TotalAppSec Release 2.10 | Web Application Scanning Release 1.30 API

August 06, 2026

Subscription-Based API Rate Limits

We have updated the Public API rate-limiting framework. This aligns API consumption limits with your Qualys subscription level. It also provides a consistent rate-limiting experience across all supported API versions.

Aligned Rate Limit Window

The V4 rate-limiting window is updated from 60 seconds to 3600 seconds (1 hour) to match the behavior of V3 APIs.

Rate limits by subscription tier

V4 APIs now enforce concurrency and hourly call limits based on your service level:

Service Level	Concurrency Limit	Rate Limit
Standard API Service	2 calls	300 calls/hour
Enterprise API Service	5 calls	750 calls/hour
Premium API Service	10 calls	2000 calls/hour

How does this benefit:

You get full advantage of the API rate limits
Migrating from V3 APIs receive a consistent rate-limiting experience in V4 APIs.
High-volume integrations and automation workflows can process more requests with fewer throttling events.

New APIs: Schedule Scans

The Scheduled Scans API now supports automated scan schedules. You can create, update, delete, search, and control their activation. Flexible scheduling options, such as time-based schedules and green windows, let you automate vulnerability, discovery, and compliance scans

Create Schedule Scan
POST rest/schedule/scan/4.0
Get Schedule Scan
GET rest/schedule/scan/4.0/{id}
Update Schedule Scan
PUT rest/schedule/scan/4.0/{id}
Delete Schedule Scan
DEL rest/schedule/scan/4.0/{id}
Search Schedule Scan
POST rest/schedule/scan/4.0/search
Count Schedule Scan
POST rest/schedule/scan/4.0/count
Activate Schedule Scan
POST rest/schedule/scan/4.0/activate
Deactivate Schedule Scan
POSTrest/schedule/scan/4.0/deActivate
Delete Schedule Scans using Filter
POST rest/schedule/scan/4.0/delete
Download schedule scans as iCalendar
POST rest/schedule/scan/4.0/downloadCalendar

New API: Create Schedule Scan

New or Updated APIs	New
API Endpoint (New version)	rest/schedule/scan/4.0
Method	POST
JSON Schema Changes	No

Sample: Create Schedule ScanSample: Create Schedule Scan

API Request

curl --request POST \
  --url rest/schedule/scan/4.0 \
  --header 'authorization: Bearer <token>'
  --header 'content-type: application/json' \
  --data '
  {
"name": "TAS Single Vulnerability Scan | Classic Scheduling",
"category": "SINGLE",
"target": {
"application": {
"id": 83379314
}
},
"config": {
"type": "VULNERABILITY",
"setting": {
"scanner": {
"type": "EXTERNAL"
},
"isSendEmailEnabled": false,
"optionProfile": {
"id": 3297805
},
"progressiveScanningOption": "USE_FOR_SCAN",
"isAIPoweredScanOptimizationEnabled": true,
"isResetProgressionEnabled": true
},
"scheduling": {
"schedulingType": "CLASSIC",
"startDate": "2026-04-02T00:00:00.000Z",
"startTime": "13:33",
"timeZone": {
"offset": "GMT-07:00"
},
"scheduleOccurrence": {
"occurrenceType": "WEEKLY",
"endDate": "2026-04-21T00:00:00.000Z",
"endScheduleAfterOccurrenceCount": 3,
"endOption": "AFTER",
"occursInEveryNWeeks": 3,
"occursOnDays": [
"MONDAY",
"TUESDAY",
"WEDNESDAY"
]
}
}
},
"notification": {
"isEnabled": false
},
"status": "ACTIVE"
}

API Response

{
"id": 1900348,
"name": "TAS Single Vulnerability Scan | Classic Scheduling",
"category": "SINGLE",
"owner": {
"id": 6565,
"firstName": "Appsec",
"lastName": "Qualys",
"username": "quays_appsec"
},
"target": {
"application": {
"id": 83379314,
"name": "Integration Webapp 01",
"url": "https://webapp01.integration.qualys.com"
}
},
"config": {
"type": "VULNERABILITY",
"setting": {
"scanner": {
"type": "EXTERNAL"
},
"optionProfile": {
"id": 3297805,
"name": "Integration Test Profile"
},
"progressiveScanningOption": "USE_FOR_SCAN",
"isAIPoweredScanOptimizationEnabled": true,
"isResetProgressionEnabled": true,
"isSendEmailEnabled": false
},
"scheduling": {
"schedulingType": "CLASSIC",
"startDate": "2026-04-02T00:00:00.000Z",
"startTime": "13:33",
"timeZone": {
"zoneId": "America/Creston",
"offset": "GMT-07:00",
"name": "Mountain Standard Time (GMT-07:00)"
},
"scheduleOccurrence": {
"occurrenceType": "WEEKLY",
"endDate": "2026-04-21T00:00:00.000Z",
"endScheduleAfterOccurrenceCount": 3,
"endOption": "AFTER",
"occursInEveryNWeeks": 3,
"occursOnDays": [
"MONDAY",
"TUESDAY",
"WEDNESDAY"
]
},
"runCount": 0
}
},
"notification": {
"isEnabled": false
},
"status": "ACTIVE",
"nextDate": 1775161980000,
"createdDate": 1775078416797,
"updatedDate": 1775078418018,
"createdBy": {
"id": 6565,
"firstName": "Appsec",
"lastName": "Qualys",
"username": "quays_appsec"
},
"updatedBy": {
"id": 6565,
"firstName": "Appsec",
"lastName": "Qualys",
"username": "quays_appsec"
}
}

New API: Get Schedule Scan

New or Updated APIs	New
API Endpoint (New version)	rest/schedule/scan/4.0/{id}
Method	GET
JSON Schema Changes	No

Sample: Get Schedule ScanSample: Get Schedule Scan

API Request

curl --request POST \
  --url rest/schedule/scan/4.0 \
  --header 'authorization: Bearer <token>'
  --header 'content-type: application/json' \
  --data '
  {
"name": "TAS Single Vulnerability Scan | Classic Scheduling",
"category": "SINGLE",
"target": {
"application": {
"id": 83379314
}
},
"config": {
"type": "VULNERABILITY",
"setting": {
"scanner": {
"type": "EXTERNAL"
},
"isSendEmailEnabled": false,
"optionProfile": {
"id": 3297805
},
"progressiveScanningOption": "USE_FOR_SCAN",
"isAIPoweredScanOptimizationEnabled": true,
"isResetProgressionEnabled": true
},
"scheduling": {
"schedulingType": "CLASSIC",
"startDate": "2026-04-02T00:00:00.000Z",
"startTime": "13:33",
"timeZone": {
"offset": "GMT-07:00"
},
"scheduleOccurrence": {
"occurrenceType": "WEEKLY",
"endDate": "2026-04-21T00:00:00.000Z",
"endScheduleAfterOccurrenceCount": 3,
"endOption": "AFTER",
"occursInEveryNWeeks": 3,
"occursOnDays": [
"MONDAY",
"TUESDAY",
"WEDNESDAY"
]
}
}
},
"notification": {
"isEnabled": false
},
"status": "ACTIVE"
}

API Response

{
"id": 1900348,
"name": "TAS Single Vulnerability Scan | Classic Scheduling",
"category": "SINGLE",
"owner": {
"id": 6565,
"firstName": "Appsec",
"lastName": "Qualys",
"username": "quays_appsec"
},
"target": {
"application": {
"id": 83379314,
"name": "Integration Webapp 01",
"url": "https://webapp01.integration.qualys.com"
}
},
"config": {
"type": "VULNERABILITY",
"setting": {
"scanner": {
"type": "EXTERNAL"
},
"optionProfile": {
"id": 3297805,
"name": "Integration Test Profile"
},
"progressiveScanningOption": "USE_FOR_SCAN",
"isAIPoweredScanOptimizationEnabled": true,
"isResetProgressionEnabled": true,
"isSendEmailEnabled": false
},
"scheduling": {
"schedulingType": "CLASSIC",
"startDate": "2026-04-02T00:00:00.000Z",
"startTime": "13:33",
"timeZone": {
"zoneId": "America/Creston",
"offset": "GMT-07:00",
"name": "Mountain Standard Time (GMT-07:00)"
},
"scheduleOccurrence": {
"occurrenceType": "WEEKLY",
"endDate": "2026-04-21T00:00:00.000Z",
"endScheduleAfterOccurrenceCount": 3,
"endOption": "AFTER",
"occursInEveryNWeeks": 3,
"occursOnDays": [
"MONDAY",
"TUESDAY",
"WEDNESDAY"
]
},
"runCount": 0
}
},
"notification": {
"isEnabled": false
},
"status": "ACTIVE",
"nextDate": 1775161980000,
"createdDate": 1775078416797,
"updatedDate": 1775078418018,
"createdBy": {
"id": 6565,
"firstName": "Appsec",
"lastName": "Qualys",
"username": "quays_appsec"
},
"updatedBy": {
"id": 6565,
"firstName": "Appsec",
"lastName": "Qualys",
"username": "quays_appsec"
}
}

New API: Update Schedule Scan

New or Updated APIs	New
API Endpoint (New version)	rest/schedule/scan/4.0/{id}
Method	PUT
JSON Schema Changes	No

Sample: Update Schedule ScanSample: Update Schedule Scan

API Request

curl --request POST \
  --url rest/schedule/scan/4.0 \
  --header 'authorization: Bearer <token>'
  --header 'content-type: application/json' \
  --data '
  {
"name": "TAS Single Vulnerability Scan | Classic Scheduling",
"category": "SINGLE",
"target": {
"application": {
"id": 83379314
}
},
"config": {
"type": "VULNERABILITY",
"setting": {
"scanner": {
"type": "EXTERNAL"
},
"isSendEmailEnabled": false,
"optionProfile": {
"id": 3297805
},
"progressiveScanningOption": "USE_FOR_SCAN",
"isAIPoweredScanOptimizationEnabled": true,
"isResetProgressionEnabled": true
},
"scheduling": {
"schedulingType": "CLASSIC",
"startDate": "2026-04-02T00:00:00.000Z",
"startTime": "13:33",
"timeZone": {
"offset": "GMT-07:00"
},
"scheduleOccurrence": {
"occurrenceType": "WEEKLY",
"endDate": "2026-04-21T00:00:00.000Z",
"endScheduleAfterOccurrenceCount": 3,
"endOption": "AFTER",
"occursInEveryNWeeks": 3,
"occursOnDays": [
"MONDAY",
"TUESDAY",
"WEDNESDAY"
]
}
}
},
"notification": {
"isEnabled": false
},
"status": "ACTIVE"
}

API Response

{
"id": 1900348,
"name": "TAS Single Vulnerability Scan | Classic Scheduling",
"category": "SINGLE",
"owner": {
"id": 6565,
"firstName": "Appsec",
"lastName": "Qualys",
"username": "quays_appsec"
},
"target": {
"application": {
"id": 83379314,
"name": "Integration Webapp 01",
"url": "https://webapp01.integration.qualys.com"
}
},
"config": {
"type": "VULNERABILITY",
"setting": {
"scanner": {
"type": "EXTERNAL"
},
"optionProfile": {
"id": 3297805,
"name": "Integration Test Profile"
},
"progressiveScanningOption": "USE_FOR_SCAN",
"isAIPoweredScanOptimizationEnabled": true,
"isResetProgressionEnabled": true,
"isSendEmailEnabled": false
},
"scheduling": {
"schedulingType": "CLASSIC",
"startDate": "2026-04-02T00:00:00.000Z",
"startTime": "13:33",
"timeZone": {
"zoneId": "America/Creston",
"offset": "GMT-07:00",
"name": "Mountain Standard Time (GMT-07:00)"
},
"scheduleOccurrence": {
"occurrenceType": "WEEKLY",
"endDate": "2026-04-21T00:00:00.000Z",
"endScheduleAfterOccurrenceCount": 3,
"endOption": "AFTER",
"occursInEveryNWeeks": 3,
"occursOnDays": [
"MONDAY",
"TUESDAY",
"WEDNESDAY"
]
},
"runCount": 0
}
},
"notification": {
"isEnabled": false
},
"status": "ACTIVE",
"nextDate": 1775161980000,
"createdDate": 1775078416797,
"updatedDate": 1775078418018,
"createdBy": {
"id": 6565,
"firstName": "Appsec",
"lastName": "Qualys",
"username": "quays_appsec"
},
"updatedBy": {
"id": 6565,
"firstName": "Appsec",
"lastName": "Qualys",
"username": "quays_appsec"
}
}

New API: Delete Schedule Scan

New or Updated APIs	New
API Endpoint (New version)	rest/schedule/scan/4.0/{id}
Method	DELETE
JSON Schema Changes	No

New: Delete Schedule ScanNew: Delete Schedule Scan

API Request

curl --request POST \
  --url rest/schedule/scan/4.0 \
  --header 'authorization: Bearer <token>'
  --header 'content-type: application/json' \
  --data '
  {
"name": "TAS Single Vulnerability Scan | Classic Scheduling",
"category": "SINGLE",
"target": {
"application": {
"id": 83379314
}
},
"config": {
"type": "VULNERABILITY",
"setting": {
"scanner": {
"type": "EXTERNAL"
},
"isSendEmailEnabled": false,
"optionProfile": {
"id": 3297805
},
"progressiveScanningOption": "USE_FOR_SCAN",
"isAIPoweredScanOptimizationEnabled": true,
"isResetProgressionEnabled": true
},
"scheduling": {
"schedulingType": "CLASSIC",
"startDate": "2026-04-02T00:00:00.000Z",
"startTime": "13:33",
"timeZone": {
"offset": "GMT-07:00"
},
"scheduleOccurrence": {
"occurrenceType": "WEEKLY",
"endDate": "2026-04-21T00:00:00.000Z",
"endScheduleAfterOccurrenceCount": 3,
"endOption": "AFTER",
"occursInEveryNWeeks": 3,
"occursOnDays": [
"MONDAY",
"TUESDAY",
"WEDNESDAY"
]
}
}
},
"notification": {
"isEnabled": false
},
"status": "ACTIVE"
}

API Response

{
"id": 1900348,
"name": "TAS Single Vulnerability Scan | Classic Scheduling",
"category": "SINGLE",
"owner": {
"id": 6565,
"firstName": "Appsec",
"lastName": "Qualys",
"username": "quays_appsec"
},
"target": {
"application": {
"id": 83379314,
"name": "Integration Webapp 01",
"url": "https://webapp01.integration.qualys.com"
}
},
"config": {
"type": "VULNERABILITY",
"setting": {
"scanner": {
"type": "EXTERNAL"
},
"optionProfile": {
"id": 3297805,
"name": "Integration Test Profile"
},
"progressiveScanningOption": "USE_FOR_SCAN",
"isAIPoweredScanOptimizationEnabled": true,
"isResetProgressionEnabled": true,
"isSendEmailEnabled": false
},
"scheduling": {
"schedulingType": "CLASSIC",
"startDate": "2026-04-02T00:00:00.000Z",
"startTime": "13:33",
"timeZone": {
"zoneId": "America/Creston",
"offset": "GMT-07:00",
"name": "Mountain Standard Time (GMT-07:00)"
},
"scheduleOccurrence": {
"occurrenceType": "WEEKLY",
"endDate": "2026-04-21T00:00:00.000Z",
"endScheduleAfterOccurrenceCount": 3,
"endOption": "AFTER",
"occursInEveryNWeeks": 3,
"occursOnDays": [
"MONDAY",
"TUESDAY",
"WEDNESDAY"
]
},
"runCount": 0
}
},
"notification": {
"isEnabled": false
},
"status": "ACTIVE",
"nextDate": 1775161980000,
"createdDate": 1775078416797,
"updatedDate": 1775078418018,
"createdBy": {
"id": 6565,
"firstName": "Appsec",
"lastName": "Qualys",
"username": "quays_appsec"
},
"updatedBy": {
"id": 6565,
"firstName": "Appsec",
"lastName": "Qualys",
"username": "quays_appsec"
}
}

New API: Search Schedule Scan

New or Updated APIs	New
API Endpoint (New version)	rest/schedule/scan/4.0/search
Method	POST
JSON Schema Changes	No

Sample: Search Schedule ScanSample: Search Schedule Scan

API Request

curl --request POST \
  --url rest/schedule/scan/4.0 \
  --header 'authorization: Bearer <token>'
  --header 'content-type: application/json' \
  --data '
  {
"name": "TAS Single Vulnerability Scan | Classic Scheduling",
"category": "SINGLE",
"target": {
"application": {
"id": 83379314
}
},
"config": {
"type": "VULNERABILITY",
"setting": {
"scanner": {
"type": "EXTERNAL"
},
"isSendEmailEnabled": false,
"optionProfile": {
"id": 3297805
},
"progressiveScanningOption": "USE_FOR_SCAN",
"isAIPoweredScanOptimizationEnabled": true,
"isResetProgressionEnabled": true
},
"scheduling": {
"schedulingType": "CLASSIC",
"startDate": "2026-04-02T00:00:00.000Z",
"startTime": "13:33",
"timeZone": {
"offset": "GMT-07:00"
},
"scheduleOccurrence": {
"occurrenceType": "WEEKLY",
"endDate": "2026-04-21T00:00:00.000Z",
"endScheduleAfterOccurrenceCount": 3,
"endOption": "AFTER",
"occursInEveryNWeeks": 3,
"occursOnDays": [
"MONDAY",
"TUESDAY",
"WEDNESDAY"
]
}
}
},
"notification": {
"isEnabled": false
},
"status": "ACTIVE"
}

API Response

{
"id": 1900348,
"name": "TAS Single Vulnerability Scan | Classic Scheduling",
"category": "SINGLE",
"owner": {
"id": 6565,
"firstName": "Appsec",
"lastName": "Qualys",
"username": "quays_appsec"
},
"target": {
"application": {
"id": 83379314,
"name": "Integration Webapp 01",
"url": "https://webapp01.integration.qualys.com"
}
},
"config": {
"type": "VULNERABILITY",
"setting": {
"scanner": {
"type": "EXTERNAL"
},
"optionProfile": {
"id": 3297805,
"name": "Integration Test Profile"
},
"progressiveScanningOption": "USE_FOR_SCAN",
"isAIPoweredScanOptimizationEnabled": true,
"isResetProgressionEnabled": true,
"isSendEmailEnabled": false
},
"scheduling": {
"schedulingType": "CLASSIC",
"startDate": "2026-04-02T00:00:00.000Z",
"startTime": "13:33",
"timeZone": {
"zoneId": "America/Creston",
"offset": "GMT-07:00",
"name": "Mountain Standard Time (GMT-07:00)"
},
"scheduleOccurrence": {
"occurrenceType": "WEEKLY",
"endDate": "2026-04-21T00:00:00.000Z",
"endScheduleAfterOccurrenceCount": 3,
"endOption": "AFTER",
"occursInEveryNWeeks": 3,
"occursOnDays": [
"MONDAY",
"TUESDAY",
"WEDNESDAY"
]
},
"runCount": 0
}
},
"notification": {
"isEnabled": false
},
"status": "ACTIVE",
"nextDate": 1775161980000,
"createdDate": 1775078416797,
"updatedDate": 1775078418018,
"createdBy": {
"id": 6565,
"firstName": "Appsec",
"lastName": "Qualys",
"username": "quays_appsec"
},
"updatedBy": {
"id": 6565,
"firstName": "Appsec",
"lastName": "Qualys",
"username": "quays_appsec"
}
}

New API: Count Schedule Scan

New or Updated APIs	New
API Endpoint (New version)	rest/schedule/scan/4.0/count
Method	POST
JSON Schema Changes	No

Sample: Count Schedule ScanSample: Count Schedule Scan

API Request

curl --request POST \
  --url rest/schedule/scan/4.0 \
  --header 'authorization: Bearer <token>'
  --header 'content-type: application/json' \
  --data '
  {
"name": "TAS Single Vulnerability Scan | Classic Scheduling",
"category": "SINGLE",
"target": {
"application": {
"id": 83379314
}
},
"config": {
"type": "VULNERABILITY",
"setting": {
"scanner": {
"type": "EXTERNAL"
},
"isSendEmailEnabled": false,
"optionProfile": {
"id": 3297805
},
"progressiveScanningOption": "USE_FOR_SCAN",
"isAIPoweredScanOptimizationEnabled": true,
"isResetProgressionEnabled": true
},
"scheduling": {
"schedulingType": "CLASSIC",
"startDate": "2026-04-02T00:00:00.000Z",
"startTime": "13:33",
"timeZone": {
"offset": "GMT-07:00"
},
"scheduleOccurrence": {
"occurrenceType": "WEEKLY",
"endDate": "2026-04-21T00:00:00.000Z",
"endScheduleAfterOccurrenceCount": 3,
"endOption": "AFTER",
"occursInEveryNWeeks": 3,
"occursOnDays": [
"MONDAY",
"TUESDAY",
"WEDNESDAY"
]
}
}
},
"notification": {
"isEnabled": false
},
"status": "ACTIVE"
}

API Response

{
"id": 1900348,
"name": "TAS Single Vulnerability Scan | Classic Scheduling",
"category": "SINGLE",
"owner": {
"id": 6565,
"firstName": "Appsec",
"lastName": "Qualys",
"username": "quays_appsec"
},
"target": {
"application": {
"id": 83379314,
"name": "Integration Webapp 01",
"url": "https://webapp01.integration.qualys.com"
}
},
"config": {
"type": "VULNERABILITY",
"setting": {
"scanner": {
"type": "EXTERNAL"
},
"optionProfile": {
"id": 3297805,
"name": "Integration Test Profile"
},
"progressiveScanningOption": "USE_FOR_SCAN",
"isAIPoweredScanOptimizationEnabled": true,
"isResetProgressionEnabled": true,
"isSendEmailEnabled": false
},
"scheduling": {
"schedulingType": "CLASSIC",
"startDate": "2026-04-02T00:00:00.000Z",
"startTime": "13:33",
"timeZone": {
"zoneId": "America/Creston",
"offset": "GMT-07:00",
"name": "Mountain Standard Time (GMT-07:00)"
},
"scheduleOccurrence": {
"occurrenceType": "WEEKLY",
"endDate": "2026-04-21T00:00:00.000Z",
"endScheduleAfterOccurrenceCount": 3,
"endOption": "AFTER",
"occursInEveryNWeeks": 3,
"occursOnDays": [
"MONDAY",
"TUESDAY",
"WEDNESDAY"
]
},
"runCount": 0
}
},
"notification": {
"isEnabled": false
},
"status": "ACTIVE",
"nextDate": 1775161980000,
"createdDate": 1775078416797,
"updatedDate": 1775078418018,
"createdBy": {
"id": 6565,
"firstName": "Appsec",
"lastName": "Qualys",
"username": "quays_appsec"
},
"updatedBy": {
"id": 6565,
"firstName": "Appsec",
"lastName": "Qualys",
"username": "quays_appsec"
}
}

New API: Activate Schedule Scan

New or Updated APIs	New
API Endpoint (New version)	rest/schedule/scan/4.0/activate
Method	POST
JSON Schema Changes	No

Sample: Activate Schedule ScanSample: Activate Schedule Scan

API Request

curl --request POST \
  --url rest/schedule/scan/4.0 \
  --header 'authorization: Bearer <token>'
  --header 'content-type: application/json' \
  --data '
  {
"name": "TAS Single Vulnerability Scan | Classic Scheduling",
"category": "SINGLE",
"target": {
"application": {
"id": 83379314
}
},
"config": {
"type": "VULNERABILITY",
"setting": {
"scanner": {
"type": "EXTERNAL"
},
"isSendEmailEnabled": false,
"optionProfile": {
"id": 3297805
},
"progressiveScanningOption": "USE_FOR_SCAN",
"isAIPoweredScanOptimizationEnabled": true,
"isResetProgressionEnabled": true
},
"scheduling": {
"schedulingType": "CLASSIC",
"startDate": "2026-04-02T00:00:00.000Z",
"startTime": "13:33",
"timeZone": {
"offset": "GMT-07:00"
},
"scheduleOccurrence": {
"occurrenceType": "WEEKLY",
"endDate": "2026-04-21T00:00:00.000Z",
"endScheduleAfterOccurrenceCount": 3,
"endOption": "AFTER",
"occursInEveryNWeeks": 3,
"occursOnDays": [
"MONDAY",
"TUESDAY",
"WEDNESDAY"
]
}
}
},
"notification": {
"isEnabled": false
},
"status": "ACTIVE"
}

API Response

{
"id": 1900348,
"name": "TAS Single Vulnerability Scan | Classic Scheduling",
"category": "SINGLE",
"owner": {
"id": 6565,
"firstName": "Appsec",
"lastName": "Qualys",
"username": "quays_appsec"
},
"target": {
"application": {
"id": 83379314,
"name": "Integration Webapp 01",
"url": "https://webapp01.integration.qualys.com"
}
},
"config": {
"type": "VULNERABILITY",
"setting": {
"scanner": {
"type": "EXTERNAL"
},
"optionProfile": {
"id": 3297805,
"name": "Integration Test Profile"
},
"progressiveScanningOption": "USE_FOR_SCAN",
"isAIPoweredScanOptimizationEnabled": true,
"isResetProgressionEnabled": true,
"isSendEmailEnabled": false
},
"scheduling": {
"schedulingType": "CLASSIC",
"startDate": "2026-04-02T00:00:00.000Z",
"startTime": "13:33",
"timeZone": {
"zoneId": "America/Creston",
"offset": "GMT-07:00",
"name": "Mountain Standard Time (GMT-07:00)"
},
"scheduleOccurrence": {
"occurrenceType": "WEEKLY",
"endDate": "2026-04-21T00:00:00.000Z",
"endScheduleAfterOccurrenceCount": 3,
"endOption": "AFTER",
"occursInEveryNWeeks": 3,
"occursOnDays": [
"MONDAY",
"TUESDAY",
"WEDNESDAY"
]
},
"runCount": 0
}
},
"notification": {
"isEnabled": false
},
"status": "ACTIVE",
"nextDate": 1775161980000,
"createdDate": 1775078416797,
"updatedDate": 1775078418018,
"createdBy": {
"id": 6565,
"firstName": "Appsec",
"lastName": "Qualys",
"username": "quays_appsec"
},
"updatedBy": {
"id": 6565,
"firstName": "Appsec",
"lastName": "Qualys",
"username": "quays_appsec"
}
}

New API: Deactivate Schedule Scan

New or Updated APIs	New
API Endpoint (New version)	rest/schedule/scan/4.0/deActivate
Method	POST
JSON Schema Changes	No

Sample: Deactivate Schedule ScanSample: Deactivate Schedule Scan

API Request

curl --request POST \
  --url rest/schedule/scan/4.0 \
  --header 'authorization: Bearer <token>'
  --header 'content-type: application/json' \
  --data '
  {
"name": "TAS Single Vulnerability Scan | Classic Scheduling",
"category": "SINGLE",
"target": {
"application": {
"id": 83379314
}
},
"config": {
"type": "VULNERABILITY",
"setting": {
"scanner": {
"type": "EXTERNAL"
},
"isSendEmailEnabled": false,
"optionProfile": {
"id": 3297805
},
"progressiveScanningOption": "USE_FOR_SCAN",
"isAIPoweredScanOptimizationEnabled": true,
"isResetProgressionEnabled": true
},
"scheduling": {
"schedulingType": "CLASSIC",
"startDate": "2026-04-02T00:00:00.000Z",
"startTime": "13:33",
"timeZone": {
"offset": "GMT-07:00"
},
"scheduleOccurrence": {
"occurrenceType": "WEEKLY",
"endDate": "2026-04-21T00:00:00.000Z",
"endScheduleAfterOccurrenceCount": 3,
"endOption": "AFTER",
"occursInEveryNWeeks": 3,
"occursOnDays": [
"MONDAY",
"TUESDAY",
"WEDNESDAY"
]
}
}
},
"notification": {
"isEnabled": false
},
"status": "ACTIVE"
}

API Response

{
"id": 1900348,
"name": "TAS Single Vulnerability Scan | Classic Scheduling",
"category": "SINGLE",
"owner": {
"id": 6565,
"firstName": "Appsec",
"lastName": "Qualys",
"username": "quays_appsec"
},
"target": {
"application": {
"id": 83379314,
"name": "Integration Webapp 01",
"url": "https://webapp01.integration.qualys.com"
}
},
"config": {
"type": "VULNERABILITY",
"setting": {
"scanner": {
"type": "EXTERNAL"
},
"optionProfile": {
"id": 3297805,
"name": "Integration Test Profile"
},
"progressiveScanningOption": "USE_FOR_SCAN",
"isAIPoweredScanOptimizationEnabled": true,
"isResetProgressionEnabled": true,
"isSendEmailEnabled": false
},
"scheduling": {
"schedulingType": "CLASSIC",
"startDate": "2026-04-02T00:00:00.000Z",
"startTime": "13:33",
"timeZone": {
"zoneId": "America/Creston",
"offset": "GMT-07:00",
"name": "Mountain Standard Time (GMT-07:00)"
},
"scheduleOccurrence": {
"occurrenceType": "WEEKLY",
"endDate": "2026-04-21T00:00:00.000Z",
"endScheduleAfterOccurrenceCount": 3,
"endOption": "AFTER",
"occursInEveryNWeeks": 3,
"occursOnDays": [
"MONDAY",
"TUESDAY",
"WEDNESDAY"
]
},
"runCount": 0
}
},
"notification": {
"isEnabled": false
},
"status": "ACTIVE",
"nextDate": 1775161980000,
"createdDate": 1775078416797,
"updatedDate": 1775078418018,
"createdBy": {
"id": 6565,
"firstName": "Appsec",
"lastName": "Qualys",
"username": "quays_appsec"
},
"updatedBy": {
"id": 6565,
"firstName": "Appsec",
"lastName": "Qualys",
"username": "quays_appsec"
}
}

New API: Delete Schedule Scans using Filter

New or Updated APIs	New
API Endpoint (New version)	rest/schedule/scan/4.0/delete
Method	POST
JSON Schema Changes	No

Sample: Delete Schedule Scans using FilterSample: Delete Schedule Scans using Filter

API Request

curl --request POST \
  --url rest/schedule/scan/4.0 \
  --header 'authorization: Bearer <token>'
  --header 'content-type: application/json' \
  --data '
  {
"name": "TAS Single Vulnerability Scan | Classic Scheduling",
"category": "SINGLE",
"target": {
"application": {
"id": 83379314
}
},
"config": {
"type": "VULNERABILITY",
"setting": {
"scanner": {
"type": "EXTERNAL"
},
"isSendEmailEnabled": false,
"optionProfile": {
"id": 3297805
},
"progressiveScanningOption": "USE_FOR_SCAN",
"isAIPoweredScanOptimizationEnabled": true,
"isResetProgressionEnabled": true
},
"scheduling": {
"schedulingType": "CLASSIC",
"startDate": "2026-04-02T00:00:00.000Z",
"startTime": "13:33",
"timeZone": {
"offset": "GMT-07:00"
},
"scheduleOccurrence": {
"occurrenceType": "WEEKLY",
"endDate": "2026-04-21T00:00:00.000Z",
"endScheduleAfterOccurrenceCount": 3,
"endOption": "AFTER",
"occursInEveryNWeeks": 3,
"occursOnDays": [
"MONDAY",
"TUESDAY",
"WEDNESDAY"
]
}
}
},
"notification": {
"isEnabled": false
},
"status": "ACTIVE"
}

API Response

{
"id": 1900348,
"name": "TAS Single Vulnerability Scan | Classic Scheduling",
"category": "SINGLE",
"owner": {
"id": 6565,
"firstName": "Appsec",
"lastName": "Qualys",
"username": "quays_appsec"
},
"target": {
"application": {
"id": 83379314,
"name": "Integration Webapp 01",
"url": "https://webapp01.integration.qualys.com"
}
},
"config": {
"type": "VULNERABILITY",
"setting": {
"scanner": {
"type": "EXTERNAL"
},
"optionProfile": {
"id": 3297805,
"name": "Integration Test Profile"
},
"progressiveScanningOption": "USE_FOR_SCAN",
"isAIPoweredScanOptimizationEnabled": true,
"isResetProgressionEnabled": true,
"isSendEmailEnabled": false
},
"scheduling": {
"schedulingType": "CLASSIC",
"startDate": "2026-04-02T00:00:00.000Z",
"startTime": "13:33",
"timeZone": {
"zoneId": "America/Creston",
"offset": "GMT-07:00",
"name": "Mountain Standard Time (GMT-07:00)"
},
"scheduleOccurrence": {
"occurrenceType": "WEEKLY",
"endDate": "2026-04-21T00:00:00.000Z",
"endScheduleAfterOccurrenceCount": 3,
"endOption": "AFTER",
"occursInEveryNWeeks": 3,
"occursOnDays": [
"MONDAY",
"TUESDAY",
"WEDNESDAY"
]
},
"runCount": 0
}
},
"notification": {
"isEnabled": false
},
"status": "ACTIVE",
"nextDate": 1775161980000,
"createdDate": 1775078416797,
"updatedDate": 1775078418018,
"createdBy": {
"id": 6565,
"firstName": "Appsec",
"lastName": "Qualys",
"username": "quays_appsec"
},
"updatedBy": {
"id": 6565,
"firstName": "Appsec",
"lastName": "Qualys",
"username": "quays_appsec"
}
}

New API: Download schedule scans as iCalendar

New or Updated APIs	New
API Endpoint (New version)	rest/schedule/scan/4.0/downloadCalendar
Method	POST
JSON Schema Changes	No

Sample: Download schedule scans as iCalendarSample: Download schedule scans as iCalendar

API Request

curl --request POST \
  --url rest/schedule/scan/4.0 \
  --header 'authorization: Bearer <token>'
  --header 'content-type: application/json' \
  --data '
  {
"name": "TAS Single Vulnerability Scan | Classic Scheduling",
"category": "SINGLE",
"target": {
"application": {
"id": 83379314
}
},
"config": {
"type": "VULNERABILITY",
"setting": {
"scanner": {
"type": "EXTERNAL"
},
"isSendEmailEnabled": false,
"optionProfile": {
"id": 3297805
},
"progressiveScanningOption": "USE_FOR_SCAN",
"isAIPoweredScanOptimizationEnabled": true,
"isResetProgressionEnabled": true
},
"scheduling": {
"schedulingType": "CLASSIC",
"startDate": "2026-04-02T00:00:00.000Z",
"startTime": "13:33",
"timeZone": {
"offset": "GMT-07:00"
},
"scheduleOccurrence": {
"occurrenceType": "WEEKLY",
"endDate": "2026-04-21T00:00:00.000Z",
"endScheduleAfterOccurrenceCount": 3,
"endOption": "AFTER",
"occursInEveryNWeeks": 3,
"occursOnDays": [
"MONDAY",
"TUESDAY",
"WEDNESDAY"
]
}
}
},
"notification": {
"isEnabled": false
},
"status": "ACTIVE"
}

API Response

{
"id": 1900348,
"name": "TAS Single Vulnerability Scan | Classic Scheduling",
"category": "SINGLE",
"owner": {
"id": 6565,
"firstName": "Appsec",
"lastName": "Qualys",
"username": "quays_appsec"
},
"target": {
"application": {
"id": 83379314,
"name": "Integration Webapp 01",
"url": "https://webapp01.integration.qualys.com"
}
},
"config": {
"type": "VULNERABILITY",
"setting": {
"scanner": {
"type": "EXTERNAL"
},
"optionProfile": {
"id": 3297805,
"name": "Integration Test Profile"
},
"progressiveScanningOption": "USE_FOR_SCAN",
"isAIPoweredScanOptimizationEnabled": true,
"isResetProgressionEnabled": true,
"isSendEmailEnabled": false
},
"scheduling": {
"schedulingType": "CLASSIC",
"startDate": "2026-04-02T00:00:00.000Z",
"startTime": "13:33",
"timeZone": {
"zoneId": "America/Creston",
"offset": "GMT-07:00",
"name": "Mountain Standard Time (GMT-07:00)"
},
"scheduleOccurrence": {
"occurrenceType": "WEEKLY",
"endDate": "2026-04-21T00:00:00.000Z",
"endScheduleAfterOccurrenceCount": 3,
"endOption": "AFTER",
"occursInEveryNWeeks": 3,
"occursOnDays": [
"MONDAY",
"TUESDAY",
"WEDNESDAY"
]
},
"runCount": 0
}
},
"notification": {
"isEnabled": false
},
"status": "ACTIVE",
"nextDate": 1775161980000,
"createdDate": 1775078416797,
"updatedDate": 1775078418018,
"createdBy": {
"id": 6565,
"firstName": "Appsec",
"lastName": "Qualys",
"username": "quays_appsec"
},
"updatedBy": {
"id": 6565,
"firstName": "Appsec",
"lastName": "Qualys",
"username": "quays_appsec"
}
}

Enhancements in API

Purge API (Deprecated)

The Purge API operation is now deprecated. Use the Clear App Data for API operation instead to remove scan history and findings while keeping the API record.
Old endpoints remain available and are marked as deprecated. This causes no breaking changes to existing integrations.

Operation	Endpoint	Status
Purge API	POST`rest/api/1.0/purge`	Deprecated
Clear App Data for API	POST`rest/api/1.0/clearAppData`	New

Delete API using Filter (Deprecated)

The Delete API using Filter operation is now deprecated. Use the Purge (Delete) API using Filter operation to remove the API records and their associated data from the subscription.
Old endpoints are retained and marked Deprecated with no breaking change to existing integrations.
Old endpoints remain available and are marked as deprecated. This causes no breaking changes to existing integrations.

Operation	Endpoint	Status
Delete API using Filter	POST`rest/api/1.0/delete`	Deprecated
Purge (Delete) API using Filter	POST`rest/api/1.0/purgeRemove`	New

Enhancements in Web Application

Purge Web Application (Deprecated)

The Purge Web Application operation is now deprecated. Use the Clear app data for WebApp operation instead to remove scan history, findings, and associated data while keeping the web application record.
Old endpoints remain available and are marked as deprecated. This causes no breaking changes to existing integrations.

Operation	Endpoint	Status
Purge Web Application	POST`rest/webapp/4.0/purge`	Deprecated
Clear app data for WebApp	POST`rest/webapp/4.0/clearAppData`	New

Delete Web Application using Filter (Deprecated)

The Delete Web Application using Filter operation is now deprecated. Use the Purge (Delete) WebApp using Filter operation instead to remove the web application records and their associated data from the subscription.
Old endpoints remain available and are marked as deprecated. This causes no breaking changes to existing integrations.

Operation	Endpoint	Status
Delete Web Application using Filter	POST`rest/webapp/4.0/delete`	Deprecated
Purge (Delete) WebApp using Filter	POST`rest/webapp/4.0/purgeRemove`	New

Issues Addressed

The following reported issues are fixed in this release.

Application	Component	Description
TAS and WAS	V3 Schedule Scan API Response Format	We fixed an issue where the `tagList` field returned in the WAS API v3 Schedule Details response changed from a list structure to a set structure after the QSS migration. The API response format has been restored to the expected list structure, and the corresponding documentation has been updated to ensure consistency and prevent integration discrepancies.

Last updated: August, 2026