By default, it does not list QIDs for false submission. If set to true, the pciFailVulns parameter must be set to true. |
| downloadFormat | Optional | String | Specify the download format for consolidated vulnerability reports. Valid values:
|
Sample: Generate Consolidated Vulnerability DataSample: Generate Consolidated Vulnerability Data
The following sample illustrates generating consolidated vulnerability data.
API Request
curl --location 'https://pci-api.qualys.com/pci/vuln/consolidated?limit=2' \
--header 'X-Requested-With: test' \
-u '<user_login>'
API Response
{
"responseApiVersion": "LATEST - V1",
"data": {
"totalCount": 302843,
"fetchRange": "1-2",
"merchantVulnConsolidatedList": [
{
"id": 1347858,
"qid": 82003,
"title": "ICMP Timestamp Request",
"pciCompliant": "Pass",
"severity": "Confirmed Low",
"ip": "10.10.10.10",
"dns": "def.p01.eng.in01.qualys.com...",
"dateLastScanned": "01/14/2025",
"fpStatus": "NA",
"scanModule": "PCI",
"operatingSystem": "NetScaler",
"qualysSeverity": 1,
"cvssBase": "null",
"cvssTemporal": "null",
"category": "TCP/IP",
"port": null,
"service": "TCP/IP",
"protocol": null,
"bugTraqList": [],
"cveList": [],
"vendorReferenceList": [],
"dateLastUpdate": "May 28, 2025 at 12:00 AM GMT",
"threat": "ICMP (Internet Control and Error Message Protocol) is a protocol encapsulated in IP packets...",
"impact": "Unauthorized users can obtain information about your network by sending ICMP timestamp packets.",
"solution": "You can filter ICMP messages of type Timestamp and Timestamp Reply at the firewall level.",
"patch": null,
"result": "Timestamp of host (network byte ordering): 12:10:11 GMT"
},
{
"id": 1347859,
"qid": 34000,
"title": "TCP Source Port Pass Firewall",
"pciCompliant": "Fail",
"severity": "Confirmed Low",
"ip": "10.10.10.10",
"dns": "def.p01.eng.in01.qualys.com...",
"dateLastScanned": "01/14/2025",
"fpStatus": "Rejected",
"scanModule": "PCI",
"operatingSystem": "NetScaler",
"qualysSeverity": 3,
"cvssBase": "null",
"cvssTemporal": "null",
"category": "Firewall",
"port": null,
"service": "Firewall",
"protocol": null,
"bugTraqList": [],
"cveList": [],
"vendorReferenceList": [],
"dateLastUpdate": "July 10, 2017 at 12:00 AM GMT",
"threat": "Your firewall policy seems to let TCP packets with a specific source port pass through.",
"impact": "Some types of requests can pass through the firewall.",
"solution": "Make sure that all your filtering rules are correct and strict enough.",
"patch": null,
"result": "The host responded 2 times to 4 TCP SYN probes sent to destination port 20 using source port 20."
}
]
}
}
Sample: Export Consolidated Vulnerability DataSample: Export Consolidated Vulnerability Data
The following sample illustrates how to download consolidated vulnerability data.
API Request
curl -OJ --location 'https://pci-api.qualys.com/pci/vuln/consolidated?downloadFormat=csv&limit=100' \
--header 'Content-Type: application/zip' \
--header 'X-Requested-With: test' \
-u '<user_login>'
API Response
HTTP/1.1 200
Content-Disposition: attachment; filename=PCIVulnReport-20260420.csv
Content-Type: text/csv;charset=UTF-8
Content-Length: 482
Issues Addressed
There are no notable and important customer issues for this release.