TotalAI Release 2.0 API

September 9, 2026

This release adds connector-based (credential-free) authentication for AWS Bedrock and Azure OpenAI models, plus a full new Asset API for creating, searching, updating, counting, and deleting AI assets like LLM models and MCP servers.

Before reviewing the API release highlights, learn more about the API server URL to use in your API requests by referring to the "Know Your Qualys API Server URL" section. For this API Release Notes, <qualys_base_url> is mentioned in the sample API requests.

AI Model Connector-based Authentication

With this release, you can authenticate an AWS Bedrock or Azure OpenAI model using an existing connector instead of providing long-lived credentials when creating a new model or updating an existing one:

Asset API

With this release, we are introducing the following Asset APIs to create, retrieve, search, update, count, and delete AI assets, including LLM models and MCP servers, in your account:

New API

New API: Create an Asset

New or Updated API New
API Endpoint /api/1.1/asset/
Method POST
DTD or XSD changes Not Applicable

Create a new asset with the provided attributes. This feature supports creating LLM models and MCP servers with their respective configurations. Required fields vary based on the asset type and runtime.

 The owner field is read-only, and the system automatically sets it to the authenticated user.

Sample: Create an LLM AssetSample: Create an LLM Asset

API Request

{
  "name": "test model create from Public API 2026-07-17T14:26",
  "type": "LLM",
  "modelId": "vertex-g-123",
  "runtime": "GOOGLE_VERTEX",
  "region": "europe-west1",
  "endpointId": "xxxxx",
  "projectId": "xxxxx",
  "optionProfile": {
    "id": "xxxxx"
  },
    "authRecord": {
    "authType": "SERVICE_ACCOUNT",
    "serviceAccountAuthInputType": "JSON",
    "serviceAccountFileContent": "ewogICJlbXB0eSI6ICJkYXRhIgp9Cg==",
    "serviceAccountFileName": "filename.json"
  }
}

API Response

Response 200 - LLM creation

{
  "id": "xxxxx",
  "uuid": "xxxxx",
  "name": "test model create from Public API 2026-07-17T14:26",
  "type": "LLM",
  "createdDate": 1784298400661,
  "lastUpdatedDate": 1784298400661,
  "createdBy": {
    "username": "test_jd",
    "firstname": "John",
    "lastname": "Doe"
  },
  "updatedBy": {
    "username": "test_jd",
    "firstname": "John",
    "lastname": "Doe"
  },
  "modelId": "vertex-g-123",
  "runtime": "GOOGLE_VERTEX",
  "url": "https://europe-west1-aiplatform.googleapis.com",
  "region": "europe-west1",
  "projectId": "xxxxx",
  "endpointId": "xxxxx",
  "status": "CONFIRMED",
  "scannerLocked": false,
  "authRecord": {
    "authType": "SERVICE_ACCOUNT",
    "serviceAccountFileContent": "KioqKio=",
    "serviceAccountFileName": "filename.json",
    "serviceAccountAuthInputType": "JSON"
  },
  "optionProfile": {
    "id": "xxxxx",
    "name": "OP - John Doe"
  },
  "owner": {
    "id": "xxxxx",
    "uuid": "xxxxx",
    "username": "test_jd",
    "firstName": "John",
    "lastName": "Doe"
  }
}

Response 400 - The field [Description] does not exist.

{
  "errorCode": "QAPI-400004",
  "message": "The field [{field}] does not exist.",
  "hint": "Check the documentation for the list of possible fields.",
  "details": "The field [Description] does not exist.",
  "parameters": {
    "field": "Description"
  },
  "timestamp": 1766397052701
}

Response 401 - Invalid QAS token provided.

{
  "errorCode": "QAPI-401001",
  "message": "Invalid QAS token provided.",
  "hint": "Re-authenticate using your front office username and password.",
  "timestamp": 1749023966241
}

Response 401 - Invalid QAS token type provided.

{
  "errorCode": "QAPI-401002",
  "message": "Invalid QAS token type provided.",
  "hint": "Re-authenticate using your front office username and password.",
  "timestamp": 1749023966242
}

Response 401 - QAS authentication failed.

{
  "errorCode": "QAPI-401003",
  "message": "QAS authentication failed.",
  "hint": "Make sure to authenticate with your front office username and password.",
  "timestamp": 1749023966243
}

Response 401 - QAS bearer token not found.

{
  "errorCode": "QAPI-401004",
  "message": "QAS bearer token not found.",
  "hint": "Make sure to authenticate with your front office username and password.",
  "timestamp": 1749023966244
}

Response 401 - Unauthorized TAI Module Access.

{
  "errorCode": "QAPI-401005",
  "message": "Unauthorized {module} Module Access.",
  "hint": "Request access to the module from your account manager.",
  "timestamp": 1751378140433,
  "parameters": {
    "module": "TAI"
  }
}

Response 401 - Unauthorized API Access.

{
  "errorCode": "QAPI-401006",
  "message": "Unauthorized API Access.",
  "hint": "Request API access from your account manager.",
  "timestamp": 1751378140434
}

Response 404 - Tag not found with UUID [xxxxx].

{
  "errorCode": "QAPI-404003",
  "message": "Tag not found with UUID [{uuid}].",
  "hint": "Verify the provided UUID is correct.",
  "timestamp": 1766395789612,
  "parameters": {
    "uuid": "xxxxx"
  }
}

Response 404 - Tag not found with ID [xxxxx].

{
  "errorCode": "QAPI-404002",
  "message": "Tag not found with ID [{id}].",
  "hint": "Verify the provided ID is correct.",
  "timestamp": 1766396169637,
  "parameters": {
    "id": "xxxxx"
  }
}

Response 404 - Option Profile not found with ID [xxxxx].

{
  "errorCode": "QTAI-404004",
  "message": "Option Profile not found with ID [{id}].",
  "hint": "Verify the provided ID is correct and is in user scope.",
  "timestamp": 1766396388669,
  "parameters": {
    "id": "xxxxx"
  }
}

Response 500 - An error occurred while processing the request.

{
  "errorCode": "QAPI-500001",
  "message": "An error occurred while processing the request.",
  "hint": "Contact your account manager.",
  "timestamp": 1749023966241
}

New API

NEW API: Count Assets

New or Updated API New
API Endpoint /api/1.1/asset/count
Method POST
DTD or XSD changes Not Applicable

Count all assets or only those that match the provided QQL filter. This operation returns the total number of accessible assets and applies the specified QQL criteria when provided. Use it to get quick statistics without retrieving full asset data.

Sample: Asset CountSample: Asset Count

API Request

{
  "filter": {
    "assetQql": "asset.id: {{createdModelID}}"
  }
}

API Response

Response 200 - Asset Count

{
  "count": 1
}

Response 401 - Invalid QAS token provided.

{
  "errorCode": "QAPI-401001",
  "message": "Invalid QAS token provided.",
  "hint": "Re-authenticate using your front office username and password.",
  "timestamp": 1749023966241
}

Response 401 - Invalid QAS token type provided.

{
  "errorCode": "QAPI-401002",
  "message": "Invalid QAS token type provided.",
  "hint": "Re-authenticate using your front office username and password.",
  "timestamp": 1749023966242
}

Response 401 - QAS authentication failed.

{
  "errorCode": "QAPI-401003",
  "message": "QAS authentication failed.",
  "hint": "Make sure to authenticate with your front office username and password.",
  "timestamp": 1749023966243
}

Response 401 - QAS bearer token not found.

{
  "errorCode": "QAPI-401004",
  "message": "QAS bearer token not found.",
  "hint": "Make sure to authenticate with your front office username and password.",
  "timestamp": 1749023966244
}

Response 401 - Unauthorized TAI Module Access.

{
  "errorCode": "QAPI-401005",
  "message": "Unauthorized {module} Module Access.",
  "hint": "Request access to the module from your account manager.",
  "timestamp": 1751378140433,
  "parameters": {
    "module": "TAI"
  }
}

Response 401 - Unauthorized API Access.

{
  "errorCode": "QAPI-401006",
  "message": "Unauthorized API Access.",
  "hint": "Request API access from your account manager.",
  "timestamp": 1751378140434
}

Response 500 - An error occurred while processing the request.

{
  "errorCode": "QAPI-500001",
  "message": "An error occurred while processing the request.",
  "hint": "Contact your account manager.",
  "timestamp": 1749023966241
}

New API

New API: Delete Asset(s) Using Filter

New or Updated API New
API Endpoint /api/1.1/asset/delete
Method POST
DTD or XSD changes Not Applicable

Delete multiple assets that match the specified QQL query criteria in a single operation. This operation permanently removes all assets that match the provided filter. The response includes the ID of each deleted asset and the deletion status for each operation (success, failure, or partial). Verify that the QQL query is correct before executing this operation, as it deletes all matching assets. This operation performs the equivalent of searching for assets and deleting each result individually, but executes the entire process as a single bulk operation.

Sample: Delete Assets Matching a FilterSample: Delete Assets Matching a Filter

API Request

{
  "filter": {
    "assetQql": "asset.name: Test Hugging Face"
  }
}

API Response

Response 200 - Asset Delete Matching

{
  "entries": [
    {
      "entityId": "xxxxx",
      "status": "SUCCESS"
    },
    {
      "entityId": "xxxxx",
      "status": "SUCCESS"
    }
  ]
}

Response 200 - Asset Delete No Match

{}

Response 401 - Invalid QAS token provided.

{
  "errorCode": "QAPI-401001",
  "message": "Invalid QAS token provided.",
  "hint": "Re-authenticate using your front office username and password.",
  "timestamp": 1749023966241
}

Response 401 - Invalid QAS token type provided.

{
  "errorCode": "QAPI-401002",
  "message": "Invalid QAS token type provided.",
  "hint": "Re-authenticate using your front office username and password.",
  "timestamp": 1749023966242
}

Response 401 - QAS authentication failed.

{
  "errorCode": "QAPI-401003",
  "message": "QAS authentication failed.",
  "hint": "Make sure to authenticate with your front office username and password.",
  "timestamp": 1749023966243
}

Response 401 - QAS bearer token not found.

{
  "errorCode": "QAPI-401004",
  "message": "QAS bearer token not found.",
  "hint": "Make sure to authenticate with your front office username and password.",
  "timestamp": 1749023966244
}

Response 401 - Unauthorized TAI Module Access.

{
  "errorCode": "QAPI-401005",
  "message": "Unauthorized {module} Module Access.",
  "hint": "Request access to the module from your account manager.",
  "timestamp": 1751378140433,
  "parameters": {
    "module": "TAI"
  }
}

Response 401 - Unauthorized API Access.

{
  "errorCode": "QAPI-401006",
  "message": "Unauthorized API Access.",
  "hint": "Request API access from your account manager.",
  "timestamp": 1751378140434
}

Response 500 - An error occurred while processing the request.

{
  "errorCode": "QAPI-500001",
  "message": "An error occurred while processing the request.",
  "hint": "Contact your account manager.",
  "timestamp": 1749023966241
}

New API

Search Assets

New or Updated API New
API Endpoint /api/1.1/asset/search
Method POST
DTD or XSD changes Not Applicable

Search and retrieve assets that match the specified QQL criteria, with support for pagination, sorting, and field selection. When the fields parameter is omitted, this operation returns the default response fields. When fields is specified, it returns only the selected fields. In both cases, the response includes only non-null values.

Available Response FieldsAvailable Response Fields

Field Description
id Asset identifier
uuid Asset universally unique identifier
name Asset name
type Asset type (LLM or MCP)
createdDate Creation timestamp in milliseconds since epoch
lastUpdatedDate Last updated timestamp in milliseconds since epoch
lastScanDate Last scan timestamp in milliseconds since epoch
confirmedDate Last confirmed timestamp in milliseconds since epoch
createdBy User who created the asset
createdBy.firstName Creator first name
createdBy.id Creator user identifier
createdBy.lastName Creator last name
createdBy.username Creator username
updatedBy User who last updated the asset
updatedBy.firstName Updater first name
updatedBy.id Updater user identifier
updatedBy.lastName Updater last name
updatedBy.username Updater username
updatedDate Last updated timestamp in milliseconds since epoch
modelId Model ID, in case of an LLM asset
runtime Associated runtime (always MCP_SERVER for MCP assets)
version Asset version
description Optional description
url URL
region Region
openAIVersion OpenAI version
projectId Project ID
endpointId Endpoint ID
status Status (POTENTIAL or CONFIRMED)
payload Optional payload saved from scan
launchEligible Indicates whether scan launch is allowed
endpoints MCP server endpoints (not applicable for LLM assets)
tags Organization tags for grouping and filtering
tags.id Tag identifier
tags.uuid Tag UUID
tags.name Tag name
scannerLocked Indicates whether the scanner is locked
defaultScanner Default scanner
defaultScanner.id Default scanner identifier
defaultScanner.name Default scanner name
defaultScannerTags Default scanner tags
defaultScannerTags.id Tag identifier
defaultScannerTags.uuid Tag UUID
defaultScannerTags.name Tag name
authRecord Associated auth record
authRecord.authType Auth type (BEARER_TOKEN, ACCESS_KEY_SECRET_KEY, ASSUME_ROLE, API_KEY, SERVICE_ACCOUNT, BASIC)
authRecord.bearerToken Bearer token
authRecord.accessKey Access key
authRecord.secretKey Secret key
authRecord.apiKey API key
authRecord.serviceAccountFileContent Service account file contents (Base64 encoded)
authRecord.serviceAccountFileName Service account file name
authRecord.serviceAccountAuthInputType Service account auth input type
authRecord.basicUsername Basic username
authRecord.basicPassword Basic password
optionProfile Option profile (not applicable for MCP assets)
optionProfile.id Option profile identifier (not applicable for MCP assets)
optionProfile.name Option profile name (not applicable for MCP assets)
owner User who owns the asset
owner.firstName Owner first name
owner.id Owner user identifier
owner.lastName Owner last name
owner.username Owner username

Default Response Fields: id, uuid, name, type, tags, lastUpdatedDate.

Supported Order By Fields:

Field Description
id Sort by asset identifier
name Sort by asset name
lastUpdatedDate Sort by last updated date
type Sort by asset type

Sample: Search Assets by NameSample: Search Assets by Name

API Request

{
  "fields": "id,name,type,createdDate,lastUpdatedDate,lastScanDate,confirmedDate,createdBy,updatedBy,modelId,runtime,version,description,url,region,openAIVersion,projectId,endpointId,status,payload,endpoints,tags,scannerLocked,defaultScanner,defaultScannerTags,authRecord,optionProfile,owner,launchEligible",
  "filter": {
    "assetQql": "asset.name: Test Hugging Face"
  },
  "size": 3
}

API Response

Response 200 - Search Assets by Name

{
  "totalElements": 26,
  "scrollInfo": "eyJwYWdlIjoxLCJzaXplIjo1MH0=",
  "content": [
    {
      "id": "xxxxx",
      "name": "Test Hugging Face + Jailbreak",
      "type": "LLM",
      "createdDate": 1728027247000,
      "lastUpdatedDate": 1730114631000,
      "lastScanDate": 1730116594000,
      "createdBy": {
        "username": "test_jd",
        "firstname": "John",
        "lastname": "Doe"
      },
      "updatedBy": {
        "username": "#SYSTEM-USER#@Test_1365221",
        "firstname": "SYSTEM",
        "lastname": "USER"
      },
      "modelId": "llama3",
      "runtime": "HUGGINGFACE_TGI_SERVER",
      "url": "http://10.88.33.110:8083",
      "status": "CONFIRMED",
      "launchEligible": true,
      "scannerLocked": false,
      "authRecord": {
        "authType": "BEARER_TOKEN",
        "bearerToken": "*****"
      },
      "optionProfile": {
        "id": "xxxxx",
        "name": "Test Hugging Face + Jailbreak-Option Profile"
      }
    },
    {
      "id": "xxxxx",
      "name": "TestHuggingInterfaceExternal_Bedrock",
      "type": "LLM",
      "createdDate": 1728902047000,
      "lastUpdatedDate": 1737784058000,
      "lastScanDate": 1737784739000,
      "createdBy": {
        "username": "test_jd",
        "firstname": "John",
        "lastname": "Doe"
      },
      "updatedBy": {
        "username": "#SYSTEM-USER#@Test_1365221",
        "firstname": "SYSTEM",
        "lastname": "USER"
      },
      "modelId": "meta.llama3-8b-instruct-v1:0",
      "runtime": "AWS_BEDROCK",
      "description": "The Mistral-Nemo-Instruct-2407 Large Language Model (LLM) is an instruct fine-tuned version of the Mistral-Nemo-Base-2407. Trained jointly by Mistral AI and NVIDIA, it significantly outperforms existing models smaller or similar in size.",
      "url": "https://bedrock-runtime.us-west-2.amazonaws.com",
      "region": "US West (Oregon)",
      "status": "CONFIRMED",
      "launchEligible": false,
      "tags": [
        {
          "uuid": "xxxxx",
          "name": "AI_ANJ_Test"
        }
      ],
      "scannerLocked": false,
      "defaultScanner": {
        "id": "xxxxx",
        "name": "test64bit_LLM"
      },
      "authRecord": {
        "authType": "ACCESS_KEY_SECRET_KEY",
        "bearerToken": "*****",
        "accessKey": "*****",
        "secretKey": "*****"
      },
      "optionProfile": {
        "id": "xxxxx",
        "name": "TestHuggingInterfaceExternal_Bedrock-Option Profile"
      }
    },
    {
      "id": "xxxxx",
      "name": "Test Model with Hugging Face-KB attack-updated",
      "type": "LLM",
      "createdDate": 1729154103000,
      "lastUpdatedDate": 1778165415000,
      "lastScanDate": 1778167123000,
      "createdBy": {
        "username": "test_jd",
        "firstname": "John",
        "lastname": "Doe"
      },
      "updatedBy": {
        "username": "#SYSTEM-USER#@Test_1365221",
        "firstname": "SYSTEM",
        "lastname": "USER"
      },
      "modelId": "meta.llama3-8b-instruct-v1:0",
      "runtime": "HUGGINGFACE_TGI_SERVER",
      "url": "http://10.88.33.110:8083",
      "status": "CONFIRMED",
      "launchEligible": true,
      "scannerLocked": false,
      "authRecord": {
        "authType": "BEARER_TOKEN",
        "bearerToken": "*****"
      },
      "optionProfile": {
        "id": "xxxxx",
        "name": "Test Model with Hugging Face-KB attack-updated-Option Profile"
      }
    }
  ]
}

Response 400 - Invalid orderBy field [invalidField].

{
  "errorCode": "QAPI-400001",
  "message": "Invalid orderBy field [{orderBy}].",
  "hint": "Verify the possible orderBy field values.",
  "timestamp": 1750686790423,
  "parameters": {
    "orderBy": "invalidField"
  }
}

Response 400 - The token [asset.namo] is not supported.

{
  "errorCode": "QAPI-400005",
  "message": "The token [{name}] is not supported.",
  "hint": "Check the documentation for the list of possible QQL tokens.",
  "timestamp": 1764166727749,
  "parameters": {
    "name": "asset.namo"
  }
}

Response 400 - The field [invalidField] does not exist.

{
  "errorCode": "QAPI-400004",
  "message": "The field [{field}] does not exist.",
  "hint": "Check the documentation for the list of possible fields.",
  "timestamp": 1784739281044,
  "parameters": {
    "field": "invalidField"
  }
}

Response 401 - Invalid QAS token provided.

{
  "errorCode": "QAPI-401001",
  "message": "Invalid QAS token provided.",
  "hint": "Re-authenticate using your front office username and password.",
  "timestamp": 1749023966241
}

Response 401 - Invalid QAS token type provided.

{
  "errorCode": "QAPI-401002",
  "message": "Invalid QAS token type provided.",
  "hint": "Re-authenticate using your front office username and password.",
  "timestamp": 1749023966242
}

Response 401 - QAS authentication failed.

{
  "errorCode": "QAPI-401003",
  "message": "QAS authentication failed.",
  "hint": "Make sure to authenticate with your front office username and password.",
  "timestamp": 1749023966243
}

Response 401 - QAS bearer token not found.

{
  "errorCode": "QAPI-401004",
  "message": "QAS bearer token not found.",
  "hint": "Make sure to authenticate with your front office username and password.",
  "timestamp": 1749023966244
}

Response 401 - Unauthorized TAI Module Access.

{
  "errorCode": "QAPI-401005",
  "message": "Unauthorized {module} Module Access.",
  "hint": "Request access to the module from your account manager.",
  "timestamp": 1751378140433,
  "parameters": {
    "module": "TAI"
  }
}

Response 401 - Unauthorized API Access.

{
  "errorCode": "QAPI-401006",
  "message": "Unauthorized API Access.",
  "hint": "Request API access from your account manager.",
  "timestamp": 1751378140434
}

Response 500 - An error occurred while processing the request.

{
  "errorCode": "QAPI-500001",
  "message": "An error occurred while processing the request.",
  "hint": "Contact your account manager.",
  "timestamp": 1749023966241
}

New API

New API: Get an Asset by ID

New or Updated API New
API Endpoint /api/1.1/asset/{id}
Method GET
DTD or XSD changes Not Applicable

Retrieve detailed information about a specific asset. Use the optional fields parameter to return only selected properties. When fields is not specified, the operation returns all available asset properties.

Input ParametersInput Parameters

Name Description
id Asset identifier
fields Comma separated list of field names to include in the response.
Usage:
- Omit parameter to get full asset representation (default)
- Use comma separated values for specific fields: id,name,scannerLocked
- Use dot notation for nested fields: owner.username,optionProfile.name
Examples:
- ?fields=id,name,status - Basic information only
- ?fields=id,name,runtime,url - Key configuration settings
See operation description for the complete list of available field names.

Sample: Get an LLM AssetSample: Get an LLM Asset

API Response

Response 200 - LLM get

{
  "id": "xxxxx",
  "uuid": "xxxxx",
  "name": "test model create from Public API 2026-07-17T14:26",
  "type": "LLM",
  "createdDate": 1784298400661,
  "lastUpdatedDate": 1784298400661,
  "createdBy": {
    "username": "test_jd",
    "firstname": "John",
    "lastname": "Doe"
  },
  "updatedBy": {
    "username": "test_jd",
    "firstname": "John",
    "lastname": "Doe"
  },
  "modelId": "vertex-g-123",
  "runtime": "GOOGLE_VERTEX",
  "url": "https://europe-west1-aiplatform.googleapis.com",
  "region": "europe-west1",
  "projectId": "xxxxx",
  "endpointId": "xxxxx",
  "status": "CONFIRMED",
  "scannerLocked": false,
  "authRecord": {
    "authType": "SERVICE_ACCOUNT",
    "serviceAccountFileContent": "KioqKio=",
    "serviceAccountFileName": "filename.json",
    "serviceAccountAuthInputType": "JSON"
  },
  "optionProfile": {
    "id": "xxxxx",
    "name": "OP - John Doe"
  },
  "owner": {
    "id": "xxxxx",
    "uuid": "xxxxx",
    "username": "test_jd",
    "firstName": "John",
    "lastName": "Doe"
  }
}

Response 400 - The field [invalidField] does not exist.

{
  "errorCode": "QAPI-400004",
  "message": "The field [{field}] does not exist.",
  "hint": "Check the documentation for the list of possible fields.",
  "timestamp": 1784739281044,
  "parameters": {
    "field": "invalidField"
  }
}

Response 401 - Invalid QAS token provided.

{
  "errorCode": "QAPI-401001",
  "message": "Invalid QAS token provided.",
  "hint": "Re-authenticate using your front office username and password.",
  "timestamp": 1749023966241
}

Response 401 - Invalid QAS token type provided.

{
  "errorCode": "QAPI-401002",
  "message": "Invalid QAS token type provided.",
  "hint": "Re-authenticate using your front office username and password.",
  "timestamp": 1749023966242
}

Response 401 - QAS authentication failed.

{
  "errorCode": "QAPI-401003",
  "message": "QAS authentication failed.",
  "hint": "Make sure to authenticate with your front office username and password.",
  "timestamp": 1749023966243
}

Response 401 - QAS bearer token not found.

{
  "errorCode": "QAPI-401004",
  "message": "QAS bearer token not found.",
  "hint": "Make sure to authenticate with your front office username and password.",
  "timestamp": 1749023966244
}

Response 401 - Unauthorized TAI Module Access.

{
  "errorCode": "QAPI-401005",
  "message": "Unauthorized {module} Module Access.",
  "hint": "Request access to the module from your account manager.",
  "timestamp": 1751378140433,
  "parameters": {
    "module": "TAI"
  }
}

Response 401 - Unauthorized API Access.

{
  "errorCode": "QAPI-401006",
  "message": "Unauthorized API Access.",
  "hint": "Request API access from your account manager.",
  "timestamp": 1751378140434
}

Response 404 - Asset not found with ID [xxxxx].

{
  "errorCode": "QTAI-404007",
  "message": "Asset not found with ID [{id}].",
  "hint": "Verify the provided ID is correct and is in user scope.",
  "timestamp": 1764166552483,
  "parameters": {
    "id": "xxxxx"
  }
}

Response 500 - An error occurred while processing the request.

{
  "errorCode": "QAPI-500001",
  "message": "An error occurred while processing the request.",
  "hint": "Contact your account manager.",
  "timestamp": 1749023966241
}

New API

Update an Asset

New or Updated API New
API Endpoint /api/1.1/asset/{id}
Method PUT
DTD or XSD changes Not Applicable

Update an asset with the specified ID. This operation supports partial updates and modifies only the fields included in the request body. For example, to update only the asset name, provide only the name field in the request body. The operation leaves all other fields unchanged. For complete details about partial update behavior, refer to the API Conventions section. The response returns the updated asset details.

The owner field is read-only. Do not include it in the request body, as the endpoint rejects such requests with a validation error.

Input ParametersInput Parameters

Name Description
id Asset identifier

Sample: Update an LLM AssetSample: Update an LLM Asset

API Request

{
  "name": "test model update from Public API 2026-07-20T16:02"
}

API Response

Response 200 - LLM update

{
  "id": "xxxxx",
  "uuid": "xxxxx",
  "name": "test model update from Public API 2026-07-20T16:02",
  "type": "LLM",
  "createdDate": 1784559970000,
  "lastUpdatedDate": 1784563375018,
  "createdBy": {
    "username": "test_sd",
    "firstname": "John",
    "lastname": "Doe"
  },
  "updatedBy": {
    "username": "test_sd",
    "firstname": "John",
    "lastname": "Doe"
  },
  "modelId": "vertex-g-123",
  "runtime": "GOOGLE_VERTEX",
  "url": "https://europe-west1-aiplatform.googleapis.com",
  "region": "europe-west1",
  "projectId": "xxxxx",
  "endpointId": "xxxxx",
  "status": "CONFIRMED",
  "scannerLocked": false,
  "authRecord": {
    "authType": "SERVICE_ACCOUNT",
    "serviceAccountFileContent": "KioqKio=",
    "serviceAccountFileName": "filename.json",
    "serviceAccountAuthInputType": "JSON"
  },
  "optionProfile": {
    "id": "xxxxx",
    "name": "OP - John Doe"
  },
  "owner": {
    "id": "xxxxx",
    "uuid": "xxxxx",
    "username": "test_jd",
    "firstName": "John",
    "lastName": "Doe"
  }
}

Response 400 - The field [Description] does not exist.

{
  "errorCode": "QAPI-400004",
  "message": "The field [{field}] does not exist.",
  "hint": "Check the documentation for the list of possible fields.",
  "details": "The field [Description] does not exist.",
  "parameters": {
    "field": "Description"
  },
  "timestamp": 1766397052701
}

Response 401 - Invalid QAS token provided.

{
  "errorCode": "QAPI-401001",
  "message": "Invalid QAS token provided.",
  "hint": "Re-authenticate using your front office username and password.",
  "timestamp": 1749023966241
}

Response 401 - Invalid QAS token type provided.

{
  "errorCode": "QAPI-401002",
  "message": "Invalid QAS token type provided.",
  "hint": "Re-authenticate using your front office username and password.",
  "timestamp": 1749023966242
}

Response 401 - QAS authentication failed.

{
  "errorCode": "QAPI-401003",
  "message": "QAS authentication failed.",
  "hint": "Make sure to authenticate with your front office username and password.",
  "timestamp": 1749023966243
}

Response 401 - QAS bearer token not found.

{
  "errorCode": "QAPI-401004",
  "message": "QAS bearer token not found.",
  "hint": "Make sure to authenticate with your front office username and password.",
  "timestamp": 1749023966244
}

Response 401 - Unauthorized TAI Module Access.

{
  "errorCode": "QAPI-401005",
  "message": "Unauthorized {module} Module Access.",
  "hint": "Request access to the module from your account manager.",
  "timestamp": 1751378140433,
  "parameters": {
    "module": "TAI"
  }
}

Response 401 - Unauthorized API Access.

{
  "errorCode": "QAPI-401006",
  "message": "Unauthorized API Access.",
  "hint": "Request API access from your account manager.",
  "timestamp": 1751378140434
}

Response 404 - Asset not found with ID [xxxxx].

{
  "errorCode": "QTAI-404007",
  "message": "Asset not found with ID [{id}].",
  "hint": "Verify the provided ID is correct and is in user scope.",
  "timestamp": 1766401611347,
  "parameters": {
    "id": "xxxxx"
  }
}

Response 404 - Tag not found with UUID [xxxxx].

{
  "errorCode": "QAPI-404003",
  "message": "Tag not found with UUID [{uuid}].",
  "hint": "Verify the provided UUID is correct.",
  "timestamp": 1766395789612,
  "parameters": {
    "uuid": "xxxxx"
  }
}

Response 404 - Tag not found with ID [xxxxx].

{
  "errorCode": "QAPI-404002",
  "message": "Tag not found with ID [{id}].",
  "hint": "Verify the provided ID is correct.",
  "timestamp": 1766396169637,
  "parameters": {
    "id": "xxxxx"
  }
}

Response 404 - Option Profile not found with ID [xxxxx].

{
  "errorCode": "QTAI-404004",
  "message": "Option Profile not found with ID [{id}].",
  "hint": "Verify the provided ID is correct and is in user scope.",
  "timestamp": 1766396388669,
  "parameters": {
    "id": "xxxxx"
  }
}

Response 500 - An error occurred while processing the request.

{
  "errorCode": "QAPI-500001",
  "message": "An error occurred while processing the request.",
  "hint": "Contact your account manager.",
  "timestamp": 1749023966241
}

New API

Delete Asset

New or Updated API New
API Endpoint /api/1.1/asset/{id}
Method DELETE
DTD or XSD changes Not Applicable

Delete an asset with the specified ID. This operation permanently removes the asset and returns the deletion status.

Input ParametersInput Parameters

Name Description
id Asset identifier

Sample: Delete an Asset by IDSample: Delete an Asset by ID

API Response

Response 200 - Asset Delete By ID

{
  "entityId": "xxxxx",
  "status": "SUCCESS"
}

Response 200 - Asset Delete Does Not Exist

{
  "entityId": "xxxxx",
  "status": "DOES_NOT_EXIST",
  "reason": "Asset does not exist"
}

Response 401 - Invalid QAS token provided.

{
  "errorCode": "QAPI-401001",
  "message": "Invalid QAS token provided.",
  "hint": "Re-authenticate using your front office username and password.",
  "timestamp": 1749023966241
}

Response 401 - Invalid QAS token type provided.

{
  "errorCode": "QAPI-401002",
  "message": "Invalid QAS token type provided.",
  "hint": "Re-authenticate using your front office username and password.",
  "timestamp": 1749023966242
}

Response 401 - QAS authentication failed.

{
  "errorCode": "QAPI-401003",
  "message": "QAS authentication failed.",
  "hint": "Make sure to authenticate with your front office username and password.",
  "timestamp": 1749023966243
}

Response 401 - QAS bearer token not found.

{
  "errorCode": "QAPI-401004",
  "message": "QAS bearer token not found.",
  "hint": "Make sure to authenticate with your front office username and password.",
  "timestamp": 1749023966244
}

Response 401 - Unauthorized TAI Module Access.

{
  "errorCode": "QAPI-401005",
  "message": "Unauthorized {module} Module Access.",
  "hint": "Request access to the module from your account manager.",
  "timestamp": 1751378140433,
  "parameters": {
    "module": "TAI"
  }
}

Response 401 - Unauthorized API Access.

{
  "errorCode": "QAPI-401006",
  "message": "Unauthorized API Access.",
  "hint": "Request API access from your account manager.",
  "timestamp": 1751378140434
}

Response 500 - An error occurred while processing the request.

{
  "errorCode": "QAPI-500001",
  "message": "An error occurred while processing the request.",
  "hint": "Contact your account manager.",
  "timestamp": 1749023966241
}

Updated API

Create API: Create AWS Bedrock Model with Connector-based Authentication

New or Updated API Updated
API Endpoint /api/1.1/asset/
Method POST
DTD or XSD changes Not Applicable

You can now authenticate an AWS Bedrock model using an existing AWS connector instead of providing a long-lived access key and secret key when you create the model. When you associate a connector, TotalAI exchanges the connector's role details for short-lived AWS STS credentials at scan launch, so no static credentials are stored against the model.

Input ParametersInput Parameters

Use the following authRecord parameters to authenticate an AWS Bedrock model using a connector.

Parameter Data Type Optional/ Mandatory Description

authRecord.authType

String

Mandatory

Use this parameter to define the authentication type for the model.
New value: ASSUME_ROLE

connectorObject.connectorId

Integer

Optional

Use this parameter to provide the ID of the AWS connector to associate with the model.

connectorObject.connectorUuid

String

Mandatory when using a connector

Use this parameter to provide the UUID of the AWS connector. This value is required when authRecord.authType is set to ASSUME_ROLE.

connectorObject.name

String

Optional

Use this parameter to provide the display name of the AWS connector.

When you provide connectorObject, do not send accessKey or secretKey. When you remove the connector or switch to static credentials, the previously stored connector association is cleared automatically.

Sample: Create AWS Bedrock Model with Connector-based AuthenticationSample: Create AWS Bedrock Model with Connector-based Authentication

API Request

{
  "name": "Bedrock model - connector auth",
  "type": "LLM",
  "modelId": "bedrock_model",
  "runtime": "AWS_BEDROCK",
  "region": "Asia Pacific (Tokyo)",
  "optionProfile": {
    "id": 7290432
  },
  "authRecord": {
    "authType": "ASSUME_ROLE"
  },
  "connectorObject": {
    "connectorUuid": "3fa85f64-5717-4562-b3fc-2c963f66afa6",
    "name": "aws-prod-connector"
  }
}

API Response

Response 200 - Bedrock model created with connector-based authentication

{
    "id": 98139898,
    "uuid": "f87ae520-a0e4-4113-a931-9e2d6adcf2e6",
    "name": "Bedrock model - connector auth",
    "type": "LLM",
    "modelId": "bedrock_model",
    "runtime": "AWS_BEDROCK",
    "region": "Asia Pacific (Tokyo)",
    "status": "CONFIRMED",
    "authRecord": {
        "authType": "ASSUME_ROLE"
    },
    "connectorObject": {
        "connectorUuid": "3fa85f64-5717-4562-b3fc-2c963f66afa6",
        "name": "aws-prod-connector"
    },
    "optionProfile": {
        "id": 7290432,
        "name": "test OP"
    }
}

Updated API

Update API: Update AWS Bedrock Model with Connector-based Authentication

New or Updated API Updated
API Endpoint /api/1.1/asset/{id}
Method PUT
DTD or XSD changes Not Applicable

You can now update an existing AWS Bedrock model to use connector-based authentication, associating an AWS connector in place of a long-lived access key and secret key. When you associate a connector, TotalAI exchanges the connector's role details for short-lived AWS STS credentials at scan launch, so no static credentials are stored against the model. This operation supports partial updates and modifies only the fields included in the request body.

Input ParametersInput Parameters

Name Description
id Asset identifier

Use the following authRecord parameters to switch an AWS Bedrock model to connector-based authentication.

Parameter Data Type Optional/ Mandatory Description

authRecord.authType

String

Mandatory

Use this parameter to define the authentication type for the model.
New value: ASSUME_ROLE

connectorObject.connectorId

Integer

Optional

Use this parameter to provide the ID of the AWS connector to associate with the model.

connectorObject.connectorUuid

String

Mandatory when using a connector

Use this parameter to provide the UUID of the AWS connector. This value is required when authRecord.authType is set to ASSUME_ROLE.

connectorObject.name

String

Optional

Use this parameter to provide the display name of the AWS connector.

When you provide connectorObject, do not send accessKey or secretKey. When you remove the connector or switch to static credentials, the previously stored connector association is cleared automatically.

Sample: Update AWS Bedrock Model with Connector-based AuthenticationSample: Update AWS Bedrock Model with Connector-based Authentication

API Request

{
  "authRecord": {
    "authType": "ASSUME_ROLE"
  },
  "connectorObject": {
    "connectorUuid": "3fa85f64-5717-4562-b3fc-2c963f66afa6",
    "name": "aws-prod-connector"
  }
}

API Response

Response 200 - Bedrock model updated with connector-based authentication

{
    "id": 98139898,
    "uuid": "f87ae520-a0e4-4113-a931-9e2d6adcf2e6",
    "name": "Bedrock model - connector auth",
    "type": "LLM",
    "modelId": "bedrock_model",
    "runtime": "AWS_BEDROCK",
    "region": "Asia Pacific (Tokyo)",
    "status": "CONFIRMED",
    "authRecord": {
        "authType": "ASSUME_ROLE"
    },
    "connectorObject": {
        "connectorUuid": "3fa85f64-5717-4562-b3fc-2c963f66afa6",
        "name": "aws-prod-connector"
    },
    "optionProfile": {
        "id": 7290432,
        "name": "test OP"
    }
}

Updated API

Create API: Create Azure OpenAI Model with Connector-based Authentication

New or Updated API Updated
API Endpoint /api/1.1/asset/
Method POST
DTD or XSD changes Not Applicable

You can now authenticate an Azure OpenAI model using an Azure Service Principal connector instead of a manually entered API key when you create the model. When you associate a connector, TotalAI retrieves the tenant, application, and client secret details from the connector at scan time, so the client secret is never stored in TotalAI.

Input ParametersInput Parameters

Use the following authRecord parameters to authenticate an Azure OpenAI model using a connector.

Parameter Data Type Optional/ Mandatory Description

authRecord.authType

String

Mandatory

Use this parameter to define the authentication type for the model.
New value: SERVICE_PRINCIPAL

connectorObject.connectorUuid

String

Mandatory when using a connector

Use this parameter to provide the UUID of the Azure connector that has an Azure Service Principal configured. This value is required when authRecord.authType is set to SERVICE_PRINCIPAL.

connectorObject.name

String

Optional

Use this parameter to provide the display name of the Azure connector.

API Key authentication for Azure OpenAI models is unchanged and continues to be supported alongside Service Principal authentication.

Sample: Create Azure OpenAI Model with Connector-based AuthenticationSample: Create Azure OpenAI Model with Connector-based Authentication

API Request

{
  "name": "Azure OpenAI model - connector auth",
  "type": "LLM",
  "runtime": "AZURE_OPEN_AI",
  "url": "https://example.openai.azure.com",
  "openAIVersion": "2024-02-01",
  "optionProfile": {
    "id": 7290432
  },
  "authRecord": {
    "authType": "SERVICE_PRINCIPAL"
  },
  "connectorObject": {
    "connectorUuid": "7c9e6679-7425-40de-944b-e07fc1f90ae7",
    "name": "azure-prod-connector"
  }
}

API Response

Response 200 - Azure OpenAI model created with connector-based authentication

{
    "id": 98139901,
    "uuid": "a1b2c3d4-1234-5678-9abc-def012345678",
    "name": "Azure OpenAI model - connector auth",
    "type": "LLM",
    "runtime": "AZURE_OPEN_AI",
    "url": "https://example.openai.azure.com",
    "openAIVersion": "2024-02-01",
    "status": "CONFIRMED",
    "authRecord": {
        "authType": "SERVICE_PRINCIPAL"
    },
    "connectorObject": {
        "connectorUuid": "7c9e6679-7425-40de-944b-e07fc1f90ae7",
        "name": "azure-prod-connector"
    },
    "optionProfile": {
        "id": 7290432,
        "name": "test OP"
    }
}

Updated API

Update API: Update Azure OpenAI Model with Connector-based Authentication

New or Updated API Updated
API Endpoint /api/1.1/asset/{id}
Method PUT
DTD or XSD changes Not Applicable

You can now update an existing Azure OpenAI model to use an Azure Service Principal connector in place of a manually entered API key. When you associate a connector, TotalAI retrieves the tenant, application, and client secret details from the connector at scan time, so the client secret is never stored in TotalAI. This operation supports partial updates and modifies only the fields included in the request body.

Input ParametersInput Parameters

Name Description
id Asset identifier

Use the following authRecord parameters to switch an Azure OpenAI model to connector-based authentication.

Parameter Data Type Optional/ Mandatory Description

authRecord.authType

String

Mandatory

Use this parameter to define the authentication type for the model.
New value: SERVICE_PRINCIPAL

connectorObject.connectorUuid

String

Mandatory when using a connector

Use this parameter to provide the UUID of the Azure connector that has an Azure Service Principal configured. This value is required when authRecord.authType is set to SERVICE_PRINCIPAL.

connectorObject.name

String

Optional

Use this parameter to provide the display name of the Azure connector.

API Key authentication for Azure OpenAI models is unchanged and continues to be supported alongside Service Principal authentication.

Sample: Update Azure OpenAI Model with Connector-based AuthenticationSample: Update Azure OpenAI Model with Connector-based Authentication

API Request

{
  "authRecord": {
    "authType": "SERVICE_PRINCIPAL"
  },
  "connectorObject": {
    "connectorUuid": "7c9e6679-7425-40de-944b-e07fc1f90ae7",
    "name": "azure-prod-connector"
  }
}

API Response

Response 200 - Azure OpenAI model updated with connector-based authentication

{
    "id": 98139901,
    "uuid": "a1b2c3d4-1234-5678-9abc-def012345678",
    "name": "Azure OpenAI model - connector auth",
    "type": "LLM",
    "runtime": "AZURE_OPEN_AI",
    "url": "https://example.openai.azure.com",
    "openAIVersion": "2024-02-01",
    "status": "CONFIRMED",
    "authRecord": {
        "authType": "SERVICE_PRINCIPAL"
    },
    "connectorObject": {
        "connectorUuid": "7c9e6679-7425-40de-944b-e07fc1f90ae7",
        "name": "azure-prod-connector"
    },
    "optionProfile": {
        "id": 7290432,
        "name": "test OP"
    }
}

 

© 2026 Qualys, Inc. All rights reserved. Privacy Policy. Last updated: September, 2026