Patch Management Release 3.11 API

January 27, 2026

Before understanding the API release highlights, learn more about the API server URL to be used in your API requests by referring to the Know Your Qualys API Server URL section. For this API Release Notes, <qualys_base_url> is mentioned in the sample API requests.

New API: Generate MTG Deployment Job Progress Report

New or Updated API	New
API Endpoint	/pm/v1/report/mitigationjobprogress
Method	POST
DTD or XSD changes	Not Applicable

We have introduced a new Get MTG Deployment Job Progress API that generates customized Mitigation job progress report for the specified job ID. All columns are selected by default, but you can modify and provide only the required columns. This API supports only Windows and Linux platforms.

If you provide an empty request body and null parameters, the API will generate a report including all the columns.

Input ParametersInput Parameters

Parameter	Mandatory/ Optional	Data Type	Description
deploymentJobId	Mandatory	String	Specify the job ID.

Parameter

Mandatory/
Optional

Data Type

Description

deploymentJobId

Mandatory

String

Specify the job ID.

Sample - Generate MTG Deployment Job Progress ReportSample - Generate MTG Deployment Job Progress Report

API Request

curl -X 'POST' \
  '<qualys_base_url>/pm/v1/report/mitigationjobprogress/d8560bb3-a863-4f1d-9682-00fd708061e3' \
  -H 'accept: application/json' \
  -H 'Authorization: Bearer<JWT_token>
  -H 'Content-Type: application/json' \
  -d '

API Body

{
  "name": "Mitigation Job Progress Report",
  "description": "Mitigation Job Progress Report Description",
  "query": "",
  "columnsToDisplay": {
    "mitigationJobProgress": [
      "assetId",
      "assetName",
      "jobStatus",
      "operatingSystem",
      "qid",
      "actionStatus",
      "returnCode",
      "returnMessage",
      "mitigationStatus",
      "cveIds",
      "mitigationTitle",
      "mitigationType",
      "impactFactor",
      "mitigationReturnCode",
      "mitigationReason",
      "assetDeactivated"
    ]
  }
}'

API Response

{
  "reportId": "18446aab-3dfc-46a0-8578-67a55d96f180"
}

New API: Generate ISL Deployment Job Progress Report

New or Updated API	New
API Endpoint	pm/v1/report/isolationjobprogress
Method	POST
DTD or XSD changes	Not Applicable

We have introduced a new Get ISL Deployment Job Progress API that generates customized Isolation job progress report for the specified job ID. All columns are selected by default, but you can modify and provide only the required columns. This API supports only Windows and Linux platforms.

If you provide an empty request body and null parameters, the API will generate a report including all the columns.

Input ParametersInput Parameters

Parameter	Mandatory/ Optional	Data Type	Description
deploymentJobId	Mandatory	String	Specify the job ID.

Parameter

Mandatory/
Optional

Data Type

Description

deploymentJobId

Mandatory

String

Specify the job ID.

Sample - Generate ISL Deployment Job Progress ReportSample - Generate ISL Deployment Job Progress Report

API Request

  curl -X 'POST' \
  '<qualys_base_url>/pm/v1/report/isolationjobprogress/f8560bb3-a863-4f1d-9682-00fd708061e3' \
  -H 'accept: application/json' \
  -H 'Authorization: Bearer <JWT_Token>
  -H 'Content-Type: application/json' \
  -d '

API Body

  curl -X 'POST' \
  '<qualys_base_url>/pm/v1/report/isolationjobprogress/f8560bb3-a863-4f1d-9682-00fd708061e3' \
  -H 'accept: application/json' \
  -H 'Authorization: Bearer eyJhbGC4a_rcRzokzA' \
  -H 'Content-Type: application/json' \
  -d '{
  "name": "Isolation Job Progress Report",
  "description": "Isolation Job Progress Report Description",
  "query": "",
  "columnsToDisplay": {
    "isolationJobProgress": [
      "assetId",
      "assetName",
      "jobStatus",
      "assetIp",
      "operatingSystem",
      "isolationStatus",
      "isolationMessage",
      "assetDeactivated"
    ]
  }
}'

API Response

{
  "reportId": "3c41aa33-f4bd-4982-8880-87024741e3f9"
}

Updated API: Create Deployment Job

New or Updated API	Updated
API Endpoint	/pm/v1/deploymentjob
Method	POST
DTD or XSD changes	Not Applicable

With this release, we have updated the Create Deployment Job API, which will display an error message in the API response, if the pre or post actions includes restricted commands.

Sample - Create Deployment Job with restricted commandsSample - Create Deployment Job with restricted commands

API Request

curl -X 'POST' \
  '<qualys_base_url>/pm/v1/deploymentjob' \
  -H 'accept: application/json' \
  -H 'Authorization: Bearer <JWT_Token>
  -H 'Content-Type: application/json' \
  -d '

API Body

{
  "approvedPatches": ["0c4619c6-dbc6-391b-a4fe-f2cad1835600"],
  "dynamicPatchesQQL": "",
  "isDynamicPatchesQQL": false,
  "additionalDynamicPatchesQQL": "",
  "additionalDynamicQQLType": "",
  "linkedJobId": "",
  "dynamicQQLType": 1,
  "assetCount": 0,
  "assetIds": ["1857c651-a6d4-4cb2-a334-0fb94cbaa5b7"],
  "isAssetImported": false,
  "assetFilePath": null,
  "assetTagIds": [],
  "assetDetectionsQQL": "",
  "deleted": false,
  "duringDeployment": {
    "userMessage": "",
    "description": ""
  },
  "name": "test_blacklist_script",
  "description": "",
  "createdBy": null,
  "patchCount": 0,
  "postDeployment": {
    "suppressreboots": false,
    "rebootHonorOnUserLogin": false,
    "onComplete": {
      "userMessage": "",
      "description": "",
      "alwaysShowCompletedPrompt": false
    },
    "rebootCountdown": {
      "interval": 15,
      "intervalUnit": "MINUTES",
      "userMessage": "Reboot countdown started",
      "description": "The system reboot is initiated. It will reboot automatically after the timer countdown."
    },
    "rebootOption": {
      "deferment": {
        "count": 3,
        "interval": 1,
        "intervalUnit": "HOURS"
      },
      "userMessage": "",
      "description": ""
    }
  },
  "preDeployment": {
    "deferment": {
      "count": 3,
      "interval": 1,
      "intervalUnit": "HOURS"
    },
    "userMessage": "",
    "description": ""
  },
  "recurring": false,
  "dayOfMonth": null,
  "recurringLastDayOfMonth": false,
  "patchTuesdayPlusXDays": null,
  "monthlyRecurringType": null,
  "recurringDayOfMonth": null,
  "recurringWeekDayOfMonth": null,
  "recurringWeekDays": "",
  "scheduleType": "On-demand",
  "schemaVersion": "1.0",
  "startDateTime": null,
  "status": "Disabled",
  "opportunisticdownloads": false,
  "minimizeWindow": false,
  "enableReattemptFailedPatches": false,
  "reattemptFailedPatches": {
    "noOfReattempts": 0,
    "exponentialBackoffInterval": 0
  },
  "allowExecutionWithPendingReboot": false,
  "customPatchURLId": null,
  "timeout": -1,
  "timeoutUnit": "HOURS",
  "downloadRandomizeTime": 0,
  "downloadRandomizeTimeUnit": "MINUTES",
  "timezone": null,
  "timezoneType": null,
  "type": "Install",
  "filterType": "Any",
  "exclusionFilterType": "Any",
  "exclusionTagIds": [],
  "matchAllTagIds": [],
  "coAuthorUserIds": [],
  "platform": "Windows",
  "exclusionAssetIds": [],
  "preDeployActions": [
    {
      "action": "Run Script",
      "params": {
        "actionItem": "Run command",
        "carScriptDetails": {
          "carScriptCategory": "",
          "carScriptDescription": "",
          "carScriptId": "",
          "carScriptLanguage": "",
          "carScriptPlatform": "",
          "carScriptQid": "",
          "carScriptSource": "",
          "carScriptStatus": "",
          "carScriptSubType": "",
          "carScriptTitle": "",
          "carScriptType": "",
          "scriptType": "Patch"
        },
        "fileChecksum": "",
        "remediationScope": false,
        "defaultScriptType": ""
      },
      "scriptType": "ps",
      "script": "UmVzdGFydC1TZXJ2aWNlIC1uYW1lICJRdWFseXNBZ2VudCI=",
      "selected": true
    }
  ],
  "postDeployActions": [
    {
      "action": "Run Script",
      "params": {
        "actionItem": "test2",
        "carScriptDetails": {
          "carScriptCategory": "",
          "carScriptDescription": "",
          "carScriptId": "",
          "carScriptLanguage": "",
          "carScriptPlatform": "",
          "carScriptQid": "",
          "carScriptSource": "",
          "carScriptStatus": "",
          "carScriptSubType": "",
          "carScriptTitle": "",
          "carScriptType": "",
          "scriptType": "Patch"
        },
        "fileChecksum": "",
        "remediationScope": false,
        "defaultScriptType": ""
      },
      "scriptType": "ps",
      "script": "UmVzdGFydC1TZXJ2aWNlIC1uYW1lICJRdWFseXNBZ2VudCI=",
      "selected": true
    }
  ],
  "jobCategory": null,
  "jobSource": 2,
  "notification": null,
  "remediationQids": [],
  "isVulnContext": false,
  "subCategory": "Patch",
  "chainedJobRule": [],
  "hostIsolationConfig": null,
  "quarantineAssetRequestNotification": null,
  "isDefaultJob": false,
  "defaultJobConfiguration": {
    "onAssetActivation": false,
    "onAssetInactiveForXDays": null
  }
}'

API Response

{
  "_error": {
    "code": 400,
    "message": "Job creation failed because the script includes restricted command in action Run command."
  }
}

Updated API: Update Deployment Job

New or Updated API	Updated
API Endpoint	/pm/v1/deploymentjob/update/{deploymentJobId}
Method	POST
DTD or XSD changes	Not Applicable

With this release, we have updated the Update Deployment Job API, which will display an error message in the API response, if the pre or post actions includes restricted commands.

Sample - Update Deployment Job with restricted commandsSample - Update Deployment Job with restricted commands

API Request

curl -X 'PATCH' \
  '<qualys_base_url>/pm/v1/deploymentjob/update/e0553f55-a0e8-4dc3-ae7b-2f5842d69a47' \
  -H 'accept: application/json' \
  -H 'Authorization: Bearer <JWT_Token>
  -H 'Content-Type: application/json' \
  -d '

API Body

{
  "approvedPatches": [
    "b88687cb-21a0-31bb-87b9-5277ced2b146"
  ],
  "dynamicPatchesQQL": "",
  "isDynamicPatchesQQL": false,
  "dynamicQQLType": 1,
  "additionalDynamicPatchesQQL": "",
  "additionalDynamicQQLType": "",
  "linkedJobId": "",
  "chainedJobRule": [],
  "assetCount": 1,
  "assetIds": [
    "1857c651-a6d4-4cb2-a334-0fb94cbaa5b7"
  ],
  "isAssetImported": false,
  "assetFilePath": null,
  "assetTagIds": [],
  "assetDetectionsQQL": "",
  "deleted": false,
  "duringDeployment": {
    "userMessage": "",
    "description": ""
  },
  "name": "feaea",
  "description": "",
  "patchCount": 1,
  "createdBy": {
    "user": {
      "id": "5ec46a7e-421c-5450-82a5-bcd66aebcf38",
      "name": "quays_pn71",
      "fullName": "Prerna Guhe"
    },
    "date": "1764047524073"
  },
  "postDeployment": {
    "suppressreboots": false,
    "rebootHonorOnUserLogin": false,
    "onComplete": {
      "userMessage": "",
      "description": "",
      "alwaysShowCompletedPrompt": false
    },
    "rebootCountdown": {
      "interval": 15,
      "intervalUnit": "MINUTES",
      "userMessage": "Reboot countdown started",
      "description": "The system reboot is initiated. It will reboot automatically after the timer countdown."
    },
    "rebootOption": {
      "deferment": {
        "count": null,
        "interval": null,
        "intervalUnit": "HOURS"
      },
      "userMessage": "",
      "description": ""
    }
  },
  "preDeployment": {
    "deferment": {
      "count": null,
      "interval": null,
      "intervalUnit": "HOURS"
    },
    "userMessage": "",
    "description": ""
  },
  "recurring": false,
  "dayOfMonth": null,
  "recurringLastDayOfMonth": false,
  "patchTuesdayPlusXDays": null,
  "monthlyRecurringType": null,
  "recurringDayOfMonth": null,
  "recurringWeekDayOfMonth": null,
  "recurringWeekDays": "",
  "scheduleType": "On-demand",
  "schemaVersion": "1.0",
  "startDateTime": null,
  "status": "Disabled",
  "opportunisticdownloads": false,
  "minimizeWindow": false,
  "enableReattemptFailedPatches": false,
  "reattemptFailedPatches": {
    "noOfReattempts": 0,
    "exponentialBackoffInterval": 0
  },
  "allowExecutionWithPendingReboot": false,
  "timeout": -1,
  "timeoutUnit": "HOURS",
  "downloadRandomizeTime": 0,
  "downloadRandomizeTimeUnit": "MINUTES",
  "timezone": null,
  "timezoneType": null,
  "type": "Install",
  "filterType": "Any",
  "exclusionFilterType": "Any",
  "exclusionTagIds": [],
  "matchAllTagIds": [],
  "coAuthorUserIds": [],
  "exclusionAssetIds": [],
  "preDeployActions": [
    {
      "action": "Run Script",
      "params": {
        "actionItem": "Blocked commands",
        "carScriptDetails": {
          "carScriptCategory": "",
          "carScriptDescription": "",
          "carScriptId": "",
          "carScriptLanguage": "",
          "carScriptPlatform": "",
          "carScriptQid": "",
          "carScriptSource": "",
          "carScriptStatus": "",
          "carScriptSubType": "",
          "carScriptTitle": "",
          "carScriptType": "",
          "scriptType": "Patch"
        },
        "fileChecksum": "",
        "remediationScope": false,
        "defaultScriptType": ""
      },
      "scriptType": "ps",
      "script": "U3RvcC1TZXJ2aWNlIC1uYW1lICJRdWFseXNBZ2VudCIK",
      "actionId": "599b4ce0-7627-4e47-bf99-829e3f63ec8e"
    }
  ],
  "postDeployActions": [],
  "jobCategory": 3,
  "jobSource": 2,
  "platform": "Windows",
  "notification": null,
  "customPatchURLId": null,
  "remediationQids": [],
  "isVulnContext": false,
  "subCategory": "Patch",
  "hostIsolationConfig": null,
  "quarantineAssetRequestNotification": null,
  "isDefaultJob": false,
  "defaultJobConfiguration": {
    "onAssetActivation": false,
    "onAssetInactiveForXDays": null
  }
}

API Response

{
  "_error": {
    "code": 400,
    "message": "Job update failed because the script includes restricted command in action Run command."
  }
}

Updated API: Get List of Mitigations

New or Updated API	Updated
API Endpoint	/mtg/v1/vulnerabilities/mitigations
Method	POST
DTD or XSD changes	Not Applicable

We have updated the Get List of Mitigations API to include a new parameter, mitigationSource, in the API response. This parameter specifies the source of the mitigation script, indicating whether it is a Qualys script or a user-defined custom script.

Sample - Get List of MitigationsSample - Get List of Mitigations

API Request

curl -X 'POST' \
  '<qualys_base_url>/mtg/v1/vulnerabilities/mitigations' \
  -H 'accept: application/json' \
  -H 'Authorization: Bearer <JWT_Token>' \
  -H 'Content-Type: application/json' \
  -d

API Body

 {
  "pageNumber": 0,
  "pageSize": 10,
  "qids": [92142],
  "platform": [
    "Windows"
  ],
  "implication": [
    "FIX"
  ]
}

API Response

[
  {
    "qid": 92142,
    "vulnMitigation": {
      "Windows": {
        "scriptBased": {
          "CVE-2024-30080": [
            {
              "mitigationId": "c9d5319f-5f93-490a-989c-e504fe368cd6",
              "mitigationType": "demo",
              "mitigationCategory": null,
              "description": "",
              "impactFactor": 100,
              "isDefault": true,
              "implication": "FIX",
              "mitigationSource": "qualys"
            }
          ],
          "CVE-2024-35250": [
            {
              "mitigationId": "c9d5319f-5f93-490a-989c-e504fe368cd6",
              "mitigationType": "demo",
              "mitigationCategory": null,
              "description": "",
              "impactFactor": 100,
              "isDefault": true,
              "implication": "FIX",
              "mitigationSource": "custom"
            }
          ]
        }
      }
    }
  }
]

UI Release Updates

To know in detail about the UI features, enhancements and issues addressed, see Patch Management Release 3.11.