Qualys Flow Release 1.18 API
August 13, 2025
Before understanding the API release highlights, learn more about the API server URL to be used in your API requests by referring to the Know Your Qualys API Server URL section. For this API Release Notes, <qualys_base_url> is mentioned in the sample API requests.
Introduced Date Restrictions on the Execution List API
The Execution List API has been introduced with a date restriction to ensure consistency and accuracy in execution data retrieval.
Previously, the Execution List API results retained executions up to 60 days, but the deletion of the executions occurred at different times in the backend, leading to data inconsistencies.
With this release, you can query the last 30 days of execution records using the startAt and endAt parameters.
Execution List API
|
New or Updated API |
Updated |
|
API Endpoint |
/qflowapi/v1/workflows/{workflowId}/executions |
|
Method |
GET |
|
DTD or XSD changes |
Not Applicable |
Use this API to get a comprehensive list of all executions of a workflow.
Input ParametersInput Parameters
|
Parameter |
Mandatory/Optional |
Data Type |
Description |
|---|---|---|---|
|
startAt |
Optional |
Date |
Filters workflows to show only those created on or after a specific start date. The start date can only go as far back as 30 days from the present day. For example, The response displays all the workflows that were created after |
|
endAt |
Optional |
Date |
Filters workflows to show only those created on or before a specific end date. For example, The response displays all the workflows that were created before |
Sample: Get the workflows with the specified start and end dateSample: Get the workflows with the specified start and end date
API Request
curl --location 'https://<gateway_url>.qualys.com/qflowapi/v1/workflows/f516bcf4-f6fb-46ac-a54f-ddbcf2a2d24a/executions?pageSize=2&offset=0&endAt=2025-05-12T01%3A45%3A36.220Z&startAt=2025-04-20T01%3A45%3A36.220Z&order=createdAt' \ --header 'Authorization: Bearer <Token>'
Response
{ "total": "9", "items": [ { "execution": "e5d57d53-79db-4840-a7a0-10d0cb1d8020", "workflow": "f516bcf4-f6fb-46ac-a54f-ddbcf2a2d24a", "endDate": 1745233995144, "parDateKey": "2025-04-21T00:00:00.000Z", "executionType": "Simple", "source": "UI", "parentExecutionId": null, "tags": [ "created_by=0ffaf046-768b-79fc-83f6-aa25be52c2a1" ], "createdAt": 1745233971431, "customerId": "54f50897-26f3-c9af-83f9-e71459be70d9", "details": { "executionEndDate": 1745233995144 }, "id": "e5d57d53-79db-4840-a7a0-10d0cb1d8020", "categories": { "regions": [ "us-east-1" ], "projects": [ null ], "solutions": [ "AWS Best Practices" ], "cloud_providers": [ "AWS" ], "services": [], "accounts": [ "@aa70acae-6ea8-3acf-b504-f327855b316a" ], "resource_groups": [], "apps": [] }, "startDate": 1745233971431, "linkedExecutionIds": null, "updatedAt": 1745233995210, "status": "Success" }, { "execution": "6ad5f333-c4ad-4008-b0d3-caab170d130b", "workflow": "f516bcf4-f6fb-46ac-a54f-ddbcf2a2d24a", "endDate": 1745234580143, "parDateKey": "2025-04-21T00:00:00.000Z", "executionType": "Simple", "source": "UI", "parentExecutionId": null, "tags": [ "created_by=0ffaf046-768b-79fc-83f6-aa25be52c2a1" ], "createdAt": 1745234555690, "customerId": "54f50897-26f3-c9af-83f9-e71459be70d9", "details": { "executionEndDate": 1745234580143 }, "id": "6ad5f333-c4ad-4008-b0d3-caab170d130b", "categories": { "regions": [ "us-east-1" ], "projects": [ null ], "solutions": [ "AWS Best Practices" ], "cloud_providers": [ "AWS" ], "services": [], "accounts": [ "@aa70acae-6ea8-3acf-b504-f327855b316a" ], "resource_groups": [], "apps": [] }, "startDate": 1745234555690, "linkedExecutionIds": null, "updatedAt": 1745234580184, "status": "Success" } ] }
Support for Variable Override in Run Workflow Public API
The Run Workflow Public API now supports overriding saved variables during workflow execution, offering greater flexibility in runtime configurations.
Previously, you could only execute workflows using predefined saved variables.
With this release, we have offered the input and variable parameters in the API body for you to add your override variables.
When overriding variables, ensure that values are provided for all Cloud-specific variables. You may reuse existing values, but no variable field should be left blank. For example, an AWS workflow variable override would require updating both Credentials and Region. Learn more about the available cloud-specific variables in the QFlow API guide.
You can generate the Connector UUID required for the workflow cloud credentials by executing the Get Connector APIs in TotalCloud. Learn more.
Run Workflow API
|
New or Updated API |
Updated |
|
API Endpoint |
/qflowapi/v1/workflows/{workflowId}/run |
|
Method |
POST |
|
DTD or XSD changes |
Not Applicable |
Use this API to initiate the execution of a specific workflow. It allows triggering automated processes with input parameters.
Input ParametersInput Parameters
|
Parameter |
Mandatory/Optional |
Data Type |
Description |
|---|---|---|---|
|
workflowId |
Mandatory |
String |
Provide a valid workflow ID. Ensure it is a Connector UUID. For example, '0ffaf046-xxxx-xxxx-xxxx-aa25be52c2a1' |
| input | Optional | String | Pass any JSON value to add to "variables":{ "credentials": "aa70acae-xxxx-xxxx-xxxx-f327855b316a", "region": "us-east-1", "name": "maha2" } |
|
Authorization |
Mandatory |
String |
An authorization token to authenticate to the Qualys Enterprise TruRisk Platform. Prepend the token with 'Bearer' and one space. For example - Bearer <authToken> |
Sample: Initiate execution of a workflow Sample: Initiate execution of a workflow
API Request
curl --location 'https://<qualys_gateway_url>.qualys.com/qflowapi/v1/workflows/6cad21c8-xxxx-xxx-xxxx-7372feafb5b4/run' \
--header 'accept: application/json' \
--header 'Authorization: <Token>' \
--header 'Content-Type: application/json' \
--data '{
"input": {
"bucketName": "test-bucket-1",
"totalBucketCount": 4
},
"variables":{
"credentials": "aa70acae-xxxx-xxxx-xxxx-f327855b316a",
"region": "us-east-1",
"name": "maha2"
}
}'
Response
{ "message": "Workflow execution started", "executionId": "497d0fe7-xxxx-xxxx-xxxx-3d90e904d1c5" }
Introduced a Parameter to Generate Output in JSON Object Format
Previously, with the 1.16.0 release, we introduced the Workflow Execution Input API and Execution Step Output APIs, which return the input/output of an execution step when provided with the nodeId.
With the 1.18.0 release, we have introduced a new optional parameter parseJson for both of the aforementioned APIs, the value of which, if provided as true in the request, retrieves the response in a JSON object format. If the parseJson value is false or the parameter is not provided, then by default it returns in a JSON String format.
Workflow Execution Input / Execution Step Output APIs
|
New or Updated API |
Updated |
|
API Endpoint |
/qflowapi/v1/executions/{executionId}/steps/{nodeId}/input /qflowapi/v1/executions/{executionId}/steps/{nodeId}/output |
|
Method |
GET |
|
DTD or XSD changes |
Not Applicable |
Input ParametersInput Parameters
|
Parameter |
Mandatory/Optional |
Data Type |
Description |
|---|---|---|---|
|
parseJson |
optional |
Boolean | Set to true to return the response in JSON object format. If set to false, and by default, the response returns JSON string format. |
Sample: Fetch the inputs of an execution stepSample: Fetch the inputs of an execution step
API Request
curl --location 'https://<qualys-gateway-url>.qualys.com/qflowapi/v1/executions/0e72b4a1-xxxx-xxxx-xxxx-91cd87506404/steps/node-e3a84822-qualysevent/input?parseJson=true' \ --header 'Authorization: Bearer <Token>' \ --header 'Accept: application/json'
Response
{ "selectedResource": { "selectedResourceId": "node-e3a84822-workflow-trigger", "path": "", "context": { "outputPath": "" }, "label": "WorkflowTrigger" }, "resourceGroup": [], "previousOutputPath": "", "method": "RunWorkflow", "credentials": "********************", "previousOutputIsModified": true, "project": [], "credentials_azure": "********************", "waitForCompletion": true, "executionId": "0e72b4a1-abea-45b2-9ae9-91cd87506404", "credentials_gcp": "********************", "cloudType": "QUALYS", "service": "QFLOW", "customerId": "54f50897-26f3-c9af-83f9-e71459be70d9", "conditionalSettings": { "expression": "", "conditions": [] }, "region": "us-east-1", "workflowId": "f516bcf4-f6fb-46ac-a54f-ddbcf2a2d24a", "resourceType": "Workflow", "previousOutputContext": { "outputPath": "" }, "collection": [ { "source": "WORKFLOW_TRIGGER", "customerId": "54f50897-26f3-c9af-83f9-e71459be70d9", "workflowId": "b47f74b7-b0e8-48f8-9934-7ce1b0680f2b", "input": { "collection": [ { "StoppingInstances": [ { "CurrentState": { "Code": 80, "Name": "stopped" }, "InstanceId": "i-0663d3f3e572608d5", "PreviousState": { "Code": 80, "Name": "stopped" } } ], "InstanceIds": [ "i-0663d3f3e572608d5" ] }, { "StoppingInstances": [ { "CurrentState": { "Code": 80, "Name": "stopped" }, "InstanceId": "i-0c6024ad8375f39ef", "PreviousState": { "Code": 80, "Name": "stopped" } } ], "InstanceIds": [ "i-0c6024ad8375f39ef" ] } ] }, "executionId": "93c29829-8efd-4dcb-bfb8-efd6bbb2b725", "forceRun": false, "overrideVariables": [ { "key": "depthCount", "value": 2, "type": "user-defined" }, { "key": "region", "value": [ "us-east-1" ], "type": "system-defined" }, { "key": "credentials", "value": [ { "type": "role", "arn": "arn:aws:iam::993493008830:role/QFLOW_1", "externalId": "AWS", "account": "993493008830", "accountId": "993493008830", "portalUuid": "53bcaf5b-b207-4eeb-b672-cb83a4776f70", "isMigrated": true, "connectorId": "53bcaf5b-b207-4eeb-b672-cb83a4776f70", "qflowConnectorId": "aa70acae-6ea8-3acf-b504-f327855b316a" } ], "type": "system-defined" }, { "type": "user-defined", "value": { "method": "stopInstances", "service": "EC2", "cloudtype": "AWS", "resourceType": "EC2_INSTANCE" }, "key": "rawParams" }, { "type": "user-defined", "value": { "maxAttempts": 40, "score": "0.8000", "delay": 15, "underlyingApi": "DescribeInstances", "parameterBindings": [ { "sourceProperty": "input.InstanceIds", "sourceConfidence": 0.4166666666666667, "linkConfidence": 0.7692307692307693, "targetProperty": "InstanceIds" } ], "params": { "Filters": [ { "Values": [ "<optional1>", "<optional2>" ], "Name": "<optional>" } ], "NextToken": "<optional>", "MaxResults": "<optional>", "InstanceIds": [ "obj.StoppingInstances.InstanceId" ] }, "operation": "describeInstances", "acceptors": [ { "argument": "Reservations[].Instances[].State.Name", "expected": "stopped", "state": "success", "matcher": "pathAll" }, { "argument": "Reservations[].Instances[].State.Name", "expected": "pending", "state": "failure", "matcher": "pathAny" }, { "argument": "Reservations[].Instances[].State.Name", "expected": "terminated", "state": "failure", "matcher": "pathAny" } ], "waitForState": "instanceStopped" }, "key": "selectedWaiter" }, { "type": "user-defined", "value": { "InstanceStopped": { "maxAttempts": 40, "score": "0.8000", "delay": 15, "underlyingApi": "DescribeInstances", "parameterBindings": [ { "sourceProperty": "input.InstanceIds", "sourceConfidence": 0.4166666666666667, "linkConfidence": 0.7692307692307693, "targetProperty": "InstanceIds" } ], "params": { "Filters": [ { "Values": [ "<optional1>", "<optional2>" ], "Name": "<optional>" } ], "NextToken": "<optional>", "MaxResults": "<optional>", "InstanceIds": [ "obj.StoppingInstances.InstanceId" ] }, "operation": "describeInstances", "acceptors": [ { "argument": "Reservations[].Instances[].State.Name", "expected": "stopped", "state": "success", "matcher": "pathAll" }, { "argument": "Reservations[].Instances[].State.Name", "expected": "pending", "state": "failure", "matcher": "pathAny" }, { "argument": "Reservations[].Instances[].State.Name", "expected": "terminated", "state": "failure", "matcher": "pathAny" } ], "waitForState": "instanceStopped" } }, "key": "waiters" } ] } ], "stepMessage": "Child workflow triggered", "success": true, "meta": { "shouldShowStepMessage": true, "step": { "message": "Child workflow triggered" }, "inputMeta": { "length": 0 }, "outputMeta": { "length": 0 } }, "globalVariables": { "region": "us-east-1", "resourceGroup": [], "project": [], "credentials": "********************", "credentials_azure": "********************", "credentials_gcp": "********************", "taskQueue": "soar_conductor_task" } }
Sample: Fetch the output of an execution stepSample: Fetch the output of an execution step
API Request
curl --location 'https://<qualys_gateway_url>.qualys.com/qflowapi/v1/executions/0e72b4a1-abea-45b2-9ae9-91cd87506404/steps/node-e3a84822-qualysevent/output&parseJson=false' \ --header 'Authorization: Bearer <Token>' \ --header 'Accept: application/json'
Response
[{\"source\":\"WORKFLOW_TRIGGER\",\"customerId\":\"54f50897-26f3-c9af-83f9-e71459be70d9\",\"workflowId\":\"b47f74b7-b0e8-48f8-9934-7ce1b0680f2b\",\"input\":{\"collection\":[{\"StoppingInstances\":[{\"CurrentState\":{\"Code\":80,\"Name\":\"stopped\"},\"InstanceId\":\"i-0663d3f3e572608d5\",\"PreviousState\":{\"Code\":80,\"Name\":\"stopped\"}}],\"InstanceIds\":[\"i-0663d3f3e572608d5\"]},{\"StoppingInstances\":[{\"CurrentState\":{\"Code\":80,\"Name\":\"stopped\"},\"InstanceId\":\"i-0c6024ad8375f39ef\",\"PreviousState\":{\"Code\":80,\"Name\":\"stopped\"}}],\"InstanceIds\":[\"i-0c6024ad8375f39ef\"]}]},\"executionId\":\"93c29829-8efd-4dcb-bfb8-efd6bbb2b725\",\"forceRun\":false,\"overrideVariables\":[{\"key\":\"depthCount\",\"value\":2,\"type\":\"user-defined\"},{\"key\":\"region\",\"value\":[\"us-east-1\"],\"type\":\"system-defined\"},{\"key\":\"credentials\",\"value\":[{\"type\":\"role\",\"arn\":\"arn:aws:iam::993493008830:role/QFLOW_1\",\"externalId\":\"AWS\",\"account\":\"993493008830\",\"accountId\":\"993493008830\",\"portalUuid\":\"53bcaf5b-b207-4eeb-b672-cb83a4776f70\",\"isMigrated\":true,\"connectorId\":\"53bcaf5b-b207-4eeb-b672-cb83a4776f70\",\"qflowConnectorId\":\"aa70acae-6ea8-3acf-b504-f327855b316a\"}],\"type\":\"system-defined\"},{\"type\":\"user-defined\",\"value\":{\"method\":\"stopInstances\",\"service\":\"EC2\",\"cloudtype\":\"AWS\",\"resourceType\":\"EC2_INSTANCE\"},\"key\":\"rawParams\"},{\"type\":\"user-defined\",\"value\":{\"maxAttempts\":40,\"score\":\"0.8000\",\"delay\":15,\"underlyingApi\":\"DescribeInstances\",\"parameterBindings\":[{\"sourceProperty\":\"input.InstanceIds\",\"sourceConfidence\":0.4166666666666667,\"linkConfidence\":0.7692307692307693,\"targetProperty\":\"InstanceIds\"}],\"params\":{\"Filters\":[{\"Values\":[\"<optional1>\",\"<optional2>\"],\"Name\":\"<optional>\"}],\"NextToken\":\"<optional>\",\"MaxResults\":\"<optional>\",\"InstanceIds\":[\"obj.StoppingInstances.InstanceId\"]},\"operation\":\"describeInstances\",\"acceptors\":[{\"argument\":\"Reservations[].Instances[].State.Name\",\"expected\":\"stopped\",\"state\":\"success\",\"matcher\":\"pathAll\"},{\"argument\":\"Reservations[].Instances[].State.Name\",\"expected\":\"pending\",\"state\":\"failure\",\"matcher\":\"pathAny\"},{\"argument\":\"Reservations[].Instances[].State.Name\",\"expected\":\"terminated\",\"state\":\"failure\",\"matcher\":\"pathAny\"}],\"waitForState\":\"instanceStopped\"},\"key\":\"selectedWaiter\"},{\"type\":\"user-defined\",\"value\":{\"InstanceStopped\":{\"maxAttempts\":40,\"score\":\"0.8000\",\"delay\":15,\"underlyingApi\":\"DescribeInstances\",\"parameterBindings\":[{\"sourceProperty\":\"input.InstanceIds\",\"sourceConfidence\":0.4166666666666667,\"linkConfidence\":0.7692307692307693,\"targetProperty\":\"InstanceIds\"}],\"params\":{\"Filters\":[{\"Values\":[\"<optional1>\",\"<optional2>\"],\"Name\":\"<optional>\"}],\"NextToken\":\"<optional>\",\"MaxResults\":\"<optional>\",\"InstanceIds\":[\"obj.StoppingInstances.InstanceId\"]},\"operation\":\"describeInstances\",\"acceptors\":[{\"argument\":\"Reservations[].Instances[].State.Name\",\"expected\":\"stopped\",\"state\":\"success\",\"matcher\":\"pathAll\"},{\"argument\":\"Reservations[].Instances[].State.Name\",\"expected\":\"pending\",\"state\":\"failure\",\"matcher\":\"pathAny\"},{\"argument\":\"Reservations[].Instances[].State.Name\",\"expected\":\"terminated\",\"state\":\"failure\",\"matcher\":\"pathAny\"}],\"waitForState\":\"instanceStopped\"}},\"key\":\"waiters\"}]}]