TotalAppSec Release 2.11 | Web Application Scanning Release 1.31 API

September 16, 2026

New APIs: Vault ConnectionTAS icon

TotalAppSec now supports CyberArk Central Credential Provider vaults through a new set of Vault Connection APIs. You can create, retrieve, update, delete, search, count, and tag vault connections, and then reference a connection from an authentication record so that scans retrieve credentials from your vault at scan time rather than from stored credentials. 

New API: Create Vault Connection

New or Updated APIs New
API Endpoint (New version) rest/vaultConnection/1.0
Method POST
JSON Schema Changes No

Creates a vault connection from the provider configuration you supply. Once the connection exists, authentication records can draw centrally managed credentials from it instead of storing passwords in Qualys.

Sample: Create Vault ConnectionSample: Create Vault Connection

API Request

curl --request POST \
  --url <qualys_base_url>/rest/vaultConnection/1.0 \
  --header 'authorization: Bearer <token>' \
  --header 'content-type: application/json' \
  --data '
{
  "name": "CyberArk Vault - Production",
  "description": "CyberArk vault connection for production environment",
  "reachability": "EXTERNAL",
  "tags": [
    {
      "uuid": "6472a260-1161-4dca-87ae-5611ca24f3c8"
    }
  ],
  "providerData": {
    "provider": "CyberArk CCP",
    "connectionDetails": {
      "baseUrl": "https://cyberark.prod.example.com",
      "webServicePath": "/AIMWebService/api/Accounts",
      "appId": "AppScanProdApp",
      "connectionTimeout": 30,
      "authDetails": {
        "authMode": "CLIENT_CERTIFICATE",
        "clientCertificate": "-----BEGIN CERTIFICATE-----\nMIID...\n-----END CERTIFICATE-----",
        "privateKey": "-----BEGIN PRIVATE KEY-----\nMIIE...\n-----END PRIVATE KEY-----",
        "privateKeyPassphrase": "secure_passphrase",
        "caBundle": "-----BEGIN CERTIFICATE-----\nMIID...\n-----END CERTIFICATE-----",
        "verifyTls": true
      }
    },
    "variables": [
      {
        "variable": {
          "secretName": "UserName",
          "accountName": "appscan_user",
          "safe": "AppScanSafe"
        }
      },
      {
        "variable": {
          "secretName": "Content",
          "accountName": "appscan_pass",
          "safe": "AppScanSafe"
        }
      }
    ]
  }
}
'

API Response

{
  "id": 38501,
  "name": "CyberArk Vault - Production",
  "description": "CyberArk vault connection for production environment",
  "uuid": "a1b2c3d4-e5f6-7890-abcd-ef1234567890",
  "tags": [
    {
      "id": 12121,
      "uuid": "6472a260-1161-4dca-87ae-5611ca24f3c8",
      "name": "Production_Apps"
    }
  ],
  "owner": {
    "id": 6565,
    "firstName": "Appsec",
    "lastName": "Qualys",
    "username": "quays_appsec"
  },
  "reachability": "EXTERNAL",
  "provider": "CyberArk CCP",
  "providerData": {
    "provider": "CyberArk CCP",
    "connectionDetails": {
      "baseUrl": "https://cyberark.prod.example.com",
      "webServicePath": "/AIMWebService/api/Accounts",
      "appId": "AppScanProdApp",
      "connectionTimeout": 30,
      "authDetails": {
        "authMode": "CLIENT_CERTIFICATE",
        "verifyTls": true
      }
    },
    "variables": [
      {
        "id": 901,
        "uuid": "b2c3d4e5-f6a7-8901-bcde-f12345678901",
        "alias": "vault_var_1",
        "variable": {
          "secretName": "UserName",
          "accountName": "appscan_user",
          "safe": "AppScanSafe"
        }
      },
      {
        "id": 902,
        "uuid": "c3d4e5f6-a7b8-9012-cdef-123456789012",
        "alias": "vault_var_2",
        "variable": {
          "secretName": "Content",
          "accountName": "appscan_pass",
          "safe": "AppScanSafe"
        }
      }
    ]
  },
  "validity": "VALID",
  "lastValidated": 1758065078000,
  "createdDate": 1758065078000,
  "updatedDate": 1758065078500,
  "createdBy": {
    "id": 6565,
    "firstName": "Appsec",
    "lastName": "Qualys",
    "username": "quays_appsec"
  },
  "updatedBy": {
    "id": 6565,
    "firstName": "Appsec",
    "lastName": "Qualys",
    "username": "quays_appsec"
  }
}

New API: Get Vault Connection

New or Updated APIs New
API Endpoint (New version) rest/vaultConnection/1.0/{id}
Method GET
JSON Schema Changes No

Returns a single vault connection by its numeric identifier. Use the optional fields query parameter to limit the response to the properties your integration needs. Secrets such as client certificates, private keys, and passphrases are never returned.

Input Parameters

Parameter Mandatory/Optional Data Type Description

id

Mandatory

integer

Unique numeric identifier of the vault connection

fields

Optional

string

Comma separated field names to retrieve response containing only those fields. For detail set of values available for this parameter, please see method description.
Sample: Get Vault ConnectionSample: Get Vault Connection

API Request

curl --request GET \
  --url <qualys_base_url>/rest/vaultConnection/1.0/{id} \
  --header 'authorization: Bearer <token>'

API Response

{
  "id": 38501,
  "name": "CyberArk Vault - Production",
  "description": "CyberArk vault connection for production environment",
  "uuid": "a1b2c3d4-e5f6-7890-abcd-ef1234567890",
  "tags": [
    {
      "id": 12121,
      "uuid": "6472a260-1161-4dca-87ae-5611ca24f3c8",
      "name": "Production_Apps"
    }
  ],
  "owner": {
    "id": 6565,
    "firstName": "Appsec",
    "lastName": "Qualys",
    "username": "quays_appsec"
  },
  "reachability": "EXTERNAL",
  "provider": "CyberArk CCP",
  "providerData": {
    "provider": "CyberArk CCP",
    "connectionDetails": {
      "baseUrl": "https://cyberark.prod.example.com",
      "webServicePath": "/AIMWebService/api/Accounts",
      "appId": "AppScanProdApp",
      "connectionTimeout": 30,
      "authDetails": {
        "authMode": "CLIENT_CERTIFICATE",
        "verifyTls": true
      }
    },
    "variables": [
      {
        "id": 901,
        "uuid": "b2c3d4e5-f6a7-8901-bcde-f12345678901",
        "alias": "vault_var_1",
        "variable": {
          "secretName": "UserName",
          "accountName": "appscan_user",
          "safe": "AppScanSafe"
        }
      },
      {
        "id": 902,
        "uuid": "c3d4e5f6-a7b8-9012-cdef-123456789012",
        "alias": "vault_var_2",
        "variable": {
          "secretName": "Content",
          "accountName": "appscan_pass",
          "safe": "AppScanSafe"
        }
      }
    ]
  },
  "validity": "VALID",
  "lastValidated": 1758065078000,
  "createdDate": 1758065078000,
  "updatedDate": 1758065078500,
  "createdBy": {
    "id": 6565,
    "firstName": "Appsec",
    "lastName": "Qualys",
    "username": "quays_appsec"
  },
  "updatedBy": {
    "id": 6565,
    "firstName": "Appsec",
    "lastName": "Qualys",
    "username": "quays_appsec"
  }
}

New API: Update Vault Connection

New or Updated APIs New
API Endpoint (New version) rest/vaultConnection/1.0/{id}
Method PUT
JSON Schema Changes No

Updates the vault connection identified by id. Only the fields you send are changed; any field you omit keeps its existing value.

Input Parameters

Parameter Mandatory/Optional Data Type Description

id

Mandatory

integer

Unique numeric identifier of the vault connection
Sample: Update Vault ConnectionSample: Update Vault Connection

API Request

curl --request PUT \
  --url <qualys_base_url>/rest/vaultConnection/1.0/{id} \
  --header 'authorization: Bearer <token>' \
  --header 'content-type: application/json' \
  --data '
{
  "name": "CyberArk Vault - Production Updated",
  "description": "Updated description for CyberArk vault connection",
  "reachability": "INTERNAL",
  "providerData": {
    "provider": "CyberArk CCP",
    "connectionDetails": {
      "baseUrl": "https://cyberark.prod.example.com",
      "webServicePath": "/AIMWebService/api/Accounts",
      "appId": "AppScanProdApp",
      "connectionTimeout": 60,
      "authDetails": {
        "authMode": "ALLOWED_MACHINES"
      }
    }
  }
}
'

API Response

{
  "id": 38501,
  "name": "CyberArk Vault - Production Updated",
  "description": "Updated description for CyberArk vault connection",
  "uuid": "a1b2c3d4-e5f6-7890-abcd-ef1234567890",
  "tags": [
    {
      "id": 12121,
      "uuid": "6472a260-1161-4dca-87ae-5611ca24f3c8",
      "name": "Production_Apps"
    }
  ],
  "owner": {
    "id": 6565,
    "firstName": "Appsec",
    "lastName": "Qualys",
    "username": "quays_appsec"
  },
  "reachability": "INTERNAL",
  "provider": "CyberArk CCP",
  "providerData": {
    "provider": "CyberArk CCP",
    "connectionDetails": {
      "baseUrl": "https://cyberark.prod.example.com",
      "webServicePath": "/AIMWebService/api/Accounts",
      "appId": "AppScanProdApp",
      "connectionTimeout": 60,
      "authDetails": {
        "authMode": "ALLOWED_MACHINES"
      }
    },
    "variables": [
      {
        "id": 901,
        "uuid": "b2c3d4e5-f6a7-8901-bcde-f12345678901",
        "alias": "vault_var_1",
        "variable": {
          "secretName": "UserName",
          "accountName": "appscan_user",
          "safe": "AppScanSafe"
        }
      }
    ]
  },
  "validity": "VALID",
  "lastValidated": 1758065078000,
  "createdDate": 1758065078000,
  "updatedDate": 1758066078500,
  "createdBy": {
    "id": 6565,
    "firstName": "Appsec",
    "lastName": "Qualys",
    "username": "quays_appsec"
  },
  "updatedBy": {
    "id": 6565,
    "firstName": "Appsec",
    "lastName": "Qualys",
    "username": "quays_appsec"
  }
}

New API: Delete Vault Connection

New or Updated APIs New
API Endpoint (New version) rest/vaultConnection/1.0/{id}
Method DELETE
JSON Schema Changes No

Deletes the vault connection identified by id. Confirm that no authentication record still depends on the connection before you delete it.

Input Parameters

Parameter Mandatory/Optional Data Type Description

id

Mandatory

integer

Unique numeric identifier of the vault connection
Sample: Delete Vault ConnectionSample: Delete Vault Connection

API Request

curl --request DELETE \
  --url <qualys_base_url>/rest/vaultConnection/1.0/{id} \
  --header 'authorization: Bearer <token>'

API Response

{
  "entityId": 38501,
  "status": "SUCCESS"
}

New API: Search Vault Connections

New or Updated APIs New
API Endpoint (New version) rest/vaultConnection/1.0/search
Method POST
JSON Schema Changes No

Returns the vault connections that match a QQL query, with support for field selection, sort order, and page size.

Sample: Search Vault ConnectionsSample: Search Vault Connections

API Request

curl --request POST \
  --url <qualys_base_url>/rest/vaultConnection/1.0/search \
  --header 'authorization: Bearer <token>' \
  --header 'content-type: application/json' \
  --data '
{
  "filter": {
    "vaultConnectionQql": "vaultConnection.name: \"CyberArk Vault\""
  },
  "size": 25,
  "sortOrder": "ASC",
  "orderBy": "vaultConnection.updatedDate",
  "fields": "id,name,description,providerData,updatedDate,validity,tags"
}
'

API Response

{
  "totalElements": 2,
  "content": [
    {
      "id": 38501,
      "name": "CyberArk Vault - Production",
      "description": "CyberArk vault connection for production environment",
      "providerData": {
        "provider": "CyberArk CCP",
        "connectionDetails": {
          "baseUrl": "https://cyberark.prod.example.com",
          "webServicePath": "/AIMWebService/api/Accounts",
          "appId": "AppScanProdApp",
          "connectionTimeout": 30,
          "authDetails": {
            "authMode": "CLIENT_CERTIFICATE",
            "verifyTls": true
          }
        },
        "variables": [
          {
            "id": 901,
            "uuid": "b2c3d4e5-f6a7-8901-bcde-f12345678901",
            "alias": "vault_var_1",
            "variable": {
              "secretName": "UserName",
              "accountName": "appscan_user",
              "safe": "AppScanSafe"
            }
          }
        ]
      },
      "tags": [
        {
          "id": 12121,
          "uuid": "6472a260-1161-4dca-87ae-5611ca24f3c8",
          "name": "Production_Apps"
        }
      ],
      "updatedDate": 1758065078500,
      "validity": "VALID"
    },
    {
      "id": 38502,
      "name": "CyberArk Vault - Dev",
      "description": "",
      "providerData": {
        "provider": "CyberArk CCP",
        "connectionDetails": {
          "baseUrl": "https://cyberark.dev.example.com",
          "webServicePath": "/AIMWebService/api/Accounts",
          "appId": "AppScanDevApp",
          "connectionTimeout": 10,
          "authDetails": {
            "authMode": "ALLOWED_MACHINES"
          }
        },
        "variables": []
      },
      "tags": [],
      "updatedDate": 1758043275230,
      "validity": "INVALID"
    }
  ]
}

New API: Count Vault Connections

New or Updated APIs New
API Endpoint (New version) rest/vaultConnection/1.0/count
Method POST
JSON Schema Changes No

Returns the number of vault connections that match a QQL query, without returning the records themselves.

Sample: Count Vault ConnectionsSample: Count Vault Connections

API Request

curl --request POST \
  --url <qualys_base_url>/rest/vaultConnection/1.0/count \
  --header 'authorization: Bearer <token>' \
  --header 'content-type: application/json' \
  --data '
{
  "filter": {
    "vaultConnectionQql": "vaultConnection.name: \"CyberArk Vault\""
  }
}
'

API Response

{
  "count": 5
}

New API: Add Tags to Vault Connections

New or Updated APIs New
API Endpoint (New version) rest/vaultConnection/1.0/tag/add
Method POST
JSON Schema Changes No

Assigns one or more tags to the vault connections you specify, so that connections can be grouped and scoped in the same way as other TotalAppSec assets.

Sample: Add Tags to Vault ConnectionsSample: Add Tags to Vault Connections

API Request

curl --request POST \
  --url <qualys_base_url>/rest/vaultConnection/1.0/tag/add \
  --header 'authorization: Bearer <token>' \
  --header 'content-type: application/json' \
  --data '
{
  "entityIds": [
    38501
  ],
  "tags": [
    {
      "id": 54678
    }
  ]
}
'

API Response

{
  "entries": [
    {
      "entityId": 38501,
      "status": "SUCCESS"
    }
  ]
}

New API: Remove Tags from Vault Connections

New or Updated APIs New
API Endpoint (New version) rest/vaultConnection/1.0/tag/remove
Method POST
JSON Schema Changes No

Removes one or more tags from the vault connections you specify.

Sample: Remove Tags from Vault ConnectionsSample: Remove Tags from Vault Connections

API Request

curl --request POST \
  --url <qualys_base_url>/rest/vaultConnection/1.0/tag/remove \
  --header 'authorization: Bearer <token>' \
  --header 'content-type: application/json' \
  --data '
{
  "entityIds": [
    38501
  ],
  "tags": [
    {
      "id": 54678
    }
  ]
}
'

API Response

{
  "entries": [
    {
      "entityId": 38501,
      "status": "SUCCESS"
    }
  ]
}

New API: Delete Vault Connections by Query

New or Updated APIs New
API Endpoint (New version) rest/vaultConnection/1.0/delete
Method POST
JSON Schema Changes No

Deletes every vault connection that matches a QQL query. The response reports the outcome for each connection separately, so a failure on one record does not hide the successful deletions.

Sample: Delete Vault Connections by QuerySample: Delete Vault Connections by Query

API Request

curl --request POST \
  --url <qualys_base_url>/rest/vaultConnection/1.0/delete \
  --header 'authorization: Bearer <token>' \
  --header 'content-type: application/json' \
  --data '
{
  "filter": {
    "vaultConnectionQql": "vaultConnection.id: 38501"
  }
}
'

API Response

{
  "entries": [
    {
      "entityId": 38501,
      "status": "SUCCESS"
    },
    {
      "entityId": 38502,
      "status": "FAILED",
      "errors": [
        {
          "code": "VC_NOT_FOUND",
          "message": "Vault connection not found"
        }
      ]
    }
  ]
}

New APIs: Knowledge BaseTAS icon

The Knowledge Base APIs are now available in the public API. You can look up QIDs, search and count knowledge base entries, change or restore the severity of a QID, activate or ignore a QID, and manage custom signatures programmatically.

Method Endpoint Description
GET rest/knowledgeBase/1.0/{id} Get the details of a QID from the knowledge base.
POST rest/knowledgeBase/1.0/search Search the knowledge base using a QQL query.
POST rest/knowledgeBase/1.0/count Count the QIDs that match a QQL query.
POST rest/knowledgeBase/1.0/edit Change the severity assigned to a QID.
POST rest/knowledgeBase/1.0/restore Restore a QID to its Qualys-assigned severity.
POST rest/knowledgeBase/1.0/activate Activate a QID so that scans report it again.
POST rest/knowledgeBase/1.0/ignore Ignore a QID so that scans stop reporting it.
POST rest/knowledgeBase/1.0/customSignature Create a custom signature.
PUT rest/knowledgeBase/1.0/customSignature/{cqid} Update an existing custom signature.
DEL rest/knowledgeBase/1.0/customSignature/{cqid} Delete a custom signature.

New API: Get Retest Status of FindingsTAS icon

A new Finding API returns the retest status of one or more findings. After you trigger a retest, use this operation to confirm whether the retest has run, what the retest scan detected, and who requested it, without having to fetch the full finding record.

New API: Get Retest Status of Findings

New or Updated APIs New
API Endpoint (New version) rest/finding/4.0/retest/status
Method POST
JSON Schema Changes No

Returns the current retest information for the findings identified by the UUIDs in the request. For each finding, the response reports the retest status, the status recorded by the retest scan, the reason, the date of the retest, and the user who requested it.

Sample: Get Retest Status of FindingsSample: Get Retest Status of Findings

API Request

curl --request POST \
  --url <qualys_base_url>/rest/finding/4.0/retest/status \
  --header 'authorization: Bearer <token>' \
  --header 'content-type: application/json' \
  --data '
{
  "uniqueIds": [
    "e51bb31c-688a-4c42-b24a-0ae1589f7e2d"
  ]
}
'

API Response

[
  {
    "id": 261418,
    "uuid": "a0e48d2b-4419-45d9-8e99-5d0575df963c",
    "retest": {
      "retestStatus": "RETESTED",
      "scanFindingStatus": "DETECTED",
      "reason": "Finding was confirmed",
      "retestedDate": 1787079271000,
      "retestedUser": {
        "id": 1055908,
        "username": "#SYSTEM-USER#@Accnt_184222",
        "firstName": "SYSTEM",
        "lastName": "USER"
      }
    }
  }
]

Enhancements in Authentication Record

Vault Connection Details in Authentication Record Responses

The Get Authentication Record and Search Authentication Records operations now return two additional response fields that identify the vault connection supplying the credentials for that record. Both fields can be selected through the fields parameter.
These fields are additive. Existing integrations are unaffected, and neither operation requires a change to your request payload. For the corresponding request-side changes, see Updated API: Create Authentication Record.

Operation Endpoint Status

Get Authentication Record

GETrest/authRecord/4.0/{id}

Updated

Search Authentication Records

POSTrest/authRecord/4.0/search

Updated
Field Data Type Description

vaultConnectionId

string

UUID of the vault connection associated with this authentication record.

vaultConnectionName

string

Display name of the vault connection associated with this authentication record.

Updated API: Create Authentication Record

New or Updated APIs Updated
API Endpoint (New version) rest/authRecord/4.0
Method POST
JSON Schema Changes Yes - new optional vault fields added to the request and response

The Create Authentication Record operation now accepts vault references in place of stored secrets. Instead of sending a password, client secret, API key, or bearer token in the request, set the vault-key flag on the field and point it at a vault variable in a configured vault connection. At scan time, TotalAppSec retrieves the value from your CyberArk Central Credential Provider vault, so the secret is never stored in Qualys.

Vault references are supported across the authentication types the endpoint already handles - server records, form records, custom headers, and API authentication (OAuth2 client ID and client secret, OAuth2 token request parameters, API keys, and bearer tokens). Records created with a vault reference return vaultConnectionId and vaultConnectionName, which identify the vault connection supplying the credentials.

These fields are optional and additive. Requests that send credential values directly continue to work unchanged, so existing integrations require no updates.

Sample: Create Authentication RecordSample: Create Authentication Record

API Request

curl --request POST \
  --url <qualys_base_url>/rest/authRecord/4.0 \
  --header 'authorization: Bearer <token>' \n  
  --header 'content-type: application/json' \
  --data '{
  "name": "DO | PublicAPI | Vault | OAuth2 Client Credentials | interfaces",
  "authRecordType": {
    "authType": "API",
    "apiAuthentication": {
      "config": {
        "type": "OAUTH2",
        "oauth2": {
          "grantType": "CLIENT_CREDENTIALS",
          "clientId": "Application-CyberArk-WASUI_OAuth_CC_DO-client-web-1 | WAS | UserName",
          "isClientIdSensitive": true,
          "isClientIdVaultKey": true,
          "clientIdVaultVariableUuid": "f4931b5f-c75b-4254-9355-b0274d565766",
          "clientSecret": "Application-CyberArk-WASUI_OAuth_CC_DO-client-web-1 | WAS | Content",
          "isClientSecretVaultKey": true,
          "clientSecretVaultVariableUuid": "bc8452e3-657e-4f88-bdf9-5133f9c1d17d",
          "accessTokenUrl": "http://10.113.225.30:7676/token",
          "accessTokenExpiredMsgPattern": "expiered",
          "scope": "products.read products.write",
          "clientAuthentication": "body",
          "tokenRequestParams": [
            {
              "key": "audience",
              "value": "Application-CyberArk-WASUI_OAuth_CC_TokenReqParam_DO-audience | WAS | Content",
              "sendAs": "request_body",
              "isSensitive": false,
              "isVaultKey": true,
              "vaultVariableUuid": "237fd11c-db4e-462e-a70f-efdf34d514ec"
            }
          ]
        }
      }
    }
  },
  "vaultConnectionId": "1139a735-2dac-4662-88b3-81bd6d954e6d",
  "vaultConnectionName": "131_DO_oAuth_CC"
}'

API Response

{
  "id": 1855737,
  "name": "DO | PublicAPI | Vault | Server Digest | deliverables",
  "tags": [
    {
      "id": 55379694,
      "uuid": "1cfd0b50-cd4f-4984-9b32-faea115a2f52",
      "name": "DO 1.26 Imported"
    }
  ],
  "authRecordType": {
    "authType": "WEBAPP"
  },
  "serverRecord": {
    "id": 1892207,
    "isSendAuthOverSslOnlyEnabled": false,
    "fields": [
      {
        "id": 1428623,
        "type": "DIGEST",
        "realm": "testauth",
        "username": "test",
        "password": "WASUI_SERVER_BASIC_And_DIGEST_DO | WAS | Content",
        "isVaultKey": true,
        "vaultVariableUuid": "40297ee8-7e05-4480-bcda-c13c2e5a399c"
      }
    ]
  },
  "comments": [
    {
      "comment": "Test Comment 1.28",
      "author": {
        "id": 1154687758,
        "username": "quaysxda3",
        "firstName": "Deepti",
        "lastName": "O"
      },
      "createdDate": 1789980603627
    }
  ],
  "owner": {
    "id": 1154687758,
    "username": "quaysxda3",
    "firstName": "Deepti",
    "lastName": "O"
  },
  "createdDate": 1789980603608,
  "updatedDate": 1789980603670,
  "createdBy": {
    "id": 1154687758,
    "username": "quaysxda3",
    "firstName": "Deepti",
    "lastName": "O"
  },
  "updatedBy": {
    "id": 1154687758,
    "username": "quaysxda3",
    "firstName": "Deepti",
    "lastName": "O"
  },
  "applicationsCount": 0,
  "scansCount": 0,
  "schedulesCount": 0,
  "vaultConnectionId": "d642f554-c9a9-40d2-a5d2-e12faf57f993",
  "vaultConnectionName": "Server_Auth_Digest_Vault"
}

 

© 2026 Qualys, Inc. All rights reserved. Privacy Policy. Last updated: September, 2026