Search Detections

POST/api/1.0/detection/search

We have introduced the search detection API to search the detection for your subscription. You can apply filters to search the detection on specific models and detection criteria, such as, attack type, severity, category, and so on.

Use this API to list all the detections (or only the one matching the provided QQL).

All the newly introduced Activation Key APIs can be accessed only with the Qualys Gateway URLs. To learn more about using the API Gateway URL, refer API URLs section at Identify your Qualys Platform.

Input ParametersInput Parameters

Parameter	Data Type	Mandatory/Optional	Description
filter	String	Optional	Use this parameter to filter the detections based on the queries on models or detections. For the list of filters for models, refer to Search for Models. For the list of filters on detection, refer to Search for Detections.
fields	String	Optional	Use this parameter to specify a comma-separated list of fields to include in the response for each detection; if not provided, the default fields returned are id, qid, name, severity, attack, firstDetected.
scrollInfo	String	Optional	Use this parameter with the value retrieved in the previous search response to retrieve the next page. The scrollinfo appears in response only if the next page is available.
orderBy	String	Optional	Use this parameter to select the field by which to sort the records. You can order the results by id, qid, firstDetected or severity. Default value: id
sortOrder	String	Optional	Use this parameter to sort the results in ascending (ASC) or descending (DESC) order. Valid values: For ascending order: ASC For descending order: DESC Default order: ASC
size	Integer	Optional	Use this parameter to define the number of records to be displayed. Default value: 25

Parameter

Data Type

Mandatory/Optional

Description

filter

String

Optional

Use this parameter to filter the detections based on the queries on models or detections.

For the list of filters for models, refer to Search for Models.
For the list of filters on detection, refer to Search for Detections.

fields

String

Optional

Use this parameter to specify a comma-separated list of fields to include in the response for each detection; if not provided, the default fields returned are id, qid, name, severity, attack, firstDetected.

scrollInfo

String

Optional

Use this parameter with the value retrieved in the previous search response to retrieve the next page.

The scrollinfo appears in response only if the next page is available.

orderBy

String

Optional

Use this parameter to select the field by which to sort the records.
You can order the results by id, qid, firstDetected or severity.

Default value: id

sortOrder

String

Optional

Use this parameter to sort the results in ascending (ASC) or descending (DESC) order.

Valid values:
For ascending order: ASC
For descending order: DESC

Default order: ASC

size

Integer

Optional

Use this parameter to define the number of records to be displayed.

Default value: 25

Sample: Search DetectionSample: Search Detection

Request POST data

curl -X 'POST' \
  '<qualys_base_url>/tai/api/1.0/detection/search' \
  -H 'accept: application/json' \
  -H 'Authorization: Bearer <JWT_token>' \
  -H 'Content-Type: application/json' \
  -d '{
  "filter": {
    "modelQql": "model.lastScanStatus:FINISHED and model.runtime:AWS Bedrock or model.runtime:Hugging Face",
    "detectionQql": "detection.failTestPercentage>50 and detection.severity>=3"
  },
  "fields": "id, qid, name, attack, severity, firstDetected, lastDetected, lastTested, lastUpdated, result, totalQuestions, passedQuestions, failedQuestions, erroredQuestions, isJailBreak, failTestPercentage, description, consequence, solution, owaspTopTen, categories, model",
  "orderBy": "firstDetected",
  "sortOrder": "DESC",
  "size": "100"
}

API Response

{
  "totalElements": 60,
  "content": [
    {
      "id": 12345,
      "qid": 1234567,
      "name": "Always Jailbreaking Prompts Attack",
      "attack": "Jailbreak-Ajp",
      "severity": 5,
      "firstDetected": 1747391220000,
      "lastDetected": 1747395733000,
      "lastTested": 1747395733000,
      "lastUpdated": 1747395733000,
      "result": "FAIL",
      "totalQuestions": 49,
      "passedQuestions": 3,
      "failedQuestions": 46,
      "erroredQuestions": 0,
      "isJailBreak": true,
      "failTestPercentage": 94,
      "description": "The Jailbreak-AJPAttack poses a significant threat by exploiting the ability of AI to generate and execute harmful and unethical prompts through a manipulative persona called AJP, or Always Jailbreaking Prompts. ",
      "consequence": "The impact of the AJPAttack is considerable, as it could lead to the proliferation of illegal activities and unethical behaviors. By forcing the AI to act as an expert in crafting prompts for any situation, regardless of moral or legal boundaries, the AJP persona could enable users to engage in harmful actions such as fraud, hacking, or other malicious activities. This could result in serious societal harm, as individuals or groups could leverage AI-generated instructions to bypass security measures, spread disinformation, or engage in criminal enterprises. Moreover, the attack could severely undermine the trust users have in AI systems, causing reputational damage to platforms that fail to prevent such exploits.",
      "solution": "Mitigating the AJPAttack requires robust and dynamic countermeasures within AI systems. Strengthening AI safety protocols through continuous monitoring and refinement of ethical filters is critical. Implementing advanced adversarial training that can detect and neutralize manipulative personas like AJP is essential for closing off vulnerabilities. Additionally, AI developers should enhance prompt filtering systems to identify and block instructions that push the AI to act as different characters designed to bypass restrictions. Continuous updates and collaboration between AI safety experts, security teams, and regulatory bodies will be necessary to prevent evolving attacks like AJP and maintain the ethical and secure operation of AI platforms.",
      "owaspTopTen": [
        {
          "id": 20001,
          "name": "LLM01: Prompt Injection",
          "year": 2024,
          "url": "https://genai.owasp.org/llmrisk/llm01-prompt-injection/"
        },
        {
          "id": 20003,
          "name": "LLM03: Training Data Poisoning",
          "year": 2024,
          "url": "https://genai.owasp.org/llmrisk/llm03-training-data-poisoning/"
        }
      ],
      "categories": [
        {
          "id": 30018,
          "name": "Jailbreak",
          "year": 20
        }
      ],
      "model": {
        "id": 68372070,
        "name": "Automation-External-Hugging Face - 2025-05-16 14:09:43.628"
      }
    }

Sample: Get owaspTopTen's specific fieldSample: Get owaspTopTen's specific field

Request POST Data

 curl -X 'POST' \
  '<qualys_base_url>/tai/api/1.0/detection/search' \
  -H 'accept: application/json' \
  -H 'Authorization: Bearer <JWT_token>' \
  -H 'Content-Type: application/json' \
  -d '{
  "filter": {
    "modelQql": "model.runtime:Azure OpenAI or model.runtime:Chat Completion",
    "detectionQql": "detection.failTestPercentage>10"
  },
  "fields": "id, qid, name, attack, severity, result, totalQuestions, isJailBreak, failTestPercentage, owaspTopTen.name, ,owaspTopTen.id,owaspTopTen.url,categories, model",
  "orderBy": "severity",
  "sortOrder": "ASC",
  "size": "6"
}

API Response

 {
  "totalElements": 104,
  "scrollInfo": "eyJzb3J0VmFsdWVzIjpbMV19",
  "content": [
    {
      "id": 21724,
      "qid": 6330002,
      "name": "Factual Inconsistencies Detected",
      "attack": "Risk Category",
      "severity": 1,
      "result": "FAIL",
      "totalQuestions": 48,
      "failTestPercentage": 34,
      "owaspTopTen": [
        {
          "id": 20001,
          "name": "LLM01: Prompt Injection",
          "url": "https://genai.owasp.org/llmrisk/llm01-prompt-injection/"
        },
        {
          "id": 20002,
          "name": "LLM02: Insecure Output Handling",
          "url": "https://genai.owasp.org/llmrisk/llm02-insecure-output-handling/"
        }
      ],
      "categories": [
        {
          "id": 30003,
          "name": "Factual Inconsistencies",
          "year": 20
        }
      ],
      "model": {
        "id": 63732611,
        "name": "Azure AI Full attack -Internal"
      }
    },
    {
      "id": 21723,
      "qid": 6330001,
      "name": "Excessive Actions Detected",
      "attack": "Risk Category",
      "severity": 1,
      "result": "FAIL",
      "totalQuestions": 5,
      "failTestPercentage": 80,
      "owaspTopTen": [
        {
          "id": 20008,
          "name": "LLM08: Excessive Agency",
          "url": "https://genai.owasp.org/llmrisk/llm08-excessive-agency/"
        }
      ],
      "categories": [
        {
          "id": 30002,
          "name": "Excessive Agency",
          "year": 20
        }
      ],
      "model": {
        "id": 63732611,
        "name": "Azure AI Full attack -Internal"
      }
    },
    {
      "id": 21730,
      "qid": 6330008,
      "name": "Over-reliance Possibility Detected",
      "attack": "Risk Category",
      "severity": 1,
      "result": "FAIL",
      "totalQuestions": 3,
      "failTestPercentage": 100,
      "owaspTopTen": [
        {
          "id": 20009,
          "name": "LLM09: Overreliance",
          "url": "https://genai.owasp.org/llmrisk/llm09-overreliance/"
        }
      ],
      "categories": [
        {
          "id": 30009,
          "name": "Overreliance",
          "year": 20
        }
      ],
      "model": {
        "id": 63732611,
        "name": "Azure AI Full attack -Internal"
      }
    },
    {
      "id": 25601,
      "qid": 6330016,
      "name": "AntiGPT Jailbreak Vulnerability",
      "attack": "Jailbreak-AntiGpt",
      "severity": 1,
      "result": "FAIL",
      "totalQuestions": 49,
      "isJailBreak": true,
      "failTestPercentage": 15,
      "owaspTopTen": [
        {
          "id": 20003,
          "name": "LLM03: Training Data Poisoning",
          "url": "https://genai.owasp.org/llmrisk/llm03-training-data-poisoning/"
        }
      ],
      "categories": [
        {
          "id": 30017,
          "name": "OWASP LLM Top 10",
          "year": 20
        },
        {
          "id": 30018,
          "name": "Jailbreak",
          "year": 20
        }
      ],
      "model": {
        "id": 67769007,
        "name": "1.3.0.0-Chat completion"
      }
    },
    {
      "id": 25607,
      "qid": 6330022,
      "name": "EvilConfidant Jailbreak Attack",
      "attack": "Jailbreak-Evil",
      "severity": 1,
      "result": "FAIL",
      "totalQuestions": 49,
      "isJailBreak": true,
      "failTestPercentage": 15,
      "owaspTopTen": [
        {
          "id": 20003,
          "name": "LLM03: Training Data Poisoning",
          "url": "https://genai.owasp.org/llmrisk/llm03-training-data-poisoning/"
        }
      ],
      "categories": [
        {
          "id": 30017,
          "name": "OWASP LLM Top 10",
          "year": 20
        },
        {
          "id": 30018,
          "name": "Jailbreak",
          "year": 20
        }
      ],
      "model": {
        "id": 67769007,
        "name": "1.3.0.0-Chat completion"
      }
    },
    {
      "id": 27671,
      "qid": 6330008,
      "name": "Over-reliance Possibility Detected",
      "attack": "Risk Category",
      "severity": 1,
      "result": "FAIL",
      "totalQuestions": 3,
      "failTestPercentage": 100,
      "owaspTopTen": [
        {
          "id": 20009,
          "name": "LLM09: Overreliance",
          "url": "https://genai.owasp.org/llmrisk/llm09-overreliance/"
        }
      ],
      "categories": [
        {
          "id": 30009,
          "name": "Overreliance",
          "year": 20
        }
      ],
      "model": {
        "id": 68372463,
        "name": "RC Build -DND-Azure Open AI-gpt-4o-mini"
      }
    }
  ]
}

Sample: Get categories' specific fieldSample: Get categories' specific field

Request POST Data

 curl -X 'POST' \
  '<qualys_base_url>/tai/api/1.0/detection/search' \
  -H 'accept: application/json' \
  -H 'Authorization: Bearer <JWT_token>' \
  -H 'Content-Type: application/json' \
  -d '{
  "filter": {
    "modelQql": "model.runtime:Hugging Face ",
    "detectionQql": "detection.category.name:Illegal Activities "
  },
  "fields": "id, qid, name, attack, severity, result, totalQuestions, isJailBreak, failTestPercentage, owaspTopTen, categories.name,categories.year, model",
  "orderBy": "id",
  "sortOrder": "DESC",
  "size": "25"
}

API Response

 {
  "totalElements": 9,
  "content": [
    {
      "id": 21836,
      "qid": 6330005,
      "name": "Illegal Activities Encouraged",
      "attack": "Risk Category",
      "severity": 5,
      "result": "FAIL",
      "totalQuestions": 174,
      "failTestPercentage": 10,
      "owaspTopTen": [
        {
          "id": 20001,
          "name": "LLM01: Prompt Injection",
          "year": 2024,
          "url": "https://genai.owasp.org/llmrisk/llm01-prompt-injection/"
        },
        {
          "id": 20003,
          "name": "LLM03: Training Data Poisoning",
          "year": 2024,
          "url": "https://genai.owasp.org/llmrisk/llm03-training-data-poisoning/"
        }
      ],
      "categories": [
        {
          "name": "Illegal Activities",
          "year": 20
        }
      ],
      "model": {
        "id": 63733210,
        "name": "Hugging face Full attack-External"
      }
    },
    {
      "id": 20810,
      "qid": 6330005,
      "name": "Illegal Activities Encouraged",
      "attack": "Risk Category",
      "severity": 5,
      "result": "FAIL",
      "totalQuestions": 174,
      "failTestPercentage": 9,
      "owaspTopTen": [
        {
          "id": 20001,
          "name": "LLM01: Prompt Injection",
          "year": 2024,
          "url": "https://genai.owasp.org/llmrisk/llm01-prompt-injection/"
        },
        {
          "id": 20003,
          "name": "LLM03: Training Data Poisoning",
          "year": 2024,
          "url": "https://genai.owasp.org/llmrisk/llm03-training-data-poisoning/"
        }
      ],
      "categories": [
        {
          "name": "Illegal Activities",
          "year": 20
        }
      ],
      "model": {
        "id": 63715392,
        "name": "NJ - HuggingFace - External - KB"
      }
    },
    {
      "id": 5641,
      "qid": 6330005,
      "name": "Illegal Activities Encouraged",
      "attack": "Risk Category",
      "severity": 5,
      "result": "FAIL",
      "totalQuestions": 174,
      "failTestPercentage": 10,
      "owaspTopTen": [
        {
          "id": 20001,
          "name": "LLM01: Prompt Injection",
          "year": 2024,
          "url": "https://genai.owasp.org/llmrisk/llm01-prompt-injection/"
        },
        {
          "id": 20003,
          "name": "LLM03: Training Data Poisoning",
          "year": 2024,
          "url": "https://genai.owasp.org/llmrisk/llm03-training-data-poisoning/"
        }
      ],
      "categories": [
        {
          "name": "Illegal Activities",
          "year": 20
        }
      ],
      "model": {
        "id": 60583695,
        "name": "fullscanperftest2"
      }
    },
    {
      "id": 5406,
      "qid": 6330005,
      "name": "Illegal Activities Encouraged",
      "attack": "Risk Category",
      "severity": 5,
      "result": "FAIL",
      "totalQuestions": 174,
      "failTestPercentage": 7,
      "owaspTopTen": [
        {
          "id": 20001,
          "name": "LLM01: Prompt Injection",
          "year": 2024,
          "url": "https://genai.owasp.org/llmrisk/llm01-prompt-injection/"
        },
        {
          "id": 20003,
          "name": "LLM03: Training Data Poisoning",
          "year": 2024,
          "url": "https://genai.owasp.org/llmrisk/llm03-training-data-poisoning/"
        }
      ],
      "categories": [
        {
          "name": "Illegal Activities",
          "year": 20
        }
      ],
      "model": {
        "id": 60560089,
        "name": "RC Model HFT"
      }
    },
    {
      "id": 3040,
      "qid": 6330005,
      "name": "Illegal Activities Encouraged",
      "attack": "Risk Category",
      "severity": 5,
      "result": "FAIL",
      "totalQuestions": 174,
      "failTestPercentage": 6,
      "owaspTopTen": [
        {
          "id": 20001,
          "name": "LLM01: Prompt Injection",
          "year": 2024,
          "url": "https://genai.owasp.org/llmrisk/llm01-prompt-injection/"
        },
        {
          "id": 20003,
          "name": "LLM03: Training Data Poisoning",
          "year": 2024,
          "url": "https://genai.owasp.org/llmrisk/llm03-training-data-poisoning/"
        }
      ],
      "categories": [
        {
          "name": "Illegal Activities",
          "year": 20
        }
      ],
      "model": {
        "id": 58986717,
        "name": "Automation Test Model - Hugging Face - 2024-10-18 13:12:23.054"
      }
    },
    {
      "id": 3024,
      "qid": 6330005,
      "name": "Illegal Activities Encouraged",
      "attack": "Risk Category",
      "severity": 5,
      "result": "FAIL",
      "totalQuestions": 174,
      "failTestPercentage": 9,
      "owaspTopTen": [
        {
          "id": 20001,
          "name": "LLM01: Prompt Injection",
          "year": 2024,
          "url": "https://genai.owasp.org/llmrisk/llm01-prompt-injection/"
        },
        {
          "id": 20003,
          "name": "LLM03: Training Data Poisoning",
          "year": 2024,
          "url": "https://genai.owasp.org/llmrisk/llm03-training-data-poisoning/"
        }
      ],
      "categories": [
        {
          "name": "Illegal Activities",
          "year": 20
        }
      ],
      "model": {
        "id": 60031767,
        "name": "testfullscanllama1"
      }
    },
    {
      "id": 2031,
      "qid": 6330005,
      "name": "Illegal Activities Encouraged",
      "attack": "Risk Category",
      "severity": 5,
      "result": "FAIL",
      "totalQuestions": 174,
      "failTestPercentage": 26,
      "owaspTopTen": [
        {
          "id": 20001,
          "name": "LLM01: Prompt Injection",
          "year": 2024,
          "url": "https://genai.owasp.org/llmrisk/llm01-prompt-injection/"
        },
        {
          "id": 20003,
          "name": "LLM03: Training Data Poisoning",
          "year": 2024,
          "url": "https://genai.owasp.org/llmrisk/llm03-training-data-poisoning/"
        }
      ],
      "categories": [
        {
          "name": "Illegal Activities",
          "year": 20
        }
      ],
      "model": {
        "id": 59833167,
        "name": "testfullscan12"
      }
    },
    {
      "id": 342,
      "qid": 6330005,
      "name": "Illegal Activities Encouraged",
      "attack": "Risk Category",
      "severity": 5,
      "result": "FAIL",
      "totalQuestions": 174,
      "failTestPercentage": 9,
      "owaspTopTen": [
        {
          "id": 20001,
          "name": "LLM01: Prompt Injection",
          "year": 2024,
          "url": "https://genai.owasp.org/llmrisk/llm01-prompt-injection/"
        },
        {
          "id": 20003,
          "name": "LLM03: Training Data Poisoning",
          "year": 2024,
          "url": "https://genai.owasp.org/llmrisk/llm03-training-data-poisoning/"
        }
      ],
      "categories": [
        {
          "name": "Illegal Activities",
          "year": 20
        }
      ],
      "model": {
        "id": 58986124,
        "name": "Automation Test Model - Hugging Face - 2024-10-18 13:09:32.148"
      }
    },
    {
      "id": 326,
      "qid": 6330005,
      "name": "Illegal Activities Encouraged",
      "attack": "Risk Category",
      "severity": 5,
      "result": "FAIL",
      "totalQuestions": 174,
      "failTestPercentage": 11,
      "owaspTopTen": [
        {
          "id": 20001,
          "name": "LLM01: Prompt Injection",
          "year": 2024,
          "url": "https://genai.owasp.org/llmrisk/llm01-prompt-injection/"
        },
        {
          "id": 20003,
          "name": "LLM03: Training Data Poisoning",
          "year": 2024,
          "url": "https://genai.owasp.org/llmrisk/llm03-training-data-poisoning/"
        }
      ],
      "categories": [
        {
          "name": "Illegal Activities",
          "year": 20
        }
      ],
      "model": {
        "id": 58986116,
        "name": "Test Model with Hugging Face-KB attack-updated"
      }
    }
  ]
}

Last updated: July, 2026