Qualys Enterprise TruRisk™ Platform

API response skips host data having no detections.

Example

• The API is called with three target IPs: 10.10.10.1, 10.10.10.2, and 10.10.10.114.
• Host-level filters are applied, leaving only 10.10.10.1 and 10.10.10.114
• After applying Detection-level filters, only hosts with detections are included. So only 10.10.10.1 appears in the response having detections

<?xml version="1.0" encoding="UTF-8" ?>
<!DOCTYPE HOST_LIST_VM_DETECTION_OUTPUT SYSTEM

 "https://qualysapi.p04.eng.sjc01.qualys.com/api/5.0/fo/asset/host/vm/detection/dtd/output.dtd">
<HOST_LIST_VM_DETECTION_OUTPUT>
    <RESPONSE>
        <DATETIME>2025-11-11T09:06:16Z</DATETIME>
        <HOST_LIST>
            <HOST>
                <ID>12394142</ID>
                <IP>10.10.10.1</IP>
                <DETECTION_LIST>
                    <DETECTION>
                        <UNIQUE_VULN_ID>102050695</UNIQUE_VULN_ID>
                        <QID>15055</QID>
                        <TYPE>Potential</TYPE>
                        <SEVERITY>3</SEVERITY>
                    </DETECTION>
                </DETECTION_LIST>
            </HOST>
        </HOST_LIST>
    </RESPONSE>
</HOST_LIST_VM_DETECTION_OUTPUT>

All hosts resolved after applying host-level filters are consistently included in the response, even if they have no detections (shown with an empty detection list under that host)

Example

• The API is called with three target IPs: 10.10.10.1, 10.10.10.2, and 10.10.10.114.
• Host-level filters are applied, leaving only 10.10.10.1 and 10.10.10.114.
• All hosts that remain after host-level filtering are included in results. After applying Detection-level filters, if host have no detections, it appears with an empty detections list. As 10.10.10.114 shown in below response.

{
  "hostListDetections" : {
    "dateTime" : "2025-11-11T09:05:41Z",
    "userLogin" : "akkqa_tq",
    "hostList" : [
      {
        "id" : "7434100",
        "ip" : "10.10.10.114",
        "detectionList" : [ ]
      },
      {
        "id" : "12394142",
        "ip" : "10.10.10.1",
        "detectionList" : [
          {
            "uniqueVulnId" : 102050695,
            "qid" : 15055,
            "type" : "Potential",
            "severity" : 3,
        ]
      }
    ]
  }
}

truncation_limit

Default : 999

max : Not applicable

assetsPerPage

Default : 1000

max      : 10000

scan_date_since 

No date range limit.

scanDateTime 

• Default date range is 6 months from the current date.
• Can specify a range using "before" and "after" dates, but the total range must not exceed 12 months.
• If the range exceeds 12 months, the API returns a validation error.

show_results By default the result data will be included in the API response.

Default : true

showResults By default result data will not be included in the API response.

Default : false

Pagination

Page URL will have min host ID for next page reference.

<WARNING>
    <CODE>1980</CODE>
    <TEXT>1 record limit exceeded. Use URL to get next batch of results.</TEXT>
    <URL>
        <URL>
            <![CDATA[https://qualysapi.p04.eng.sjc01.qualys.com/api/5.0/fo/asset/host/vm/detection/?action=list&show_results=0&output_format=XML&ips=10.10.10.114,10.10.10.1,10.11.65.119,10.115.10.129,10.115.98.129&truncation_limit=1&id_min=7146977]]>
        </URL>
    </URL>
</WARNING>

Next page reference by id_min:  https://qualysapi.p04.eng.sjc01.qualys.com/api/5.0/fo/asset/host/vm/detection/?action=list&show_results=0&output_format=XML&ips=10.10.10.114,10.10.10.1,10.11.65.119,10.115.10.129,10.115.98.129&truncation_limit=1&id_min=7146977

Pagination

Page URL will have page number for next page reference.

{

"pageNumber" : "1",
 "requestId" : "4ed09116-970c-4052-9103-d8ee33b971a0",
 "nextPageRef" : "https://gateway.p04.eng.sjc01.qualys.com/vmrs/api/1.0/host/list/detections?requestId=4ed09116-970c-4052-9103-d8ee33b971a0&pageNumber=2",
  "status" : "success"
}

Next page reference by pageNumber: https://gateway.p04.eng.sjc01.qualys.com/vmrs/api/1.0/host/list/detections?requestId=4ed09116-970c-4052-9103-d8ee33b971a0&pageNumber=2

show_qds

By default, QDS score is not included for detections.

(Optional) Specifies the maximum number of host records processed per request. If the requested list identifies more host records than the specified limit, the response will include URL for making another request for the next batch of host records.

• Default limit to 1000 assets. Maximum limit can be set to 10000 assets per page.

network_ids

(Optional, and valid only when the Network Support feature is enabled for the user’s account) Restrict the request to certain custom network IDs. Multiple network IDs are comma separated.

Restrict the request to a certain custom network by specifying the network ID. When unspecified, we default to-100 (All networds) for the Global Default Network.

(Optional) Show only hosts which have an operating system matching a certain regular expression. An empty value cannot be specified. Use “^$” to match empty string.

Important: The regular expression string you enter must follow the PCRE standard and it must be URL encoded.

For information about the Perl Compatible Regular Expressions (PCRE) standard visit: http://php.net/manual/en/book.pcre.php

For the PCRE syntax, see: http://php.net/manual/en/reference.pcre.pattern.syntax.php

(Optional) Show only certain IPv6 addresses/ranges. One or more IPv6s/ranges may be specified. Multiple entries are comma separated. An IPv6 range is specified with a hyphen (for example: 2001:df1:f600:247c::a73:7c94-2001:df1:f600:247c::a73:7c96).

• Optional only if any of (ids,  AG parameters or Tag parameters) is present. User can provide any combination of hostIds, ips, asset groups and tags.

 (Optional) Show only detections whose detection status changed after a certain date and time. For detections that have never changed the date is applied to the last detection date. Valid date format is: YYYY-MM-DD[THH:MM:SSZ] format (UTC/GMT), like “2017-02-15” or “2017-02-
15T23:15:00Z”.

You can use this parameter in conjunction with the dateFilter.detectionUpdatedDateTime.before parameter to limit the detections shown to a specific date range.

One of these parameters may be specified in the same request: dateFilter.detectionUpdatedDateTime.after, dateFilter.detectionUpdatedDateTime.before.

All date filters are under single JSON key 'dateFilter'.

 (Optional) Show only detections whose detection status changed before a certain date and time. Valid date format is: YYYY-MM-DD[THH:MM:SSZ] format (UTC/GMT), like
“2017-02-15” or “2017-02-15T23:15:00Z”.

Tip: You can use this parameter in conjunction with the dateFilter.detectionUpdateDateTime.after parameter to limit the detections shown to a specific date range.

One of these parameters may be specified in the same request: dateFilter.detectionUpdateDateTime.after, dateFilter.detectionUpdateDateTime.before

All date filters are under single JSON key 'dateFilter'.

(Optional) Show only hosts with one or more of these status values: New, Active, Re-Opened, Fixed. Multiple status values are entered as a comma-separated list.

If this parameter is not passed to the API, by default, the output contains detections with New, Active or Re-Opened <STATUS> only.

To get hosts with Fixed status, check this API sample Qualys API - Host List Detection API samples (GitHub, sample 11).

(Optional) Show only detection records with a QDS value greater than or equal to the QDS min value specified. When qdsrange.min and qdsrange.max are specified in the same request, the qdsrange.min value must
be less than the qdsrange.max value.

• The QDS Scores filters (min and max) are added under the hierarchy of 'qdsRange'.

(Optional) Show only detection records with a QDS value less than or equal to the QDS max value specified. When qdsRange.min and qdsRange.max are specified in the same request, the qdsRange.min value must be less than the qdsRange.max value.

The QDS Scores filters (min and max) are added under the hierarchy of 'qdsRange'.

include_vuln_type

(Optional) Use to download vulnerability information based on their type, confirmed or potential. Specify:

 "includeVulnType": "Confirmed" to download only confirmed vulnerabilities.

 "includeVulnType": "Potential" to download only potential vulnerabilities.

Exceptional Scenarios

• After passing the parameter value
  •  "includeVulnType": "Confirmed", some potential vulnerabilities may show up in the API response. This happens when the vulnerability type for the QID is modified in the Qualys KnowledgeBase.
• After passing the parameter value
  •  "includeVulnType": "Confirmed", some confirmed vulnerabilities show up in the API response. This happens with the vulnerabilities assigned with a half red/half yellow severity level.
• After passing the parameter value  "includeVulnType": "Confirmed", some confirmed vulnerabilities may not be shown in API response. This will happen when vulnerabilities are assigned with a half red/half yellow severity level.
• This happens when the vulnerability type for the QID is changed while running the authenticated scan. It is because of various factors affecting scan results.

include_disabled

(Optional except as noted) Specify 'true' to show detection records with information gathered along with confirmed vulnerabilities and potential vulnerabilities. Specify 'false' (default) to hide information gathered. The showIgs parameter is required in one use case. The parameter "showIgs": true must be specified if both these conditions are met:

1) Search lists are included using the parameter qidFilter.searchList.includeTitles or
 qidFilter.searchList.includeIds.

2) If the included search lists contain only information gathered.

Show TruRisk Elimination Status i.e 'Mitigated' or 'Isolated' for the detections.

This feature is limited to TruRisk Eliminate Enabled Subscriptions only.

 Show Detection sources and latest detection source for detected Vulns and IGs.

This feature is limited to Detection Source Data Enabled Subscriptions only. 

 (Optional) When specified, we show the asset CVEs of the detections in the output. The default value of this parameter is set to false. When set to false, we do not show the asset cve information for the detections.

This flag is applicable only when 'assetCveDetection' tweak is enabled for the subscription.

The number of assets per page is defined in the first request to HLD. At this stage the page size is fixed and for subsequent pagination requests, you only need to provide page number.

For example, if the hosts are defined from id 1 to 200 and assetsPerPage=100 then each page will have 100 hosts. Hence ,
if pageNumber=1 → Host ids = 1 to 100

if pageNumber=2 → Host ids = 101 to 200.

Tagset Id can be provided in case it is already created using Portal API. This is an alternative to providing Tag information in 'hostTarget.tag'

(List of applicable network IDs to the provided IPV6 "addresses". (Valid only when the Network Support feature is enabled for the user’s account)

Restrict the request to a certain custom network by specifying the network ID. When unspecified, we default to “0” for the Global Default Network.)

The result can be achieved by using the two date filters: dateFilter.detectionUpdatedDateTime.before and dateFilter.detectionUpdatedDateTime.after. These will serve as the only date-based filters applied to detection.

The result can be achieved by using the two date filters: dateFilter.scanDateTime.after and dateFilter.scanDateTime.before. These will serve as the only date-based filters applied to detection.

The result can be achieved by using the two date filters: dateFilter.scanDateTime.after and dateFilter.scanDateTime.before. These will serve as the only date-based filters applied to detection.

The result can be achieved by using the two date filters: dateFilter.scanDateTime.after and dateFilter.scanDateTime.before. These will serve as the only date-based filters applied to detection.

The result can be achieved by using the two date filters: dateFilter.scanDateTime.after and dateFilter.scanDateTime.before. These will serve as the only date-based filters applied to detection.

The result can be achieved by using the two date filters: dateFilter.scanDateTime.after and dateFilter.scanDateTime.before. These will serve as the only date-based filters applied to detection.

Login User details and request datetime

  Echo Request

  Host List

  Detection

Pagination