Enterprise TruRisk™ Platform Release 3.25.1 API

October 16, 2026

This release adds RESTful V2 User Management APIs to update, delete, tag, export, and change the status of users, along with new APIs for self-service password changes and administrator-initiated password resets.

Before understanding the API release highlights, learn more about the API server URL to be used in your API requests by referring to the Know Your Qualys API Server URL section. In this API Release Notes, <qualys_base_url> is mentioned in the sample API requests.

Unlock Enhanced Administration Application Experience with RBAC 2.0
The new APIs and API enhancements described in this release are available exclusively in the enhanced Administration application (RBAC 2.0). While you can continue using the current Administration APIs, migrating to RBAC 2.0 provides access to the latest Administration API capabilities and future enhancements. For more information, see Migrating to RBAC 2.0.

Enhancement

User Management V2 APIs

What Changed For You

You can now update, delete, tag, export, and activate or deactivate users through resource-oriented V2 endpoints, including deleting multiple users in a single request.

The new set of V2 APIs complies with RESTful conventions. The legacy V1 endpoints remain the same.

New API: Update User by ID

New or Updated API	New
API Endpoint	/adminui/user-management/v2/users/{userId}
	EOS Timeline: December 2026
	EOL Timeline: March 2027
Method	PUT
DTD or XSD changes	Not Applicable

With this release, you can fully update a user by their numeric user ID. All mutable fields of the specified user are replaced with the values in the request body, and any optional field that is omitted is reset to its default or null value. This resource-oriented endpoint provides the same capability as the existing v1 update user API (/adminui/user-management/v1/user).

Input ParametersInput Parameters

Parameter	Mandatory/ Optional	Data Type	Description
userId	Mandatory	Integer	Specify the numeric ID of the user to update

Sample - Update a User by IDSample - Update a User by ID

API Request

curl --location --request PUT '<qualys_base_url>/adminui/user-management/v2/users/{userId}' \
--header 'Content-Type: application/json' \
--header 'Authorization: Bearer <JWT_Token>' \
--data-raw '

API Body

{
  "userDetails": {
    "firstName": "john",
    "lastName": "doe",
    "title": "QA Engineer",
    "emailId": "[email protected]",
    "contactNumber": null,
    "zipCode": "411038",
    "country": "Andorra",
    "state": "None",
    "city": null,
    "externalId": null,
    "address": "123 Test Street",
    "language": "English",
    "accessToAllAssetGroups": false,
    "sendEmail": true
  },
  "locale": {
    "userDateFormat": "dmy_text",
    "language": "English",
    "userDownloadFormat": "Comma-Separated Value (CSV)"
  },
  "userType": "REGULAR",
  "globalPermission": [
    "API_ACCESS",
    "UI_ACCESS"
  ],
  "buTag": {
    "tagId": 47734065,
    "buSourceId": 1807825,
    "tagName": "Test_UM"
  },
  "assetGroupTags": [
    {
      "tagId": 55712913,
      "agSourceId": 55712913,
      "tagName": "AG1"
    },
    {
      "tagId": 55712912,
      "agSourceId": 55712912,
      "tagName": "Test_AG"
    }
  ],
  "scopedTags": [
    36810704
  ],
  "qwebUserRole": "READER",
  "additionalRoles": [
    9292528,
    9292529,
    9291049,
    9292530
  ],
  "extendedPermissions": {
    "purgeHostInfo": "1",
    "manageVmModule": "1",
    "manageComplianceModules": "1"
  },
  "notification": {
    "latestControls": "weekly",
    "latestVulns": "weekly",
    "exception": "my_exceptions",
    "numberOfDaysBeforeExpiration": 4,
    "ticketNotification": null,
    "dailyTicket": true,
    "scanSummaryNotification": true,
    "mapNotification": true,
    "report": "my_reports",
    "heartbeatFailed": "1",
    "scanCompleteNotification": true
  },
  "security": {
    "vipEnabled": false,
    "samlEnabled": false,
    "passwordNeverExpired": false,
    "sessionTimeOut": null
  },
  "excludeDefaultRoles": true
}'

API Response

{
  "userId": 1072480495,
  "username": "quaysxjd1",
  "status": "SUCCESS"
}

New API: Delete User by ID

New or Updated API	New
API Endpoint	/adminui/user-management/v2/users/{userId}
	EOS Timeline: December 2026
	EOL Timeline: March 2027
Method	DELETE
DTD or XSD changes	Not Applicable

With this release, you can delete a single user by their numeric user ID. You can optionally reassign objects owned by the deleted user to another user using the newOwnerId query parameter, and permanently remove the associated scan and map results by setting deleteResults=true. This resource-oriented endpoint provides the same capability as the existing v1 delete user API.

Input ParametersInput Parameters

Parameter	Mandatory/ Optional	Data Type	Description
userId	Mandatory	Integer	Specify the numeric ID of the user to delete

Sample - Delete a User by IDSample - Delete a User by ID

API Request

curl --location --request DELETE '<qualys_base_url>/adminui/user-management/v2/users/{userId}?newOwnerId={newOwnerId}&deleteResults=true' \
--header 'Content-Type: application/json' \
--header 'Authorization: Bearer <JWT_Token>'

API Response

{
  "userId": 1072480495,
  "username": "<username>",
  "status": "SUCCESS"
}

New API: Add or Remove Tags for a User

New or Updated API	New
API Endpoint	/adminui/user-management/v2/users/{userId}/tags
Method	PUT
DTD or XSD changes	Not Applicable

With this release, you can perform bulk tag operations on a single user. Use the operationType field to choose the operation:

BULK_ADD_TAGS: Adds the supplied tags to the user's tag list.
BULK_REMOVE_TAGS: Removes the supplied tags from the user's tag list.
BULK_ADD_TAGS_TO_SCOPE: Adds the supplied tags to the user's scoped-tag set.
BULK_REMOVE_TAGS_FROM_SCOPE: Removes the supplied tags from the user's scoped-tag set.

If the tagIds array is empty or null, the API returns a 400 Bad Request error.

Input ParametersInput Parameters

Parameter	Mandatory/ Optional	Data Type	Description
userId	Mandatory	Integer	Specify the numeric ID of the user

Sample - Perform Tag Operations by User IDSample - Perform Tag Operations by User ID

API Request

curl --location --request PUT '<qualys_base_url>/adminui/user-management/v2/users/{userId}/tags' \
--header 'Content-Type: application/json' \
--header 'Authorization: Bearer <JWT_Token>' \
--data-raw '

API Body

{
  "tagIds": [
    50163024,
    36810704
  ],
  "operationType": "BULK_ADD_TAGS"
}'

API Response

{
  "userId": 1224886274,
  "username": "<username>",
  "success": true,
  "message": "add tags completed successfully"
}

New API: Update Scoped Tags by User ID

New or Updated API	New
API Endpoint	/adminui/user-management/v2/users/{userId}/scoped-tags
	EOS Timeline: December 2026
	EOL Timeline: March 2027
Method	PUT
DTD or XSD changes	Not Applicable

With this release, you can replace, add to, or remove from the scoped-tag set of a user. The request body must contain exactly one of the following keys:

updateTagsInScope – Replaces the entire scoped-tag set.
addTagsToScope – Appends the supplied tag IDs to the scoped-tag set.
removeTagsFromScope – Removes the supplied tag IDs from the scoped-tag set.

If the request body is null or empty, the API returns a 400 Bad Request error.

Input ParametersInput Parameters

Parameter	Mandatory/ Optional	Data Type	Description
userId	Mandatory	Integer	Numeric ID of the user

Sample - Replace the Scoped Tags of a UserSample - Replace the Scoped Tags of a User

API Request

curl --location --request PUT '<qualys_base_url>/adminui/user-management/v2/users/{userId}/scoped-tags' \
--header 'Content-Type: application/json' \
--header 'Authorization: Bearer <JWT_Token>' \
--data-raw '

API Body

{
  "updateTagsInScope": [
    50163024,
    50163023,
    36810704,
    50163022
  ]
}'

API Response

{
  "userId": 1072480495,
  "username": "quaysxjd1",
  "tags": [
    50163024,
    50163023,
    36810704,
    50163022
  ],
  "status": "SUCCESS"
}

New API: Export Users as CSV

New or Updated API	New
API Endpoint	/adminui/user-management/v2/users/export
	EOS Timeline: December 2026
	EOL Timeline: March 2027
Method	POST
DTD or XSD changes	Not Applicable

With this release, you can export the user list as a CSV file. The format and timezone query parameters are required; if either is omitted, the API returns a 400 Bad Request error. You can optionally pass a JSON request body to filter the set of users that is exported. This resource-oriented endpoint provides the same capability as the existing v1 download users CSV API.

Input ParametersInput Parameters

Parameter	Mandatory/ Optional	Data Type	Description
format	Mandatory	String	Specify the download format. The supported value is CSV.
timezone	Mandatory	String	Specify the timezone.

Sample - Export Users as CSVSample - Export Users as CSV

API Request

curl --location --request POST '<qualys_base_url>/adminui/user-management/v2/users/export?format=csv&timezone=Asia%2FKolkata' \
--header 'Content-Type: application/json' \
--header 'Authorization: Bearer <JWT_Token>' \
--data-raw '

API Body

{
  "limit": 5,
  "offset": 0,
  "sortFilter": {
    "username": "<username>"
  },
  "filter": {
    "role": "READER"
  }
}'

API Response

(Binary CSV file content is returned as the response body)

New API: Update User Status

New or Updated API	New
API Endpoint	/adminui/user-management/v2/users/{userId}/status
	EOS Timeline: December 2026
	EOL Timeline: March 2027
Method	PATCH
DTD or XSD changes	Not Applicable

With this release, you can activate or deactivate a user. The action field is required and must be either ACTIVATE or DEACTIVATE; an absent, empty, or unrecognized action returns a 400 Bad Request error. This resource-oriented endpoint provides the same capability as the existing v1 update user status API.

Input ParametersInput Parameters

Parameter	Mandatory/ Optional	Data Type	Description
userId	Mandatory	Array of Integer	Specify the numeric ID of the user.

Sample - Deactivate a UserSample - Deactivate a User

API Request

curl --location --request PATCH '<qualys_base_url>/adminui/user-management/v2/users/{userId}/status' \
--header 'Content-Type: application/json' \
--header 'Authorization: Bearer <JWT_Token>' \
--data-raw '

API Body

{
  "action": "DEACTIVATE"
}'

API Response

{
  "userId": 1229354639,
  "username": "<username>",
  "status": "SUCCESS"
}

New API: Bulk Delete Users

New or Updated API	New
API Endpoint	/adminui/user-management/v2/users
	EOS Timeline: December 2026
	EOL Timeline: March 2027
Method	DELETE
DTD or XSD changes	Not Applicable

With this release, you can delete multiple users in a single request. The userIds array is required and must not be empty; an absent or empty list returns a 400 Bad Request error. Set deleteResults to true to also permanently remove the scan and map results owned by the deleted users. This endpoint provides the same functionality as the existing v1 bulk-delete users API.

Input ParametersInput Parameters

Parameter	Mandatory/ Optional	Data Type	Description
userIds	Mandatory	Integer	Specify the list of user IDs to delete.
deleteResults	Optional	Boolean	Specify the value as TRUE or FALSE that indicates whether to delete the users' scan results. The default value is false.

Sample - Bulk Delete UsersSample - Bulk Delete Users

API Request

curl --location --request DELETE '<qualys_base_url>/adminui/user-management/v2/users' \
--header 'Content-Type: application/json' \
--header 'Authorization: Bearer <JWT_Token>' \
--data-raw '

API Body

{
  "userIds": [
    1072480495,
    1072480496
  ],
  "deleteResults": false
}'

API Response

{
  "message": "Users successfully deleted"
}

Enhancement

Password Management APIs

What Changed For You

You can now change your own password through the API, and administrators can trigger a password reset email for another user.

New API: Change Password

New or Updated API	New
API Endpoint	/adminui/user-management/v1/user/password/change
Method	POST
DTD or XSD changes	Not Applicable

With this release, users can change their own passwords through a self-service API. The authenticated user provides their current password (oldPassword) and the desired new password (newPassword).

Input ParametersInput Parameters

Parameter	Mandatory/ Optional	Data Type	Description
oldPassword	Mandatory	String	Current password
newPassword	Mandatory	String	New password

Sample - Change PasswordSample - Change Password

API Request

curl --location --request POST '<qualys_base_url>/adminui/user-management/v1/user/password/change' \
--header 'Content-Type: application/json' \
--header 'Authorization: Bearer <JWT_Token>' \
--data-raw '

API Body

{
  "oldPassword": "xxxxxxxx",
  "newPassword": "xxxxxxxx"
}'

API Response

{
  "status": "SUCCESS",
  "message": "Password changed successfully."
}

New API: Reset Password for Other User

New or Updated API	New
API Endpoint	/adminui/user-management/v1/user/password/reset
Method	POST
DTD or XSD changes	Not Applicable

With this release, administrators can initiate a password reset for another user. The API triggers a change-password email to the target user.

You must have the Reset Password for other users permission assigned to use this API to reset other users' passwords.

The API returns a 400 Bad Request error if:

targetUsername is not specified, null, or an empty string.
The initiator and the target are the same user.
The target user is a SAML-authenticated user.
The target user has the Contact role.
The target account is NCSM (Network-Centric Security Model) enabled.

Input ParametersInput Parameters

Parameter	Mandatory/ Optional	Data Type	Description
targetUsername	Mandatory	String	Username of the account whose password is being reset

Sample - Reset a User's PasswordSample - Reset a User's Password

API Request

curl --location --request POST '<qualys_base_url>/adminui/user-management/v1/user/password/reset' \
--header 'Content-Type: application/json' \
--header 'Authorization: Bearer <JWT_Token>' \
--data-raw '

API Body

{
  "targetUsername": "<username>"
}'

API Response

{
  "status": "SUCCESS",
  "message": "Password reset email sent to the target user."
}

UI Release Updates

To know more about the UI features, enhancements, and issues addressed, see Enterprise TruRisk™ Platform Release 3.25.1.