Qualys VM, PA APIs
Click here to see this page in full context


List Reports

For API version information, refer to the API Version History section.

V2.0 | V3.0

V2.0

GET POST/api/2.0/fo/report/?action=list

List reports in the user's account. The report list output includes all report types, including scorecard reports.

 You can generate a scan based report for a paused scan. The report still reflects all data processed prior to the pause.

Permissions - Managers and Auditors view all assets in the subscription, Unit Managers view assets in their own business unit, Scanners and Readers view assets in their own account.

Input ParametersInput Parameters

Parameter

Required/Optional

Data Type

Description

action=list

Required

 String 

Specify action to list reports.

echo_request={0|1}

Optional

 Integer 

Specify 1 to view (echo) input parameters in the XML output. By default these are not included.

id={value}

Optional

 Integer 

Specifies a report ID of a report that is saved in the Report Share storage space. When specified, information on the selected report will be included in the XML output.

state={value}

Optional

 Integer

Specifies that reports with a certain state will be included in the XML output. By default, all states are included. A valid value is: Running (reports are in progress), Finished, Submitted, Canceled, or Errors.

user_login={value}

Optional

 Integer 

Specifies a user login ID. This parameter is used to restrict the XML output to reports launched by the specified user login ID.

expires_before_datetime={date}

Optional

 Integer 

Specifies the date and time (optional) when reports will expire in the future. Only reports that expire before this date/time will be included in the XML output.

The date/time is specified in YYYY-MM-DD[THH:MM:SSZ] format (UTC/GMT), like "2007-07-01" or "2007-01-25T23:12:00Z".

client_id= {value}

Optional

 Integer 

Id assigned to the client (Consultant subscription only). Parameter client_id or client_name may be specified for the same request.

client_name= {value}

Optional

 String 

Name of the client (Consultant subscription only). Parameter client_id or client_name may be specified for the same request.

Sample - List ReportsSample - List Reports

API Request

curl -H "X-Requested-With: Curl Sample"-b "QualysSession=71e6cda2a35d2cd404cddaf305ea0208; path=/api; secure" "<qualys_base_url>/api/2.0/fo/report/?action=list"

API Response

<?xml version="1.0" encoding="UTF-8" ?>
<!DOCTYPE REPORT_LIST_OUTPUT SYSTEM "<qualys_base_url>/api/2.0/fo/report/report_list_output.dtd">
<REPORT_LIST_OUTPUT>
  <RESPONSE>
    <DATETIME>2017-10-30T22:32:15Z</DATETIME>
    <REPORT_LIST>
      <REPORT>
        <ID>42703</ID>
        <TITLE><![CDATA[Test now]]></TITLE>
        <TYPE>Scan</TYPE>
        <USER_LOGIN>user@123</USER_LOGIN>
        <LAUNCH_DATETIME>2017-10-30T17:59:22Z</LAUNCH_DATETIME>
        <OUTPUT_FORMAT>PDF</OUTPUT_FORMAT>
        <SIZE>129.1 MB</SIZE>
        <STATUS>
          <STATE>Finished</STATE>
        </STATUS>
        <EXPIRATION_DATETIME>2017-11-06T17:59:24Z</EXPIRATION_DATETIME>
      </REPORT>
      <REPORT>
        <ID>42700</ID>
        <TYPE>Scorecard</TYPE>
        <USER_LOGIN>user@123</USER_LOGIN>
        <LAUNCH_DATETIME>2017-10-29T22:12:42Z</LAUNCH_DATETIME>
        <OUTPUT_FORMAT>SECURE_PDF</OUTPUT_FORMAT>
        <SIZE>18.1 KB</SIZE>
        <STATUS>
          <STATE>Finished</STATE>
        </STATUS>
        <EXPIRATION_DATETIME>2017-11-05T22:12:44Z</EXPIRATION_DATETIME>
      </REPORT>
      <REPORT>
        <ID>42699</ID>
        <TYPE>Scorecard</TYPE>
        <USER_LOGIN>user@123</USER_LOGIN>
        <LAUNCH_DATETIME>2017-10-29T21:52:19Z</LAUNCH_DATETIME>
        <OUTPUT_FORMAT>PDF</OUTPUT_FORMAT>
        <SIZE>19.87 KB</SIZE>
        <STATUS>
          <STATE>Finished</STATE>
        </STATUS>
        <EXPIRATION_DATETIME>2017-11-05T21:52:21Z</EXPIRATION_DATETIME>
      </REPORT>
    </REPORT_LIST>
  </RESPONSE>
</REPORT_LIST_OUTPUT>

Sample - View Response Progress UpdatesSample - View Response Progress Updates

API Request

curl -H "X-Requested-With: Curl Sample"
-b "QualysSession=71e6cda2a35d2cd404cddaf305ea0208; path=/api; 
secure" "/api/2.0/fo/report/?action=list""

API Response

<?xml version="1.0" encoding="UTF-8" ?>
<!DOCTYPE REPORT_LIST_OUTPUT SYSTEM "<qualys_base_url>/api/2.0/fo/report/report_list_output.dtd">
<!-- Processing reports: 274/10598 processed -->
<!-- Processing reports: 564/10598 processed -->
<!-- Processing reports: 854/10598 processed -->
<!-- Processing reports: 1145/10598 processed -->
<!-- Processing reports: 1433/10598 processed -->
<!-- Processing reports: 1719/10598 processed -->
<!-- Processing reports: 2005/10598 processed -->
<!-- Processing reports: 2295/10598 processed -->
<!-- Processing reports: 2589/10598 processed -->
<!-- Processing reports: 2877/10598 processed -->
<!-- Processing reports: 3164/10598 processed -->
<!-- Processing reports: 3455/10598 processed -->
<!-- Processing reports: 3745/10598 processed -->
<!-- Processing reports: 4029/10598 processed -->
<!-- Processing reports: 4312/10598 processed -->
<!-- Processing reports: 4594/10598 processed -->
<!-- Processing reports: 4874/10598 processed -->
<!-- Processing reports: 5162/10598 processed -->
<!-- Processing reports: 5449/10598 processed -->
<!-- Processing reports: 5736/10598 processed -->
<!-- Processing reports: 6027/10598 processed -->
<!-- Processing reports: 6314/10598 processed -->
<!-- Processing reports: 6606/10598 processed -->
<!-- Processing reports: 6893/10598 processed -->
<!-- Processing reports: 7179/10598 processed -->
<!-- Processing reports: 7468/10598 processed -->
<!-- Processing reports: 7757/10598 processed -->
<!-- Processing reports: 8048/10598 processed -->
<!-- Processing reports: 8340/10598 processed -->
<!-- Processing reports: 8629/10598 processed -->
<!-- Processing reports: 8912/10598 processed -->
<!-- Processing reports: 9201/10598 processed -->
<!-- Processing reports: 9494/10598 processed -->
<!-- Processing reports: 9786/10598 processed -->
<!-- Processing reports: 10079/10598 processed -->
<!-- Processing reports: 10369/10598 processed -->
<!-- Processing reports: 10598/10598 processed -->
<REPORT_LIST_OUTPUT>
    <RESPONSE>
        <DATETIME>2026-07-21T08:45:44Z</DATETIME>
        <REPORT_LIST>
            <REPORT>
                <ID>4302141</ID>
                <TITLE>
                    <![CDATA[SCHEDULED POLICY REPORT  NOTIFICATION TEST]]>
                </TITLE>
                <TYPE>Compliance</TYPE>
                <USER_LOGIN>rstec_rs</USER_LOGIN>
                <LAUNCH_DATETIME>2026-07-20T19:32:10Z</LAUNCH_DATETIME>
                <OUTPUT_FORMAT>HTML</OUTPUT_FORMAT>
                <SIZE>-</SIZE>
                <STATUS>
                    <STATE>Errors</STATE>
                    <MESSAGE>
                        <![CDATA[Rendering glossary...]]>
                    </MESSAGE>
                    <PERCENT>77</PERCENT>
                </STATUS>
                <EXPIRATION_DATETIME>2026-08-17T19:32:18Z</EXPIRATION_DATETIME>
            </REPORT>
      .
      .
      .
      .
      .
      .
      
            <REPORT>
                <ID>4238259</ID>
                <TITLE>
                    <![CDATA[Policy Report - Policy SDC]]>
                </TITLE>
                <TYPE>Compliance</TYPE>
                <USER_LOGIN>rstec_rs</USER_LOGIN>
                <LAUNCH_DATETIME>2026-06-23T09:50:15Z</LAUNCH_DATETIME>
                <OUTPUT_FORMAT>CSV</OUTPUT_FORMAT>
                <SIZE>2.27 KB</SIZE>
                <STATUS>
                    <STATE>Finished</STATE>
                </STATUS>
                <EXPIRATION_DATETIME>2026-07-21T09:51:00Z</EXPIRATION_DATETIME>
            </REPORT>
        </REPORT_LIST>
    </RESPONSE>
</REPORT_LIST_OUTPUT>

DTD

<platform API server>/api/2.0/fo/report/report_list_output.dtd

V3.0

GET POST/api/3.0/fo/report/?action=list

List reports in the user's account. The report list output includes all report types, including scorecard reports.

 You can generate a scan based report for a paused scan. The report still reflects all data processed prior to the pause.

Permissions - Managers and Auditors view all assets in the subscription, Unit Managers view assets in their own business unit, Scanners and Readers view assets in their own account.

Input ParametersInput Parameters

Parameter

Required/Optional

Data Type

Description

action=list

Required

 String 

Specify action to list reports.

echo_request={0|1}

Optional

 Integer 

Specify 1 to view (echo) input parameters in the XML output. By default these are not included.

id={value}

Optional

 Integer 

Specifies a report ID of a report that is saved in the Report Share storage space. When specified, information on the selected report will be included in the XML output.

state={value}

Optional

 Integer

Specifies that reports with a certain state will be included in the XML output. By default, all states are included. A valid value is: Running (reports are in progress), Finished, Submitted, Canceled, or Errors.

user_login={value}

Optional

 Integer 

Specifies a user login ID. This parameter is used to restrict the XML output to reports launched by the specified user login ID.

expires_before_datetime={date}

Optional

 Integer 

Specifies the date and time (optional) when reports will expire in the future. Only reports that expire before this date/time will be included in the XML output.

The date/time is specified in YYYY-MM-DD[THH:MM:SSZ] format (UTC/GMT), like "2007-07-01" or "2007-01-25T23:12:00Z".

client_id= {value}

Optional

 Integer 

Id assigned to the client (Consultant subscription only). Parameter client_id or client_name may be specified for the same request.

client_name= {value}

Optional

 String 

Name of the client (Consultant subscription only). The parameter client_id or client_name may be specified for the same request.
fqdns={value}
 Optional Integer The target FQDN for a vulnerability scan. You must specify at least one target. Multiple values are comma-separated. 
report_type={value}
 Optional String

Filter the report list by report type. Multiple comma-separated values are supported.

Reports matching any of the specified types are returned.

Values are case-sensitive.

Valid values are - Scan, Map, Remediation, Patch, Compliance, Policy, Stig, Scorecard, and Authentication.

When report_type is not specified, all report types are returned.

Sample - List ReportsSample - List Reports

API Request

curl -H "X-Requested-With: Curl Sample"-b "QualysSession=71e6cda2a35d2cd404cddaf305ea0208; path=/api; secure" "<qualys_base_url>/api/3.0/fo/report/?action=list"

API Response

<?xml version="1.0" encoding="UTF-8" ?>
<!DOCTYPE REPORT_LIST_OUTPUT SYSTEM "<qualys_base_url>/api/3.0/fo/report/report_list_output.dtd">
<REPORT_LIST_OUTPUT>
  <RESPONSE>
    <DATETIME>2017-10-30T22:32:15Z</DATETIME>
    <REPORT_LIST>
      <REPORT>
        <ID>42703</ID>
        <TITLE><![CDATA[Test now]]></TITLE>
        <TYPE>Scan</TYPE>
        <USER_LOGIN>user@123</USER_LOGIN>
        <LAUNCH_DATETIME>2017-10-30T17:59:22Z</LAUNCH_DATETIME>
        <OUTPUT_FORMAT>PDF</OUTPUT_FORMAT>
        <SIZE>129.1 MB</SIZE>
        <STATUS>
          <STATE>Finished</STATE>
        </STATUS>
        <EXPIRATION_DATETIME>2017-11-06T17:59:24Z</EXPIRATION_DATETIME>
      </REPORT>
      <REPORT>
        <ID>42700</ID>
        <TYPE>Scorecard</TYPE>
        <USER_LOGIN>user@123</USER_LOGIN>
        <LAUNCH_DATETIME>2017-10-29T22:12:42Z</LAUNCH_DATETIME>
        <OUTPUT_FORMAT>SECURE_PDF</OUTPUT_FORMAT>
        <SIZE>18.1 KB</SIZE>
        <STATUS>
          <STATE>Finished</STATE>
        </STATUS>
        <EXPIRATION_DATETIME>2017-11-05T22:12:44Z</EXPIRATION_DATETIME>
      </REPORT>
      <REPORT>
        <ID>42699</ID>
        <TYPE>Scorecard</TYPE>
        <USER_LOGIN>user@123</USER_LOGIN>
        <LAUNCH_DATETIME>2017-10-29T21:52:19Z</LAUNCH_DATETIME>
        <OUTPUT_FORMAT>PDF</OUTPUT_FORMAT>
        <SIZE>19.87 KB</SIZE>
        <STATUS>
          <STATE>Finished</STATE>
        </STATUS>
        <EXPIRATION_DATETIME>2017-11-05T21:52:21Z</EXPIRATION_DATETIME>
      </REPORT>
    </REPORT_LIST>
  </RESPONSE>
</REPORT_LIST_OUTPUT>

Sample - View Response Progress UpdatesSample - View Response Progress Updates

API Request

curl --location --request POST
'<qualys_base_url>/api/3.0/fo/report/?echo_request=1&action=list' \ 
--header 'X-Requested-With: curl' \ 
--header 'Authorization: Basic Encoded username:passwordstring'

API Response

<?xml version="1.0" encoding="UTF-8" ?>
<!DOCTYPE REPORT_LIST_OUTPUT SYSTEM "<qualys_base_url>/api/3.0/fo/report/report_list_output.dtd">
<!-- Processing reports: 274/10598 processed -->
<!-- Processing reports: 564/10598 processed -->
<!-- Processing reports: 854/10598 processed -->
<!-- Processing reports: 1145/10598 processed -->
<!-- Processing reports: 1433/10598 processed -->
<!-- Processing reports: 1719/10598 processed -->
<!-- Processing reports: 2005/10598 processed -->
<!-- Processing reports: 2295/10598 processed -->
<!-- Processing reports: 2589/10598 processed -->
<!-- Processing reports: 2877/10598 processed -->
<!-- Processing reports: 3164/10598 processed -->
<!-- Processing reports: 3455/10598 processed -->
<!-- Processing reports: 3745/10598 processed -->
<!-- Processing reports: 4029/10598 processed -->
<!-- Processing reports: 4312/10598 processed -->
<!-- Processing reports: 4594/10598 processed -->
<!-- Processing reports: 4874/10598 processed -->
<!-- Processing reports: 5162/10598 processed -->
<!-- Processing reports: 5449/10598 processed -->
<!-- Processing reports: 5736/10598 processed -->
<!-- Processing reports: 6027/10598 processed -->
<!-- Processing reports: 6314/10598 processed -->
<!-- Processing reports: 6606/10598 processed -->
<!-- Processing reports: 6893/10598 processed -->
<!-- Processing reports: 7179/10598 processed -->
<!-- Processing reports: 7468/10598 processed -->
<!-- Processing reports: 7757/10598 processed -->
<!-- Processing reports: 8048/10598 processed -->
<!-- Processing reports: 8340/10598 processed -->
<!-- Processing reports: 8629/10598 processed -->
<!-- Processing reports: 8912/10598 processed -->
<!-- Processing reports: 9201/10598 processed -->
<!-- Processing reports: 9494/10598 processed -->
<!-- Processing reports: 9786/10598 processed -->
<!-- Processing reports: 10079/10598 processed -->
<!-- Processing reports: 10369/10598 processed -->
<!-- Processing reports: 10598/10598 processed -->
<REPORT_LIST_OUTPUT>
    <RESPONSE>
        <DATETIME>2026-07-21T08:45:44Z</DATETIME>
        <REPORT_LIST>
            <REPORT>
                <ID>4302141</ID>
                <TITLE>
                    <![CDATA[SCHEDULED POLICY REPORT  NOTIFICATION TEST]]>
                </TITLE>
                <TYPE>Compliance</TYPE>
                <USER_LOGIN>rstec_rs</USER_LOGIN>
                <LAUNCH_DATETIME>2026-07-20T19:32:10Z</LAUNCH_DATETIME>
                <OUTPUT_FORMAT>HTML</OUTPUT_FORMAT>
                <SIZE>-</SIZE>
                <STATUS>
                    <STATE>Errors</STATE>
                    <MESSAGE>
                        <![CDATA[Rendering glossary...]]>
                    </MESSAGE>
                    <PERCENT>77</PERCENT>
                </STATUS>
                <EXPIRATION_DATETIME>2026-08-17T19:32:18Z</EXPIRATION_DATETIME>
            </REPORT>
      .
      .
      .
      .
      .
      .
      
            <REPORT>
                <ID>4238259</ID>
                <TITLE>
                    <![CDATA[Policy Report - Policy SDC]]>
                </TITLE>
                <TYPE>Compliance</TYPE>
                <USER_LOGIN>rstec_rs</USER_LOGIN>
                <LAUNCH_DATETIME>2026-06-23T09:50:15Z</LAUNCH_DATETIME>
                <OUTPUT_FORMAT>CSV</OUTPUT_FORMAT>
                <SIZE>2.27 KB</SIZE>
                <STATUS>
                    <STATE>Finished</STATE>
                </STATUS>
                <EXPIRATION_DATETIME>2026-07-21T09:51:00Z</EXPIRATION_DATETIME>
            </REPORT>
        </REPORT_LIST>
    </RESPONSE>
</REPORT_LIST_OUTPUT>

Sample - List reports filtered by report typeSample - List reports filtered by report type

API Request

curl -u "USERNAME:PASSWORD" \
-H "X-Requested-With: Curl" \
"<qualys_base_url>/api/3.0/fo/report/?action=list&report_type=Stig,Scorecard"

API Response

<?xml version="1.0" encoding="UTF-8" ?>
<!DOCTYPE REPORT_LIST_OUTPUT SYSTEM "<qualys_base_url>/api/3.0/fo/report/report_list_output.dtd">
<REPORT_LIST_OUTPUT>
  <RESPONSE>
    <DATETIME>2026-09-25T14:35:00Z</DATETIME>
    <REPORT_LIST>
      <REPORT>
        <ID>12345678</ID>
        <TITLE><![CDATA[STIG Report - DMZ Servers]]></TITLE>
        <TYPE>Compliance</TYPE>
        <USER_LOGIN>user_ab1</USER_LOGIN>
        <LAUNCH_DATETIME>2026-09-25T14:30:00Z</LAUNCH_DATETIME>
        <OUTPUT_FORMAT>CSV</OUTPUT_FORMAT>
        <SIZE>245760</SIZE>
        <STATUS>
          <STATE>Finished</STATE>
        </STATUS>
        <EXPIRATION_DATETIME>2026-10-02T14:30:00Z</EXPIRATION_DATETIME>
      </REPORT>
      <REPORT>
        <ID>12345123</ID>
        <TITLE><![CDATA[Weekly Scorecard]]></TITLE>
        <TYPE>Scorecard</TYPE>
        <USER_LOGIN>user_cd2</USER_LOGIN>
        <LAUNCH_DATETIME>2026-09-24T09:15:00Z</LAUNCH_DATETIME>
        <OUTPUT_FORMAT>PDF</OUTPUT_FORMAT>
        <SIZE>19.87 KB</SIZE>
        <STATUS>
          <STATE>Finished</STATE>
        </STATUS>
        <EXPIRATION_DATETIME>2026-10-01T09:15:00Z</EXPIRATION_DATETIME>
      </REPORT>
    </REPORT_LIST>
  </RESPONSE>
</REPORT_LIST_OUTPUT>

DTD

<platform API server>/api/3.0/fo/report/report_list_output.dtd

API Version History

The following table depicts the information about the different versions of this API along with the status:

API Version EOS EOL
/api/3.0/fo/report/?action=list Active Active
/api/2.0/fo/report/?action=list December 2025 December 2026

 

 

success Thank you! We're glad to hear that this topic was useful.
success We appreciate your feedback. We'll work to make this topic better for you in the future.