Policy Audit Release 1.14 API

August 7, 2026

In the API Release Notes, <qualys_base_url> and <gateway_base_url> is used as a sample API request to represent the API server URL. To learn more about the API server URL for your environment, refer to the Know Your Qualys API Server URL section.

We have implemented versioning for APIs. For more information on API versioning, refer to the Updates on API Versioning Standards & Deprecation Timelines blog.

Manage Compliance Frameworks Using Various Framework Policy APIs

Compliance Framework policies help you meet specific technical and regulatory requirements. To assess a framework's overall posture, policies must be created using controls mapped to that framework. Creating these policies involves a defined process with several repetitive steps that can be automated. Once the process is automated, you can quickly generate policies for various compliance frameworks, reduce manual efforts, and minimize back-and-forth communication.

With this release, we have introduced the following framework APIs that can help you automate the repetitive steps:

Frameworks List API
Technologies List API
Benchmarks List API
Asset Groups List API
Asset Tags List API
Configure Controls API
Create Framework Policy API

- When creating a framework policy, you can include up to 25 technologies.
- This API feature is available to users with Policy Audit subscription only.

Frameworks List API

New or Updated API	New
API Endpoint (New Version)	/pcas/v1/frameworks
Method	GET

List available frameworks with their names and IDs.

Sample - List available frameworksSample - List available frameworks

API Request

curl --location '<gateway_base_url>/pcas/v1/frameworks' \
--header 'Authorization: Bearer '

JSON Response

[
  {
    "id": 10143,
    "name": "Royal Decree 311/2022",
    "recommended": false,
    "version": "July 2022"
  },
  {
    "id": 10144,
    "name": "Royal Decree 311/2022 - Annex II (HIGH)",
    "recommended": false,
    "version": "July 2022"
  },
  {
    "id": 10145,
    "name": "Royal Decree 311/2022 - Annex II (MEDIUM)",
    "recommended": false,
    "version": "July 2022"
  }
]

Technologies List API

New or Updated API	New
API Endpoint (New Version)	/pcas/v1/technology
Method	GET

List available technologies for a particular category.

Sample - List available technologiesSample - List available technologies

API Request

curl --location '<gateway_base_url>/pcas/v1/technology'\
--header 'Authorization: Bearer'

JSON Response

[
  {
    "categoryId": 1,
    "categoryName": "Operating system",
    "technologiesCount": 148,
    "technologies": [
      {
        "id": 6,
        "name": "AIX 5.x"
      },
      {
        "id": 35,
        "name": "AIX 6.x"
      },
      {
        "id": 430,
        "name": "Redis 7.x"
      }
    ]
  }
]

Benchmarks List API

New or Updated API	New
API Endpoint (New Version)	/pcas/v1/frameworks/benchmarks
Method	GET

List available benchmarks with their names and IDs.

Sample - List available benchmarksSample - List available benchmarks

API Request

curl --location '<gateway_base_url>/pcas/v1/frameworks/benchmarks' \
--header 'Authorization: Bearer '

JSON Response

[
  {
    "id": 1000,
    "name": "Qualys"
  },
  {
    "id": 1001,
    "name": "CIS"
  },
  {
    "id": 1051,
    "name": "Vendor"
  },
  {
    "id": 2050,
    "name": "DISA STIG"
  }
]

Asset Groups List API

New or Updated API	New
API Endpoint (New Version)	/pcas/v1/asset/group/list
Method	GET

List available asset groups with their names and IDs.

Sample - List available asset groupsSample - List available asset groups

API Request

curl --location '<gateway_base_url>/pcas/v1/asset/group/list' \
--header 'Authorization: Bearer '

JSON Response

[
  {
    "id": 55294832,
    "name": "AG - 10.11.70.44"
  },
  {
    "id": 55578061,
    "name": "RobotSanity_AG_dummyIP_20250528_1008"
  },
  {
    "id": 55578309,
    "name": "myAG_dev_99"
  }
]

Asset Tags List API

New or Updated API	New
API Endpoint (New Version)	/pcas/v1/asset/tags
Method	GET

List available asset tags with their names and IDs.

Sample - List available asset tagsSample - List available asset tags

API Request

curl --location '<gateway_base_url>/pcas/v1/asset/tags' \
--header 'Authorization: Bearer '

JSON Response

[
  {
    "name": "Cloud Agent",
    "id": 39011464
  },
  {
    "name": "CIS_MB",
    "id": 54024422
  },
  {
    "name": "AG_MB_NEW",
    "id": 54024423
  },
  {
    "name": "AG - 10.11.70.44",
    "id": 39297833
  },
  {
    "name": "Asset Groups",
    "id": 39297832
  },
  {
    "name": "myAG_dev_99",
    "id": 48282462
  }
]

Configure Controls API

New or Updated API	New
API Endpoint (New Version)	/pcas/v1/frameworks/configure/controls
Method	POST

Get the list of controls that are grouped by sections.

Input ParametersInput Parameters

Parameter Name	Required / Optional	Data Type	Description
frameworkId={value}	Required	Integer	Framework ID for which controls are to be configured.
technologyIds={value}	Required	Integer	Technology ID for which controls are to be configured.
benchmarks	Required	String	Benchmark for which controls are to be configured.

Sample - List available frameworksSample - List available frameworks

API Request

curl --location '<gateway_base_url>/pcas/v1/frameworks/configure/controls' \
--header 'Content-Type: application/json' \
--header 'Authorization: Bearer ' \
--data '{
  "frameworkId": 5081,
  "technologyIds": [
    390,391
  ],
  "benchmarks": [
    "CIS","DISA STIG","Qualys","Vendor"
  ]
}'

JSON Response

[
  {
    "sectionNumber": 1,
    "sectionHeading": "Access Control",
    "controls": [
      {
        "controlId": 7942,
        "sectionNumber": 1,
        "controlNumber": 1,
        "criticality": "5",
        "isControlDisable": false,
        "evaluate": "<CTRL><DP><K>mssql.secman.general.sa_acct_disable</K><CD>matches</CD><OP>xre</OP><FV set=\"0\">0</FV><FV set=\"1\">161803399999999</FV><V><![CDATA[^1$]]></V><FV set=\"1\">1</FV></DP></CTRL>",
        "technologyId": 390,
        "isControlConfigured": true,
        "criticalityLabel": "URGENT"
      },
      {
        "controlId": 11272,
        "sectionNumber": 1,
        "controlNumber": 2,
        "criticality": "5",
        "isControlDisable": false,
        "evaluate": "<CTRL><DP><K>mssql.secman.general.permissions_granted_to_public</K><CD>does not contain</CD><OP>xre</OP><FV set=\"1\">161803399999999</FV><V><![CDATA[.+]]></V></DP></CTRL>",
        "technologyId": 390,
        "isControlConfigured": true,
        "criticalityLabel": "URGENT"
      }
    ]
  },
  {
    "sectionNumber": 2,
    "sectionHeading": "Accountability, Audit, And Risk Management",
    "controls": [
      {
        "controlId": 7389,
        "sectionNumber": 2,
        "controlNumber": 1,
        "criticality": "2",
        "isControlDisable": false,
        "evaluate": "<CTRL><DP><K>mssql.registry.hideinstance</K><CD>matches</CD><OP>xre</OP><FV set=\"0\">161803399999999</FV><V><![CDATA[^1$]]></V><FV set=\"1\">314159265358979</FV></DP></CTRL>",
        "technologyId": 390,
        "isControlConfigured": true,
        "criticalityLabel": "MEDIUM"
      }
    ]
  },
  {
    "sectionNumber": 3,
    "sectionHeading": "Audit And Accountability",
    "controls": [
      {
        "controlId": 27015,
        "sectionNumber": 3,
        "controlNumber": 1,
        "criticality": "4",
        "isControlDisable": false,
        "evaluate": "<CTRL><DP><K>mssql.secman.general.FAILED_DATABASE_AUTHENTICATION_GROUP</K><CD>matches</CD><OP>xre</OP><FV set=\"0\">161803399999999</FV><FV set=\"0\">314159265358979</FV><V><![CDATA[^SUCCESS AND FAILURE:Y:Y$]]></V></DP></CTRL>",
        "technologyId": 391,
        "isControlConfigured": true,
        "criticalityLabel": "CRITICAL"
      }
    ]
  },
  {
    "sectionNumber": 4,
    "sectionHeading": "Configuration Management",
    "controls": [
      {
        "controlId": 25645,
        "sectionNumber": 4,
        "controlNumber": 1,
        "criticality": "3",
        "isControlDisable": false,
        "evaluate": "<CTRL><DP><K>bind.list.enabled.services</K><CD>does not contain</CD><OP>xre</OP><FV set=\"1\">314159265358979</FV><V><![CDATA[.+]]></V></DP></CTRL>",
        "technologyId": 391,
        "isControlConfigured": true,
        "criticalityLabel": "SERIOUS"
      },
      {
        "controlId": 25646,
        "sectionNumber": 4,
        "controlNumber": 2,
        "criticality": "3",
        "isControlDisable": false,
        "evaluate": "<CTRL><DP><K>bind.allowrecursion</K><CD>matches</CD><OP>xre</OP><FV set=\"0\">314159265358979</FV><V><![CDATA[((?:\\b(?:\\d{1,3}\\.){3}\\d{1,3}(?:/\\d{1,2})?\\b)|localhost|local)]]></V></DP></CTRL>",
        "technologyId": 391,
        "isControlConfigured": true,
        "criticalityLabel": "SERIOUS"
      }
    ]
  }
]

Create Framework Policy API

New or Updated API	New
API Endpoint (New Version)	/pcas/v3/policy
Method	POST

With this API, you can create a new framework policy.

Input ParametersInput Parameters

Parameter Name	Required / Optional	Data Type	Description
frameworkId={value}	Required	Integer	Framework ID for which framework policy needs to be created.
technologyIds={value}	Required	Integer	Technology ID for which framework policy needs to be created.
policyTitle={value}	Required	String	Title for the framwork policy is to be created.
assetGroupIds={value}	Optional	Integer	Asset Group IDs for which framework policy needs to be created.
isLocked={true\|false}	Optional	Boolean	Use this parameter to lock the framework policy. Specify true to lock the policy. Specify false to unlock the policy.
sections	Required	SectionDTO	Add the section details by fetching them from Configure Controls API output.
tagsIncludeAssetResolution={value}	Optional	String	Asset tags include resolution. By default, the value is set to 'Any'. Use this parameter along with tagsIncludeIds parameter.
tagsExcludeAssetResolution={value}	Optional	String	Asset tags exclude resolution. By default, the value is set to 'Any'. Use this parameter along with tagsExcludeIds parameter.
tagsIncludeIds={value}	Optional	Integer	Tag IDs to be included in the framework policy.
tagsExcludeIds={value}	Optional	Integer	Tag IDs to be excluded from the framework policy.
description={value}	Optional	String	A description about the framework policy.

Sample - Create new framework policySample - Create new framework policy

API Request

curl --location '<gateway_base_url>/pcas/v3/policy'
--header 'Content-Type: application/json'
--header 'Authorization: Bearer'
--data-raw '{"frameworkId":5364,"policyTitle":"Test Framework Policy Api 1","isActive":true,"isLocked":false,"technologyIds":[198,217,231,341,424,132,137,165],"coverPage":"CIS,DISA STIG,Qualys","sections":<add this data from configure control POST call output>,"assetGroupIds":[55294832], "tagsIncludeIds": [
  756253623
],
"tagsExcludeIds": [
  564563478
],
"tagsIncludeAssetResolution": "Any",
"tagsExcludeAssetResolution": "Any"
}’

JSON Response

[
  {
    "message": "Policy Created successfully",
    "policyId": 2069421,
    "imported": false,
    "active": true
  }
]

Middleware Asset API

We now support the Middleware Asset API that helps you list, activate, or deactivate middleware assets.

New or Updated API	New
API Endpoint	/api/2.0/fo/compliance/middleware/
Method	POST and GET
DTD or XSD changes	Yes

The list functionality supports filtering by IP address, such as, hostname, operating system, and middleware technology, providing capabilities similar to the Middleware Assets tab in the Policy Audit application.

Only users with the Manager role can activate, deactivate, and list middleware asset assessments.

Input Parameters to Active or Deactivate Middleware AssetsInput Parameters to Active or Deactivate Middleware Assets

Parameter Name	Required / Optional	Data Type	Description
action={value}	Required	String	Action to perform. Either activate or deactivate.
host_ids={value}	Required	Integer	Host IDs to activate or deactivate. Multiple entries can be added as comma seperate values. A maximum of 10000 host IDs can be added. Either host_ids or csv_data is required to activate or deactivate Middleware assets
csv_data	Required	String	CSV file containing host IDs to activate or deactivate (one per row or comma-separated). A maximum of 10000 host IDs can be added in the CSV file. Either host_ids or csv_data is required to activate or deactivate Middleware assets

Input Parameters to List all Middleware AssetsInput Parameters to List all Middleware Assets

Parameter Name	Required / Optional	Data Type	Description
action	Required	String	List action to be performed.
ips	Optional	Integer	Filter by IP addresses/ranges
hostname	Optional	String	Filter by hostname.
os	Optional	String	Filter by OS pattern (for example, hos.OS or amt.OS_NAME).
middleware_technology	Optional	String	Filter by middleware technology (for example, Apache, Tomcat).
status	Optional	String	Filter by activation status.
id_min	Optional	Integer	Minimum host ID for pagination.
id_max	Optional	Integer	Maximum host ID filter.
truncation_limit	Optional	Integer	Maximum records to be returned. Default value is set to 1000.

Sample - Activate Middleware AssetsSample - Activate Middleware Assets

API Request

curl -u "<username>:<password>" -H "X-Requested-With: curl" -k -v -d "action=activate&host_ids=7800999" <qualys_base_url>/api/2.0/fo/compliance/middleware/

API Response

<?xml version="1.0" encoding="UTF-8" ?>
<!DOCTYPE SIMPLE_RETURN SYSTEM "<qualys_base_url>/api/2.0/simple_return.dtd">
<SIMPLE_RETURN>
    <RESPONSE>
        <DATETIME>2026-07-16T09:56:21Z</DATETIME>
        <TEXT>Middleware assessment activate request processed for 1 host(s)</TEXT>
        <ITEM_LIST>
            <ITEM>
                <KEY>Successfully activated</KEY>
                <VALUE>1</VALUE>
            </ITEM>
            <ITEM>
                <KEY>Failed to activate</KEY>
                <VALUE>0</VALUE>
            </ITEM>
        </ITEM_LIST>
    </RESPONSE>
</SIMPLE_RETURN>

Sample - Deactivate Middleware AssetsSample - Deactivate Middleware Assets

API Request

curl -u "<username>:<password>" -H "X-Requested-With: curl" -v -d "action=deactivate&host_ids=7800999" <qualys_base_url>/api/2.0/fo/compliance/middleware/

API Response

<?xml version="1.0" encoding="UTF-8" ?>
<!DOCTYPE SIMPLE_RETURN SYSTEM "<qualys_base_url>/api/2.0/simple_return.dtd">
<SIMPLE_RETURN>
    <RESPONSE>
        <DATETIME>2026-07-16T09:55:24Z</DATETIME>
        <TEXT>Middleware assessment deactivate request processed for 1 host(s)</TEXT>
        <ITEM_LIST>
            <ITEM>
                <KEY>Successfully deactivated</KEY>
                <VALUE>1</VALUE>
            </ITEM>
            <ITEM>
                <KEY>Failed to deactivate</KEY>
                <VALUE>0</VALUE>
            </ITEM>
        </ITEM_LIST>
    </RESPONSE>
</SIMPLE_RETURN>

Sample - List all Middleware AssetsSample - List all Middleware Assets

API Request

curl -u "<username>:<password>" -H "X-Requested-With: curl" -v -d "action=list" <qualys_base_url>/api/2.0/fo/compliance/middleware/

API Response

<?xml version="1.0" encoding="UTF-8" ?>
<!DOCTYPE MIDDLEWARE_ASSET_LIST_OUTPUT SYSTEM "<qualys_base_url>/api/2.0/fo/compliance/middleware/dtd/list/output.dtd">
<MIDDLEWARE_ASSET_LIST_OUTPUT>
    <RESPONSE>
        <DATETIME>2026-07-16T09:57:17Z</DATETIME>
        <MIDDLEWARE_ASSET_LIST>
            <MIDDLEWARE_ASSET>
                <ID>2064785</ID>
                <HOST_ID>7800999</HOST_ID>
                <IP>10.113.198.62</IP>
                <QG_HOSTID>9782c802-75f9-4c26-a15e-9020d6c9af55</QG_HOSTID>
                <HOSTNAME>drsqrchsql05.bbtnet.com</HOSTNAME>
                <OS>Windows Server 2019 Standard 64 bit Edition Version 1809 Build 17763</OS>
                <MIDDLEWARE_TECHNOLOGY>CHROME</MIDDLEWARE_TECHNOLOGY>
                <INSTANCE_COUNT>1</INSTANCE_COUNT>
                <STATUS>Successful Activation</STATUS>
                <UPDATED_DATE>2026-02-02 05:08:28</UPDATED_DATE>
            </MIDDLEWARE_ASSET>
            <MIDDLEWARE_ASSET>
                <ID>1937465</ID>
                <HOST_ID>7800999</HOST_ID>
                <IP>10.113.198.62</IP>
                <QG_HOSTID>9782c802-75f9-4c26-a15e-9020d6c9af55</QG_HOSTID>
                <HOSTNAME>drsqrchsql05.bbtnet.com</HOSTNAME>
                <OS>Windows Server 2019 Standard 64 bit Edition Version 1809 Build 17763</OS>
                <MIDDLEWARE_TECHNOLOGY>IEXPLORER</MIDDLEWARE_TECHNOLOGY>
                <INSTANCE_COUNT>1</INSTANCE_COUNT>
                <STATUS>Successful Activation</STATUS>
                <UPDATED_DATE>2026-02-02 05:08:28</UPDATED_DATE>
            </MIDDLEWARE_ASSET>
            <MIDDLEWARE_ASSET>
                <ID>1937466</ID>
                <HOST_ID>7800999</HOST_ID>
                <IP>10.113.198.62</IP>
                <QG_HOSTID>9782c802-75f9-4c26-a15e-9020d6c9af55</QG_HOSTID>
                <HOSTNAME>drsqrchsql05.bbtnet.com</HOSTNAME>
                <OS>Windows Server 2019 Standard 64 bit Edition Version 1809 Build 17763</OS>
                <MIDDLEWARE_TECHNOLOGY>SQLServer</MIDDLEWARE_TECHNOLOGY>
                <INSTANCE_COUNT>2</INSTANCE_COUNT>
                <STATUS>Successful Activation</STATUS>
                <UPDATED_DATE>2026-02-02 05:08:28</UPDATED_DATE>
            </MIDDLEWARE_ASSET>
        </MIDDLEWARE_ASSET_LIST>
    </RESPONSE>
</MIDDLEWARE_ASSET_LIST_OUTPUT>

Sample - Activate Middleware Assets using CSV fileSample - Activate Middleware Assets using CSV file

API Request

curl -u "<username>:<password>" \
  -H "X-Requested-With: curl" \
  -H "Content-Type: text/csv" \
  -v \
  --data-binary @/home/drive/host_id.csv \
  "<qualys_base_url>/api/2.0/fo/compliance/middleware/?action=activate"

API Response

<?xml version="1.0" encoding="UTF-8" ?>
<!DOCTYPE SIMPLE_RETURN SYSTEM "<qualys_base_url>/api/2.0/simple_return.dtd">
<SIMPLE_RETURN>
  <RESPONSE>
    <DATETIME>2026-07-17T10:32:10Z</DATETIME>
    <TEXT>Middleware assessment activate request processed for 1 host(s)</TEXT>
    <ITEM_LIST>
      <ITEM>
        <KEY>Successfully activated</KEY>
        <VALUE>1</VALUE>
      </ITEM>
      <ITEM>
        <KEY>Failed to activate</KEY>
        <VALUE>0</VALUE>
      </ITEM>
    </ITEM_LIST>
  </RESPONSE>
</SIMPLE_RETURN>

Sample - Deactivate Middleware Assets using CSV fileSample - Deactivate Middleware Assets using CSV file

API Request

curl -u "<username>:<password>" \
  -H "X-Requested-With: curl" \
  -H "Content-Type: text/csv" \
  -v \
  --data-binary @/home/drive/host_id.csv \
  "<qualys_base_url>/api/2.0/fo/compliance/middleware/?action=deactivate"

API Response

<?xml version="1.0" encoding="UTF-8" ?>
<!DOCTYPE SIMPLE_RETURN SYSTEM "<qualys_base_url>/api/2.0/simple_return.dtd">
<SIMPLE_RETURN>
  <RESPONSE>
    <DATETIME>2026-07-17T10:31:33Z</DATETIME>
    <TEXT>Middleware assessment deactivate request processed for 1 host(s)</TEXT>
    <ITEM_LIST>
      <ITEM>
        <KEY>Successfully deactivated</KEY>
        <VALUE>1</VALUE>
      </ITEM>
      <ITEM>
        <KEY>Failed to deactivate</KEY>
        <VALUE>0</VALUE>
      </ITEM>
    </ITEM_LIST>
  </RESPONSE>
</SIMPLE_RETURN>

Sample - Activate Middleware Assets with no instance dataSample - Activate Middleware Assets with no instance data

API Request

curl -u "<username>:<password>" -H "X-Requested-With: curl" -v -d "action=activate&host_ids=8262564,9774170,12329657" "<qualys_base_url>/api/2.0/fo/compliance/middleware/"

API Response

<?xml version="1.0" encoding="UTF-8" ?>
<!DOCTYPE SIMPLE_RETURN SYSTEM "<qualys_base_url>/api/2.0/simple_return.dtd">
<SIMPLE_RETURN>
  <RESPONSE>
    <DATETIME>2026-07-20T06:31:13Z</DATETIME>
    <TEXT>Middleware assessment activate request processed for 3 host(s)</TEXT>
    <ITEM_LIST>
      <ITEM>
        <KEY>Successfully activated</KEY>
        <VALUE>0</VALUE>
      </ITEM>
      <ITEM>
        <KEY>Failed to activate</KEY>
        <VALUE>0</VALUE>
      </ITEM>
      <ITEM>
        <KEY>Invalid host IDs (not PC/SCA agents, not in subscription, invalid tracking method, or no middleware instance data)</KEY>
        <VALUE>8262564, 9774170, 12329657</VALUE>
      </ITEM>
    </ITEM_LIST>
  </RESPONSE>
</SIMPLE_RETURN>

Sample - Deactivate Middleware Assets with no instance dataSample - Deactivate Middleware Assets with no instance data

API Request

curl -u "<username>:<password>" -H "X-Requested-With: curl" -v -d "action=deactivate&host_ids=8262564,9774170,12329657" "<qualys_base_url>/api/2.0/fo/compliance/middleware/"

API Response

<?xml version="1.0" encoding="UTF-8" ?>
<!DOCTYPE SIMPLE_RETURN SYSTEM "<qualys_base_url>/api/2.0/simple_return.dtd">
<SIMPLE_RETURN>
  <RESPONSE>
    <DATETIME>2026-07-20T06:33:23Z</DATETIME>
    <TEXT>Middleware assessment deactivate request processed for 3 host(s)</TEXT>
    <ITEM_LIST>
      <ITEM>
        <KEY>Successfully deactivated</KEY>
        <VALUE>0</VALUE>
      </ITEM>
      <ITEM>
        <KEY>Failed to deactivate</KEY>
        <VALUE>0</VALUE>
      </ITEM>
      <ITEM>
        <KEY>Invalid host IDs (not PC/SCA agents, not in subscription, invalid tracking method, or no middleware instance data)</KEY>
        <VALUE>8262564, 9774170, 12329657</VALUE>
      </ITEM>
    </ITEM_LIST>
  </RESPONSE>
</SIMPLE_RETURN>

Sample - Activate Host IDs that are not in subscription or with invalid Host IDSample - Activate Host IDs that are not in subscription or with invalid Host ID

API Request

curl -u "<username>:<password>" -H "X-Requested-With: curl" -k -v -d "action=activate&host_ids=3456782,5678932" "<qualys_base_url>/api/2.0/fo/compliance/middleware/"

API Response

<?xml version="1.0" encoding="UTF-8" ?>
<!DOCTYPE SIMPLE_RETURN SYSTEM "<qualys_base_url>/api/2.0/simple_return.dtd">
<SIMPLE_RETURN>
  <RESPONSE>
    <DATETIME>2026-07-20T10:41:59Z</DATETIME>
    <TEXT>Middleware assessment activate request processed for 2 host(s)</TEXT>
    <ITEM_LIST>
      <ITEM>
        <KEY>Successfully activated</KEY>
        <VALUE>0</VALUE>
      </ITEM>
      <ITEM>
        <KEY>Failed to activate</KEY>
        <VALUE>0</VALUE>
      </ITEM>
      <ITEM>
        <KEY>Invalid host IDs (not PC/SCA agents, not in subscription, invalid tracking method, or no middleware instance data)</KEY>
        <VALUE>3456782, 5678932</VALUE>
      </ITEM>
    </ITEM_LIST>
  </RESPONSE>
</SIMPLE_RETURN>

Sample - Deactivate Host IDs that are not in subscription or with invalid Host IDSample - Deactivate Host IDs that are not in subscription or with invalid Host ID

API Request

curl -u "<username>:<password>" -H "X-Requested-With: curl" -v -d "action=deactivate&host_ids=4563728,3782132" "<qualys_base_url>/api/2.0/fo/compliance/middleware/"

API Response

<?xml version="1.0" encoding="UTF-8" ?>
<!DOCTYPE SIMPLE_RETURN SYSTEM "<qualys_base_url>/api/2.0/simple_return.dtd">
<SIMPLE_RETURN>
  <RESPONSE>
    <DATETIME>2026-07-20T06:34:51Z</DATETIME>
    <TEXT>Middleware assessment deactivate request processed for 2 host(s)</TEXT>
    <ITEM_LIST>
      <ITEM>
        <KEY>Successfully deactivated</KEY>
        <VALUE>0</VALUE>
      </ITEM>
      <ITEM>
        <KEY>Failed to deactivate</KEY>
        <VALUE>0</VALUE>
      </ITEM>
      <ITEM>
        <KEY>Invalid host IDs (not PC/SCA agents, not in subscription, invalid tracking method, or no middleware instance data)</KEY>
        <VALUE>3782132, 4563728</VALUE>
      </ITEM>
    </ITEM_LIST>
  </RESPONSE>
</SIMPLE_RETURN>

List Reports API: View Response Progress Updates

New or Updated API	Updated
API Endpoint	/api/2.0/fo/report/?action=list /api/3.0/fo/report/?action=list
Method	GET
DTD or XSD changes	Yes

The List Reports API now provides progress updates in the response, showing the number of reports processed out of the total reports being retrieved.

For reports, if the API response takes longer to generate, a progress message is displayed every 15 seconds indicating the current processing status (for example, 9/581, 25/581, and so on) until all are retrieved.

Previously, the API did not provide any visibility into processing progress while generating the response.

Sample - View Response Progress Updates V2.0Sample - View Response Progress Updates V2.0

API Request

curl -H "X-Requested-With: Curl Sample"
-b "QualysSession=71e6cda2a35d2cd404cddaf305ea0208; path=/api; 
secure" "/api/2.0/fo/report/?action=list"

API Response

<?xml version="1.0" encoding="UTF-8" ?>
<!DOCTYPE REPORT_LIST_OUTPUT SYSTEM "<qualys_base_url>/api/2.0/fo/report/report_list_output.dtd">
<!-- Processing reports: 274/10598 processed -->
<!-- Processing reports: 564/10598 processed -->
<!-- Processing reports: 854/10598 processed -->
<!-- Processing reports: 1145/10598 processed -->
<!-- Processing reports: 1433/10598 processed -->
<!-- Processing reports: 1719/10598 processed -->
<!-- Processing reports: 2005/10598 processed -->
<!-- Processing reports: 2295/10598 processed -->
<!-- Processing reports: 2589/10598 processed -->
<!-- Processing reports: 2877/10598 processed -->
<!-- Processing reports: 3164/10598 processed -->
<!-- Processing reports: 3455/10598 processed -->
<!-- Processing reports: 3745/10598 processed -->
<!-- Processing reports: 4029/10598 processed -->
<!-- Processing reports: 4312/10598 processed -->
<!-- Processing reports: 4594/10598 processed -->
<!-- Processing reports: 4874/10598 processed -->
<!-- Processing reports: 5162/10598 processed -->
<!-- Processing reports: 5449/10598 processed -->
<!-- Processing reports: 5736/10598 processed -->
<!-- Processing reports: 6027/10598 processed -->
<!-- Processing reports: 6314/10598 processed -->
<!-- Processing reports: 6606/10598 processed -->
<!-- Processing reports: 6893/10598 processed -->
<!-- Processing reports: 7179/10598 processed -->
<!-- Processing reports: 7468/10598 processed -->
<!-- Processing reports: 7757/10598 processed -->
<!-- Processing reports: 8048/10598 processed -->
<!-- Processing reports: 8340/10598 processed -->
<!-- Processing reports: 8629/10598 processed -->
<!-- Processing reports: 8912/10598 processed -->
<!-- Processing reports: 9201/10598 processed -->
<!-- Processing reports: 9494/10598 processed -->
<!-- Processing reports: 9786/10598 processed -->
<!-- Processing reports: 10079/10598 processed -->
<!-- Processing reports: 10369/10598 processed -->
<!-- Processing reports: 10598/10598 processed -->
<REPORT_LIST_OUTPUT>
    <RESPONSE>
        <DATETIME>2026-07-21T08:45:44Z</DATETIME>
        <REPORT_LIST>
            <REPORT>
                <ID>4302141</ID>
                <TITLE>
                    <![CDATA[SCHEDULED POLICY REPORT  NOTIFICATION TEST]]>
                </TITLE>
                <TYPE>Compliance</TYPE>
                <USER_LOGIN>rstec_rs</USER_LOGIN>
                <LAUNCH_DATETIME>2026-07-20T19:32:10Z</LAUNCH_DATETIME>
                <OUTPUT_FORMAT>HTML</OUTPUT_FORMAT>
                <SIZE>-</SIZE>
                <STATUS>
                    <STATE>Errors</STATE>
                    <MESSAGE>
                        <![CDATA[Rendering glossary...]]>
                    </MESSAGE>
                    <PERCENT>77</PERCENT>
                </STATUS>
                <EXPIRATION_DATETIME>2026-08-17T19:32:18Z</EXPIRATION_DATETIME>
            </REPORT>
      .
      .
      .
      .
      .
      .
      
            <REPORT>
                <ID>4238259</ID>
                <TITLE>
                    <![CDATA[Policy Report - Policy SDC]]>
                </TITLE>
                <TYPE>Compliance</TYPE>
                <USER_LOGIN>rstec_rs</USER_LOGIN>
                <LAUNCH_DATETIME>2026-06-23T09:50:15Z</LAUNCH_DATETIME>
                <OUTPUT_FORMAT>CSV</OUTPUT_FORMAT>
                <SIZE>2.27 KB</SIZE>
                <STATUS>
                    <STATE>Finished</STATE>
                </STATUS>
                <EXPIRATION_DATETIME>2026-07-21T09:51:00Z</EXPIRATION_DATETIME>
            </REPORT>
        </REPORT_LIST>
    </RESPONSE>
</REPORT_LIST_OUTPUT>

Sample - View Response Progress Updates V3.0Sample - View Response Progress Updates V3.0

API Request

curl --location --request POST
'<qualys_base_url>/api/3.0/fo/report/?echo_request=1&action=list' \ 
--header 'X-Requested-With: curl' \ 
--header 'Authorization: Basic Encoded username:passwordstring'

API Response

<?xml version="1.0" encoding="UTF-8" ?>
<!DOCTYPE REPORT_LIST_OUTPUT SYSTEM "<qualys_base_url>/api/3.0/fo/report/report_list_output.dtd">
<!-- Processing reports: 274/10598 processed -->
<!-- Processing reports: 564/10598 processed -->
<!-- Processing reports: 854/10598 processed -->
<!-- Processing reports: 1145/10598 processed -->
<!-- Processing reports: 1433/10598 processed -->
<!-- Processing reports: 1719/10598 processed -->
<!-- Processing reports: 2005/10598 processed -->
<!-- Processing reports: 2295/10598 processed -->
<!-- Processing reports: 2589/10598 processed -->
<!-- Processing reports: 2877/10598 processed -->
<!-- Processing reports: 3164/10598 processed -->
<!-- Processing reports: 3455/10598 processed -->
<!-- Processing reports: 3745/10598 processed -->
<!-- Processing reports: 4029/10598 processed -->
<!-- Processing reports: 4312/10598 processed -->
<!-- Processing reports: 4594/10598 processed -->
<!-- Processing reports: 4874/10598 processed -->
<!-- Processing reports: 5162/10598 processed -->
<!-- Processing reports: 5449/10598 processed -->
<!-- Processing reports: 5736/10598 processed -->
<!-- Processing reports: 6027/10598 processed -->
<!-- Processing reports: 6314/10598 processed -->
<!-- Processing reports: 6606/10598 processed -->
<!-- Processing reports: 6893/10598 processed -->
<!-- Processing reports: 7179/10598 processed -->
<!-- Processing reports: 7468/10598 processed -->
<!-- Processing reports: 7757/10598 processed -->
<!-- Processing reports: 8048/10598 processed -->
<!-- Processing reports: 8340/10598 processed -->
<!-- Processing reports: 8629/10598 processed -->
<!-- Processing reports: 8912/10598 processed -->
<!-- Processing reports: 9201/10598 processed -->
<!-- Processing reports: 9494/10598 processed -->
<!-- Processing reports: 9786/10598 processed -->
<!-- Processing reports: 10079/10598 processed -->
<!-- Processing reports: 10369/10598 processed -->
<!-- Processing reports: 10598/10598 processed -->
<REPORT_LIST_OUTPUT>
    <RESPONSE>
        <DATETIME>2026-07-21T08:45:44Z</DATETIME>
        <REPORT_LIST>
            <REPORT>
                <ID>4302141</ID>
                <TITLE>
                    <![CDATA[SCHEDULED POLICY REPORT  NOTIFICATION TEST]]>
                </TITLE>
                <TYPE>Compliance</TYPE>
                <USER_LOGIN>rstec_rs</USER_LOGIN>
                <LAUNCH_DATETIME>2026-07-20T19:32:10Z</LAUNCH_DATETIME>
                <OUTPUT_FORMAT>HTML</OUTPUT_FORMAT>
                <SIZE>-</SIZE>
                <STATUS>
                    <STATE>Errors</STATE>
                    <MESSAGE>
                        <![CDATA[Rendering glossary...]]>
                    </MESSAGE>
                    <PERCENT>77</PERCENT>
                </STATUS>
                <EXPIRATION_DATETIME>2026-08-17T19:32:18Z</EXPIRATION_DATETIME>
            </REPORT>
      .
      .
      .
      .
      .
      .
      
            <REPORT>
                <ID>4238259</ID>
                <TITLE>
                    <![CDATA[Policy Report - Policy SDC]]>
                </TITLE>
                <TYPE>Compliance</TYPE>
                <USER_LOGIN>rstec_rs</USER_LOGIN>
                <LAUNCH_DATETIME>2026-06-23T09:50:15Z</LAUNCH_DATETIME>
                <OUTPUT_FORMAT>CSV</OUTPUT_FORMAT>
                <SIZE>2.27 KB</SIZE>
                <STATUS>
                    <STATE>Finished</STATE>
                </STATUS>
                <EXPIRATION_DATETIME>2026-07-21T09:51:00Z</EXPIRATION_DATETIME>
            </REPORT>
        </REPORT_LIST>
    </RESPONSE>
</REPORT_LIST_OUTPUT>

Report Template APIs

With this release, we have introduced the report template APIs that enable you to list, retrieve, and create compliance report templates.

Using this API, you can list, retrieve, and create policy, mandate, STIG, and scorecard report templates.

List Report Templates

New or Updated API	New
API Endpoint	/pcrs/1.0/report/template/list
Method	GET

Lists all compliance report templates visible to the subscription.

Input ParametersInput Parameters

Parameter Name	Required / Optional	Data Type	Description
type	Optional	String	Filter by template types - policy, mandate, stig, and cm_score.

Sample - Filter by report typeSample - Filter by report type

API Request

curl -X GET "<gateway_base_url>/pcrs/1.0/report/template/list?type=mandate&type=policy" \
  -H "Authorization: Bearer <JWT Token>" \
  -H "Accept: application/json"

JSON Response

{
  "templates": [
    {
      "templateId": 1001,
      "title": "My Mandate Template",
      "type": "mandate",
      "isGlobal": false,
      "owner": "jsmith",
      "createdAt": "2025-03-15T10:30:00"
    },
    {
      "templateId": 1002,
      "title": "Global Policy Template",
      "type": "policy",
      "isGlobal": true,
      "owner": "admin",
      "createdAt": "2025-01-10T08:00:00"
    }
  ],
  "count": 2
}

Retrieve Report Template using ID

New or Updated API	New
API Endpoint	/pcrs/1.0/report/template/{id}
Method	GET

Retrieves details of a single report template, including all settings.

Input ParametersInput Parameters

Parameter Name	Required / Optional	Data Type	Description
id	Required	Integer	Enter the template ID for which details are to be retrieved.

Sample - Get Report Template by IDSample - Get Report Template by ID

API Request

curl -X GET "<gateway_base_url>/pcrs/1.0/report/template/4658187" \
  -H "Authorization: Bearer <JWT Token>" \
  -H "Accept: application/json"

JSON Response

{
    "templateId": 4658187,
    "title": "My Mandate Template",
    "type": "mandate",
    "isGlobal": true,
    "owner": "quays_zd38",
    "createdAt": "2026-07-24T09:27:42Z",
    "settings": {
        "group.by": "1",
        "filter.policy.controls": "true",
        "report.settings": "true",
        "report.summary": "true",
        "graph.mandate": "true",
        "graph.requirement": "true",
        "graph.policy": "true",
        "details": "true",
        "control.posture": "true",
        "glossary": "true",
        "include_posture_status": "0,1,2",
        "include_control_criticality": "0,1,2,3,4,5"
    }
}

Create Report Template

Create a new compliance report template for the authenticated subscription. All roles (Reader, Scanner, Manager, Auditor, Unit Manager) are permitted to create templates.

New or Updated API	New
API Endpoint	/pcrs/1.0/report/template
Method	GET

Input ParametersInput Parameters

Parameter Name	Required / Optional	Data Type	Description
title	Required	String	Template name
type	Required	String	Template type. See Template Types above
isGlobal={true\|false}	Optional	Boolean	If set to true, the template is visible to all users, else set as false. By default, the value is set to false.
settings	Optional	String	Key-value settings for the template. Defaults are applied per type if omitted.

Sample - Create mandate report templateSample - Create mandate report template

API Request

curl --location ''
<gateway_base_url>/pcrs/1.0/report/template' \
--header 'Content-Type: application/json' \
--header 'Authorization: Bearer <JWT_Token>' \
--data '{
  "title": "My Mandate Template",
  "type": "mandate",
  "isGlobal": true,
  "settings": {
        "filter.policy.controls": "true",
        "report.settings": "true",
        "report.summary": "true",
        "graph.mandate": "true",
        "graph.requirement": "true",
        "graph.policy": "true",
        "details": "true",
        "control.posture": "true",
        "glossary": "true",
        "include_posture_status": "0,1,2",
        "include_control_criticality": "0,1,2,3,4,5",
        "group.by": "1"
  }
}'

JSON Response

{
    "templateId": 4651201,
    "title": "My Mandate Template",
    "type": "mandate",
    "isGlobal": true,
    "owner": "quays_zd38",
    "createdAt": "2026-07-23T07:22:11Z",
    "settings": {
        "group.by": "1",
        "filter.policy.controls": "true",
        "report.settings": "true",
        "report.summary": "true",
        "graph.mandate": "true",
        "graph.requirement": "true",
        "graph.policy": "true",
        "details": "true",
        "control.posture": "true",
        "glossary": "true",
        "include_posture_status": "0,1,2",
        "include_control_criticality": "0,1,2,3,4,5"
    }
}

Sample - Create policy report templateSample - Create policy report template

API Request

curl --location ''
<gateway_base_url>/pcrs/1.0/report/template' \
--header 'Content-Type: application/json' \
--header 'Authorization: Bearer <JWT_Token>' \
--data '{
  "title": "My Policy Template",
  "type": "policy",
  "settings": {
        "report_group_by": "group_by_hosts",
        "report_sort_by": "sort_by_ip",
        "include_posture_status": "7",
        "include_report_summary": "true",
        "include_host_stats": "true",
        "include_report_details": "true",
        "include_control_rationale": "true",
        "include_control_evidence": "true",
        "include_control_ext_evidence": "true",
        "include_control_exceptions": "true",
        "include_exceptions_history": "true",
        "include_host_summary": "true",
        "include_appendix": "true",
        "include_control_scan_parameter": "true",
        "trend_duration": "30",
        "include_asset_tag": "true",
        "include_section_details": "false",
        "include_category_details": "false",
        "include_pa_report_trurisk": "false",
        "include_scan_source_details": "false",
        "include_control_previous_posture": "true",
        "include_failed_control_remediation": "true",
        "include_errored_control_remediation": "true",
        "include_control_not_expected_values": "true",
        "include_control_required_values": "true"
  }
}'

JSON Response

  {
    "templateId": 4651203,
    "title": "My Policy Template",
    "type": "policy",
    "isGlobal": false,
    "owner": "quays_zd38",
    "createdAt": "2026-07-23T07:27:21Z",
    "settings": {
        "report_group_by": "group_by_hosts",
        "report_sort_by": "sort_by_ip",
        "include_posture_status": "7",
        "include_report_summary": "true",
        "include_host_stats": "true",
        "include_report_details": "true",
        "include_control_rationale": "true",
        "include_control_evidence": "true",
        "include_control_ext_evidence": "true",
        "include_control_exceptions": "true",
        "include_exceptions_history": "true",
        "include_host_summary": "true",
        "include_appendix": "true",
        "include_control_scan_parameter": "true",
        "trend_duration": "30",
        "include_asset_tag": "true",
        "include_section_details": "false",
        "include_category_details": "false",
        "include_pa_report_trurisk": "false",
        "include_scan_source_details": "false",
        "include_control_previous_posture": "true",
        "include_failed_control_remediation": "true",
        "include_errored_control_remediation": "true",
        "include_control_not_expected_values": "true",
        "include_control_required_values": "true"
    }
}

Sample - Create STIG report templateSample - Create STIG report template

API Request

curl --location ''
<gateway_base_url>/pcrs/1.0/report/template' \
--header 'Content-Type: application/json' \
--header 'Authorization: Bearer <JWT_Token>' \
--data '{
  "title": "My STIG Template",
  "type": "stig",
  "isGlobal": true,
  "settings": {
        "include_severity": "1,2,3",
        "rule_statistics": "true",
        "compliant_rule_stats_by_severity": "true",
        "report_details": "true",
        "host_statistics": "true",
        "net_bios": "true",
        "tracking_method": "true",
        "dns": "true",
        "operating_system": "true",
        "network": "true",
        "instance": "true",
        "for_passed_control": "true",
        "for_error_control": "true",
        "control_rationale": "true",
        "group.by": "1",
        "include_posture": "0,1,1000",
        "evidence": "true",
        "extended_evidence": "true",
        "for_failed_control": "true",
        "rule_description": "true",
        "rule_posture": "true",
        "cci": "true",
        "vuln_description": "true",
        "vuln_posture": "true",
        "glossary": "true",
        "appendix": "true"
  }
}'

JSON Response

 {
    "templateId": 4651205,
    "title": "My STIG Template",
    "type": "stig",
    "isGlobal": true,
    "owner": "quays_zd38",
    "createdAt": "2026-07-23T07:35:34Z",
    "settings": {
        "group.by": "1",
        "include_posture": "0,1,1000",
        "include_severity": "1,2,3",
        "rule_statistics": "true",
        "compliant_rule_stats_by_severity": "true",
        "report_details": "true",
        "host_statistics": "true",
        "net_bios": "true",
        "tracking_method": "true",
        "dns": "true",
        "operating_system": "true",
        "network": "true",
        "instance": "true",
        "for_passed_control": "true",
        "for_error_control": "true",
        "control_rationale": "true",
        "evidence": "true",
        "extended_evidence": "true",
        "for_failed_control": "true",
        "rule_description": "true",
        "rule_posture": "true",
        "cci": "true",
        "vuln_description": "true",
        "vuln_posture": "true",
        "glossary": "true",
        "appendix": "true"
    }
}

Sample - Create scorecard report templateSample - Create scorecard report template

API Request

curl -X POST "<gateway_base_url>/pcrs/1.0/report/template" \
  -H "Authorization: Bearer <JWT_Token>" \
  curl --location ''
<gateway_base_url>/pcrs/1.0/report/template' \
--header 'Content-Type: application/json' \
--header 'Authorization: <Bearer_Token>' \
--data '{
  "title": "My Scorecard Template",
  "type": "cm_score",
  "isGlobal": true,
  "settings": {
        "include_summary": "true",
        "include_overall_by_policy": "true",
        "include_change_by_policy": "true",
        "include_change_by_policy_asset": "true",
        "include_change_by_policy_tech": "true",
        "include_overall_by_asset": "true",
        "include_change_by_asset": "true",
        "include_change_by_asset_policy": "true",
        "include_change_by_asset_tech": "true",
        "include_overall_by_tech": "true",
        "include_change_by_tech": "true",
        "include_top_host_change": "true",
        "include_top_control_change": "true",
        "include_criticality": "true",
        "include_fail_by_criticality": "true",
        "include_overall_by_criticality": "true",
        "include_change_by_criticality": "true",
        "include_change_by_criticality_policy": "true",
        "include_change_by_criticality_asset": "true",
        "include_change_by_criticality_tech": "true",
        "include_failed_controls_by_criticality": "true",
        "compliance_scorecard_report_timeframe": "30",
        "compliance_scorecard_report_display": "10",
        "compliance_scorecard_report_failed_controls_display": "5"
  }
}'

JSON Response

  {
    "templateId": 4651207,
    "title": "My Scorecard Template",
    "type": "cm_score",
    "isGlobal": true,
    "owner": "quays_zd38",
    "createdAt": "2026-07-23T07:37:24Z",
    "settings": {
        "include_summary": "true",
        "include_overall_by_policy": "true",
        "include_change_by_policy": "true",
        "include_change_by_policy_asset": "true",
        "include_change_by_policy_tech": "true",
        "include_overall_by_asset": "true",
        "include_change_by_asset": "true",
        "include_change_by_asset_policy": "true",
        "include_change_by_asset_tech": "true",
        "include_overall_by_tech": "true",
        "include_change_by_tech": "true",
        "include_top_host_change": "true",
        "include_top_control_change": "true",
        "include_criticality": "true",
        "include_fail_by_criticality": "true",
        "include_overall_by_criticality": "true",
        "include_change_by_criticality": "true",
        "include_change_by_criticality_policy": "true",
        "include_change_by_criticality_asset": "true",
        "include_change_by_criticality_tech": "true",
        "include_failed_controls_by_criticality": "true",
        "compliance_scorecard_report_timeframe": "30",
        "compliance_scorecard_report_display": "10",
        "compliance_scorecard_report_failed_controls_display": "5"
    }
}

Group Policies by Variants

Grouping of report templates varies by report template type.

Input Parameters - Policy Template SettingsInput Parameters - Policy Template Settings

Key	Required / Optional	Data Type	Description
report_group_by={value}	Optional	String	Default: group_by_hosts. see Group By Variants for details.
include_posture_status={value}	Optional	Integer	Default: 3. 1=Passed, 2=Failed, 3=Passed+Failed, 4=Error, 5=Passed+Error, 6=Failed+Error, 7=All
include_report_summary={true\|false}	Optional	Boolean	Default: true. Report summary section
include_host_stats={true\|false}	Optional	Boolean	Default: true. Host statistics section
include_control_stats={true\|false}	Optional	Boolean	Control statistics section
include_report_details={true\|false}	Optional	Boolean	Default: true. Detailed report rows
include_control_rationale={true\|false}	Optional	Boolean	Default: true. Control rationale
include_control_evidence	Optional	Boolean	Default: true. Control evidence detail
include_control_ext_evidence={true\|false}	Optional	Boolean	Default: true. Extended control evidence - requires include_control_evidence: true
include_control_comments={true\|false}	Optional	Boolean	Default: true. Control comments
include_control_exceptions={true\|false}	Optional	Boolean	Default: true. Control exceptions
include_exceptions_history={true\|false}	Optional	Boolean	Default: true. Exception history - requires include_control_exceptions: true
include_host_summary={true\|false}	Optional	Boolean	Default: true. Host summary section
include_glossary={true\|false}	Optional	Boolean	Default: true. Glossary section
include_appendix={true\|false}	Optional	Boolean	Default: true. Appendix section
include_control_scan_parameter={true\|false}	Optional	Boolean	Default: true. Scan parameters - requires include_control_evidence: true
include_control_references={true\|false}	Optional	Boolean	Control references column
include_posture_modified_date={true\|false}	Optional	Boolean	Posture modified date column
include_control_previous_posture={true\|false}	Optional	Boolean	Previous posture state column
include_control_first_fail_date={true\|false}	Optional	Boolean	First failure date column
include_control_last_fail_date={true\|false}	Optional	Boolean	Last failure date column
include_control_first_pass_date={true\|false}	Optional	Boolean	First pass date column
include_control_last_pass_date={true\|false}	Optional	Boolean	Last pass date column
do_not_include_control_criticality={true\|false}	Optional	Boolean	Suppress criticality column
include_qds={true\|false}	Optional	Boolean	QDS score column
include_scan_source_details={true\|false}	Optional	Boolean	Scan Source Details section - pref-gated (enable.scan_source_details)
include_asset_trurisk={true\|false}	Optional	Boolean	TruRisk score column
custom.footer.text={value}	Optional	String	Custom footer text
custom.footer.enabled={true\|false}	Optional	Boolean	Enable custom footer
evaluate_date_before={value}	Optional	String	Evaluation date filter - before. Pref-gated (pc.report.host_evalution_datetimeframe)
evaluate_date_after={value}	Optional	String	Evaluation date filter - after. Pref-gated
evaluate_date_unit={value}	Optional	String	Relative unit: d_last, w_last, m_last, w, m, q, y. Pref-gated
evaluate_date_since={value}	Optional	Integer	Relative "since N units". Pref-gated
evaluate_date_between={value}	Optional	String	Date range filter. Pref-gated
last_updated_date_before={value}	Optional	String	Last-updated date filter - before (validated as epoch)
last_updated_date_after={value}	Optional	String	Last-updated date filter - after (validated as epoch)
last_updated_date_unit={value}	Optional	String	Relative unit
last_updated_date_since={value}	Optional	Integer	Relative "since N units" (validated as positive integer)
last_updated_date_between={value}	Optional	String	Date range filter
include_control_required_values={true\|false}	Optional	Boolean	"Required values" cause-of-failure column
include_control_not_expected_values={true\|false}	Optional	Boolean	"Not expected values" cause-of-failure column
exclude_actual_values={true\|false}	Optional	Boolean	Exclude actual values from evidence
exclude_expected_values={true\|false}	Optional	Boolean	Exclude expected values from evidence
include_section_details={true\|false}	Optional	Boolean	Section ID/Name columns (CSV reports)
include_category_details={true\|false}	Optional	Boolean	Category/Sub-category columns (CSV reports)
exclude.account_id={true\|false}	Optional	Boolean	Exclude account ID from report
include_cloud_metadata={true\|false}	Optional	Boolean	Include cloud metadata columns
include_asset_tag={true\|false}	Optional	Boolean	Include asset tag column
include_control_remediation={true\|false}	Optional	Boolean	Control remediation text
include_criticality={value}	Optional	String	Criticality filter/section
include.report.users={value}	Optional	String	Comma-separated user IDs/usernames granted report access
include_control_chaining_scoring={true\|false}	Optional	Boolean	Control-chaining scoring section
include_host_id={true\|false}	Optional	Boolean	Host ID column
include_control_chaining_assessment_status={true\|false}	Optional	Boolean	Control-chaining assessment status
include_control_chaining_profile={true\|false}	Optional	Boolean	Control-chaining profile
include_control_chaining_cis_audit_procedure={true\|false}	Optional	Boolean	CIS audit procedure text
include_control_chaining_cis_remediation={true\|false}	Optional	Boolean	CIS remediation text
include_control_chaining_ig_mapping={true\|false}	Optional	Boolean	CIS Implementation Group mapping
include_control_chaining_criticality={true\|false}	Optional	Boolean	Control-chaining criticality
include_control_chaining_remediation={true\|false}	Optional	Boolean	Control-chaining remediation
include_control_summary={true\|false}	Optional	Boolean	Control summary section
include_control_mappings={true\|false}	Optional	Boolean	Control mappings section
include_control_tech_summary={true\|false}	Optional	Boolean	Control technology summary
host_statistics={true\|false}	Optional	Boolean	Host statistics (legacy QWEB naming)
selection.range.only_timeframe={true\|false}	Optional	Boolean	Restrict selection range to timeframe only
use_framework_filtering={true\|false}	Optional	Boolean	Enable framework-based filtering (legacy key)
trend_duration={true\|false}	Optional	Integer	Trend duration in days
scan_date_before={value}	Optional	String	Scan date filter - before
scan_date_after={value}	Optional	String	Scan date filter - after
scan_date_since={value}	Optional	Integer	Relative "since N units"
scan_date_unit={value}	Optional	String	Relative unit
scan_date_range_min={value}	Optional	String	Scan date range - min
scan_date_range_max={value}	Optional	String	Scan date range - max
trend_start_date={value}	Optional	String	Trend start date
include_control_criticality={tvalue}	Optional	String	Control criticality filter
include_pa_report_qds={true\|false}	Optional	Boolean	Policy Audit QDS section -pref-gated (enable.policy_audit + sub.enable.policy_report_score)
include_pa_report_trurisk={true\|false}	Optional	Boolean	Policy Audit TruRisk section - pref-gated (same as above)
include_framework_id={value}	Optional	String	Framework ID selection

Input Parameters - STIG Template SettingsInput Parameters - STIG Template Settings

Key	Required / Optional	Data Type	Description
group.by={value}	Optional	String	Default: 1. See Group By Variants for details
include_posture={value}	Optional	String	Default: 1. Comma-separated posture IDs: 0=Non-compliant, 1=Compliant, 1000=Not Scored
include_severity={true\|false}	Optional	String	Default: 1,2,3. Severity values: 1: CAT I (High) , 2: CAT II (Medium) , 3: CAT III (Low)
include_host_stats={true\|false}	Optional	Boolean	Default: true. Host statistics section
include_rule_stats={true\|false}	Optional	Boolean	Default: true. Rule statistics section
include_report_details={true\|false}	Optional	Boolean	Default: true. Detailed report rows
include_glossary={true\|false}	Optional	Boolean	Default: true. Glossary section
include_appendix={true\|false}	Optional	Boolean	Default: true. Appendix section
network={true\|false}	Optional	Boolean	Default: true
evidence={true\|false}	Optional	Boolean	Default: true. Evidence
extended_evidence={true\|false}	Optional	Boolean	Default: true. Extended evidence
include_control_last_fail_date={true\|false}	Optional	Boolean	Last failure date
report_details={true\|false}	Optional	Boolean	Report details section
host_statistics={true\|false}	Optional	Boolean	Host statistics section
rule_statistics={true\|false}	Optional	Boolean	Rule statistics section
vuln_statistics={true\|false}	Optional	Boolean	Vuln statistics section
compliant_rule_stats_by_severity={true\|false}	Optional	Boolean	Compliant rule stats by severity
net_bios={true\|false}	Optional	Boolean	NetBIOS column
tracking_method={true\|false}	Optional	Boolean	Tracking method column
dns={true\|false}	Optional	Boolean	DNS column
operating_system={true\|false}	Optional	Boolean	Operating system column
instance={true\|false}	Optional	Boolean	Instance column
for_failed_control={true\|false}	Optional	Boolean	Include failed-control rows
for_passed_control={true\|false}	Optional	Boolean	Include passed-control rows
for_error_control	Optional	Boolean	Include error-control rows
posture={true\|false}	Optional	Boolean	Posture toggle (distinct from include_posture CSV)
rule_description={true\|false}	Optional	Boolean	Rule description column
cci={true\|false}	Optional	Boolean	CCI column
rule_posture	Optional	Boolean	Rule posture column
vuln_description	Optional	Boolean	Vuln description column
vuln_posture={true\|false}	Optional	Boolean	Vuln posture column
glossary={true\|false}	Optional	Boolean	Glossary
appendix={true\|false}	Optional	Boolean	Appendix
exclude.account_id={true\|false}	Optional	Boolean	Exclude account ID from report
include.report.users={value}	Optional	String	Comma-separated user IDs/usernames granted report access

Input Parameters - Mandate Template SettingsInput Parameters - Mandate Template Settings

Key	Required / Optional	Data Type	Description
group.by={value}	Optional	String	Default: 1. Allowed: 1 (Mandate), 2 (Control Objective)
include_posture_status={value}	Optional	Integer	Default: 0,1,2. 0-Fail, 1-Pass, 2-Error
include_control_criticality={value}	Optional	String	Control criticality filter. Supply include_control_criticality as a comma-separated string of numeric IDs 0 — Undefined 1 — Minimal 2 — Medium 3 — Serious 4 — Critical 5 — Urgent
include_mandate_stats={true\|false}	Optional	Boolean	Default: true. Mandate statistics section
include_report_details={true\|false}	Optional	Boolean	Default: true. Detailed report rows
include_glossary={true\|false}	Optional	Boolean	Default: true. Glossary section
include_appendix={true\|false}	Optional	Boolean	Default: true. Appendix section
graph.mandate={true\|false}	Optional	Boolean	Mandate graph
graph.requirement={true\|false}	Optional	Boolean	Requirement graph
graph.policy={true\|false}	Optional	Boolean	Policy graph
report.settings={true\|false}	Optional	Boolean	Report settings block
report.summary={true\|false}	Optional	Boolean	Report summary toggle
details={true\|false}	Optional	Boolean	Details toggle
control.posture={true\|false}	Optional	Boolean	Control posture
filter.policy.controls={true\|false}	Optional	Boolean	Filter by policy controls
include_custom_footer={true\|false}	Optional	Boolean	Enable custom footer section
custom.footer.text={value}	Optional	String	Custom footer text - requires include_custom_footer: true
exclude.account_id={true\|false}	Optional	Boolean	Exclude account ID from report
report_settings={true\|false}	Optional	Boolean	Report settings block
include_report_summary={true\|false}	Optional	Boolean	Report summary section toggle
include_posture_graphs={true\|false}	Optional	Boolean	Posture graphs section toggle
glossary={true\|false}	Optional	Boolean	Glossary
appendix={true\|false}	Optional	Boolean	Appendix
include.report.users={value}	Optional	String	Comma-separated user IDs/usernames granted report access

Input Parameters - Scorecard template SettingsInput Parameters - Scorecard template Settings

Key	Required / Optional	Data Type	Description
include_summary={true\|false}	Optional	Boolean	Report summary section
include_overall_by_policy={true\|false}	Optional	Boolean	Overall compliance grouped by policy
include_change_by_policy={true\|false}	Optional	Boolean	Change-over-time grouped by policy
include_change_by_policy_asset={true\|false}	Optional	Boolean	Change by policy, sub-grouped by asset group/tag
include_change_by_policy_tech={true\|false}	Optional	Boolean	Change by policy, sub-grouped by technology
include_overall_by_asset={true\|false}	Optional	Boolean	Overall compliance grouped by asset group/tag
include_change_by_asset={true\|false}	Optional	Boolean	Change-over-time grouped by asset group/tag
include_change_by_asset_policy={true\|false}	Optional	Boolean	Change by asset, sub-grouped by policy
include_change_by_asset_tech={true\|false}	Optional	Boolean	Change by asset, sub-grouped by technology
include_overall_by_tech={true\|false}	Optional	Boolean	Overall compliance grouped by technology
include_change_by_tech={true\|false}	Optional	Boolean	Change-over-time grouped by technology
include_top_host_change={true\|false}	Optional	Boolean	Top hosts with posture change
include_top_control_change={true\|false}	Optional	Boolean	Top controls with posture change
include_criticality={value}	Optional	String	Control-criticality filter (requires subscription support)
include_fail_by_criticality={true\|false}	Optional	Boolean	Failures grouped by criticality (requires subscription support)
include_overall_by_criticality={true\|false}	Optional	Boolean	Overall compliance grouped by criticality
include_change_by_criticality={true\|false}	Optional	Boolean	Change-over-time grouped by criticality
include_change_by_criticality_policy={true\|false}	Optional	Boolean	Change by criticality, sub-grouped by policy
include_change_by_criticality_asset={true\|false}	Optional	Boolean	Change by criticality, sub-grouped by asset group/tag
include_change_by_criticality_tech={true\|false}	Optional	Boolean	Change by criticality, sub-grouped by technology
include_change_by_criticality_asc_order={true\|false}	Optional	Boolean	Sort criticality change ascending
include_change_by_criticality_desc_order={true\|false}	Optional	Boolean	Sort criticality change descending
include_failed_controls_by_criticality={true\|false}	Optional	Boolean	Failed controls grouped by criticality
compliance_scorecard_report_display={value}	Optional	Integer	Top-N display count (default 10)
compliance_scorecard_report_timeframe={value}	Optional	Integer	Trend timeframe in days, 1–90 (default 30)
compliance_scorecard_report_failed_controls_display={value}	Optional	Integer	Top-N failed controls display count (default 5)
custom.footer.enabled={true\|false}	Optional	Boolean	Enable custom footer
custom.footer.text={value}	Optional	String	Custom footer text
exclude.account_id={true\|false}	Optional	Boolean	Exclude account ID from report
include.report.users={value}	Optional	String	Comma-separated user IDs/usernames granted report access

Input ParametersInput Parameters

Policy - report_group_by

Value	Description
group_by_hosts	Group by host (default)
host	Legacy alias for group_by_hosts
group_by_controls	Group by control
group_by_control_references	Group by control reference — requires pref pc.group_by_control_ref_policy_report
group_by_control_chaining	Group by control chaining — requires pref pc.group_by_control_chaining_policy_report

Mandate - group.by

Value	Description
1	Group by Mandate (default)
2	Group by Control Objective

STIG - group.by

Value	Description
1	Group by Host based on STIG Rule (default) — see main Stig example above
2	Group by Host based on STIG Vuln
3	Group by STIG Rule
4	Group by STIG Vuln

Policy - report_group_by

Sample - Policy, Group By HostsSample - Policy, Group By Hosts

API Request

curl --location '<gateway_base_url>/pcrs/1.0/report/template' \
--header 'Content-Type: application/json' \
--header 'Authorization: Bearer <JWT_Token>' \
--data '{
  "title": "My Policy Template",
  "type": "policy",
  "settings": {
        "report_group_by": "group_by_hosts",
        "report_sort_by": "sort_by_ip",
        "include_posture_status": "7",
        "include_report_summary": "true",
        "include_host_stats": "true",
        "include_report_details": "true",
        "include_control_rationale": "true",
        "include_control_evidence": "true",
        "include_control_ext_evidence": "true",
        "include_control_exceptions": "true",
        "include_exceptions_history": "true",
        "include_host_summary": "true",
        "include_appendix": "true",
        "include_control_scan_parameter": "true",
        "trend_duration": "30",
        "include_asset_tag": "true",
        "include_section_details": "false",
        "include_category_details": "false",
        "include_pa_report_trurisk": "false",
        "include_scan_source_details": "false",
        "include_control_previous_posture": "true",
        "include_failed_control_remediation": "true",
        "include_errored_control_remediation": "true",
        "include_control_not_expected_values": "true",
        "include_control_required_values": "true"
  }
}'

JSON Response

{
    "templateId": 4651203,
    "title": "My Policy Template",
    "type": "policy",
    "isGlobal": false,
    "owner": "quays_zd38",
    "createdAt": "2026-07-23T07:27:21Z",
    "settings": {
        "report_group_by": "group_by_hosts",
        "report_sort_by": "sort_by_ip",
        "include_posture_status": "7",
        "include_report_summary": "true",
        "include_host_stats": "true",
        "include_report_details": "true",
        "include_control_rationale": "true",
        "include_control_evidence": "true",
        "include_control_ext_evidence": "true",
        "include_control_exceptions": "true",
        "include_exceptions_history": "true",
        "include_host_summary": "true",
        "include_appendix": "true",
        "include_control_scan_parameter": "true",
        "trend_duration": "30",
        "include_asset_tag": "true",
        "include_section_details": "false",
        "include_category_details": "false",
        "include_pa_report_trurisk": "false",
        "include_scan_source_details": "false",
        "include_control_previous_posture": "true",
        "include_failed_control_remediation": "true",
        "include_errored_control_remediation": "true",
        "include_control_not_expected_values": "true",
        "include_control_required_values": "true"
    }
}

Sample - Policy, Group By ControlsSample - Policy, Group By Controls

API Request

curl --location '<gateway_base_url>/pcrs/1.0/report/template' \
--header 'Content-Type: application/json' \
--header 'Authorization: Bearer <JWT_Token>' \
--data '{
  "title": "Policy Report Template - Group By Controls",
  "type": "policy",
  "settings": {
        "report_group_by": "group_by_controls",
        "report_sort_by": "sort_by_control_id",
        "include_posture_status": "7",
        "include_report_summary": "true",
        "include_report_details": "true",
        "include_control_summary": "true",
        "include_control_rationale": "true",
        "include_control_evidence": "true",
        "include_control_ext_evidence": "true",
        "include_control_exceptions": "true",
        "include_exceptions_history": "true",
        "include_appendix": "true",
        "include_control_scan_parameter": "true",
        "include_control_tech_summary": "true",
        "trend_duration": "30",
        "include_asset_tag": "true",
        "include_section_details": "false",
        "include_control_stats": "true",
        "include_control_comments": "true",
        "include_category_details": "false",
        "include_pa_report_trurisk": "false",
        "include_scan_source_details": "false",
        "include_control_previous_posture": "true",
        "include_failed_control_remediation": "true",
        "include_errored_control_remediation": "true",
        "include_control_not_expected_values": "true",
        "include_control_required_values": "true"
  }
}'

JSON Response

{
    "templateId": 4652132,
    "title": "Policy Report Template - Group By Controls",
    "type": "policy",
    "isGlobal": false,
    "owner": "quays_zd38",
    "createdAt": "2026-07-23T08:41:30Z",
    "settings": {
        "include_posture_status": "7",
        "include_report_summary": "true",
        "include_report_details": "true",
        "include_control_summary": "true",
        "include_control_rationale": "true",
        "include_control_evidence": "true",
        "include_control_ext_evidence": "true",
        "include_control_exceptions": "true",
        "include_exceptions_history": "true",
        "include_appendix": "true",
        "include_control_scan_parameter": "true",
        "include_control_tech_summary": "true",
        "report_group_by": "group_by_controls",
        "report_sort_by": "sort_by_control_id",
        "trend_duration": "30",
        "include_asset_tag": "true",
        "include_section_details": "false",
        "include_control_stats": "true",
        "include_control_comments": "true",
        "include_category_details": "false",
        "include_pa_report_trurisk": "false",
        "include_scan_source_details": "false",
        "include_control_previous_posture": "true",
        "include_failed_control_remediation": "true",
            }
}

Sample - Policy, Group By Control ReferencesSample - Policy, Group By Control References

API Request

curl --location '<gateway_base_url>/pcrs/1.0/report/template' \
--header 'Content-Type: application/json' \
--header 'Authorization: Bearer <JWT_Token>' \
--data '{
  "title": "Policy Report Template - Group By Control References",
  "type": "policy",
  "settings": {
        "report_group_by": "group_by_control_references",
        "report_sort_by": "sort_by_control_id",
        "include_posture_status": "7",
        "include_report_summary": "true",
        "include_report_details": "true",
        "include_control_summary": "true",
        "include_control_rationale": "true",
        "include_control_evidence": "true",
        "include_control_ext_evidence": "true",
        "include_control_exceptions": "true",
        "include_exceptions_history": "true",
        "include_appendix": "true",
        "include_control_scan_parameter": "true",
        "include_control_tech_summary": "true",
        "trend_duration": "30",
        "include_host_stats": "true",
        "include_host_summary": "true",
        "include_control_stats": "false",
        "include_asset_tag": "true",
        "include_section_details": "false",
        "include_category_details": "false",
        "include_pa_report_trurisk": "false",
        "include_scan_source_details": "false",
        "include_control_previous_posture": "true",
        "include_failed_control_remediation": "true",
        "include_errored_control_remediation": "true",
        "include_control_not_expected_values": "true",
        "include_control_required_values": "true"
  }
}'

JSON Response

{
    "templateId": 4652134,
    "title": "Policy Report Template - Group By Control References",
    "type": "policy",
    "isGlobal": false,
    "owner": "username",
    "createdAt": "2026-07-23T08:44:36Z",
    "settings": {
        "report_group_by": "group_by_control_references",
        "report_sort_by": "sort_by_control_id",
        "include_posture_status": "7",
        "include_report_summary": "true",
        "include_report_details": "true",
        "include_control_summary": "true",
        "include_control_rationale": "true",
        "include_control_evidence": "true",
        "include_control_ext_evidence": "true",
        "include_control_exceptions": "true",
        "include_control_scan_parameter": "true",
        "include_control_tech_summary": "true",
        "trend_duration": "30",
        "include_host_stats": "true",
        "include_host_summary": "true",
        "include_control_stats": "false",
        "include_asset_tag": "true",
        "include_exceptions_history": "true",
        "include_appendix": "true",
        "include_section_details": "false",
        "include_category_details": "false",
        "include_pa_report_trurisk": "false",
        "include_scan_source_details": "false",
        "include_control_previous_posture": "true",
        "include_failed_control_remediation": "true",
        "include_errored_control_remediation": "true",
        "include_control_not_expected_values": "true",
        "include_control_required_values": "true"
    }
}

Sample - Policy, Group By Control ChainingSample - Policy, Group By Control Chaining

API Request

curl --location '<gateway_base_url>/pcrs/1.0/report/template' \
--header 'Content-Type: application/json' \
--header 'Authorization: Bearer <JWT_Token>' \
--data '{
  "title": "Policy Report Template - Group By Control Chaining",
  "type": "policy",
  "settings": {
        "report_group_by": "group_by_control_chaining",
        "report_sort_by": "sort_by_ip",
        "include_posture_status": "7",
        "include_report_summary": "true",
        "include_host_stats": "true",
        "include_report_details": "true",
        "include_control_ext_evidence": "true",
        "include_control_scan_parameter": "true",
        "include_control_exceptions": "true",
        "include_exceptions_history": "true",
        "include_appendix": "true",
        "trend_duration": "30",
        "include_asset_tag": "true",
        "include_cloud_metadata": "false",
        "include_section_details": "false",
        "include_category_details": "false",
        "include_pa_report_trurisk": "false",
        "include_scan_source_details": "false",
        "include_host_summary": "true",
        "include_control_evidence": "true",
        "include_control_chaining_criticality": "true",
        "include_control_chaining_remediation": "true",
        "include_control_chaining_scoring": "true",
        "include_control_chaining_assessment_status": "true",
        "include_control_chaining_cis_audit_procedure": "true",
        "include_control_chaining_cis_remediation": "true",
        "include_control_chaining_ig_mapping": "true",
        "include_control_chaining_profile": "true",
        "include_control_not_expected_values": "true",
        "include_control_required_values": "true",
        "include_failed_control_remediation": "true",
        "include_errored_control_remediation": "true",
        "include_control_previous_posture": "true"
  }
}'

JSON Response

{
    "templateId": 4652136,
    "title": "Policy Report Template - Group By Control Chaining",
    "type": "policy",
    "isGlobal": false,
    "owner": "quays_zd38",
    "createdAt": "2026-07-23T08:54:17Z",
    "settings": {
        "report_group_by": "group_by_control_chaining",
        "report_sort_by": "sort_by_ip",
        "include_posture_status": "7",
        "include_report_summary": "true",
        "include_host_stats": "true",
        "include_report_details": "true",
        "include_host_summary": "true",
        "include_control_evidence": "true",
        "include_control_ext_evidence": "true",
        "include_control_scan_parameter": "true",
        "include_control_exceptions": "true",
        "include_exceptions_history": "true",
        "include_appendix": "true",
        "trend_duration": "30",
        "include_asset_tag": "true",
        "include_cloud_metadata": "false",
        "include_section_details": "false",
        "include_category_details": "false",
        "include_pa_report_trurisk": "false",
        "include_scan_source_details": "false",
        "include_control_chaining_criticality": "true",
        "include_control_chaining_remediation": "true",
        "include_control_chaining_scoring": "true",
        "include_control_chaining_assessment_status": "true",
        "include_control_chaining_cis_audit_procedure": "true",
        "include_control_chaining_cis_remediation": "true",
        "include_control_chaining_ig_mapping": "true",
        "include_control_chaining_profile": "true",
        "include_control_not_expected_values": "true",
        "include_control_required_values": "true",
        "include_failed_control_remediation": "true",
        "include_errored_control_remediation": "true",
        "include_control_previous_posture": "true"
    }
}

Mandate - Group.by

Sample - Mandate, Group By MandateSample - Mandate, Group By Mandate

API Request

curl --location '<gateway_base_url>/pcrs/1.0/report/template' \
--header 'Content-Type: application/json' \
--header 'Authorization: Bearer <JWT_Token>' \
--data '{
  "title": "My Mandate Template",
  "type": "mandate",
  "isGlobal": true,
  "settings": {
        "filter.policy.controls": "true",
        "report.settings": "true",
        "report.summary": "true",
        "graph.mandate": "true",
        "graph.requirement": "true",
        "graph.policy": "true",
        "details": "true",
        "control.posture": "true",
        "glossary": "true",
        "include_posture_status": "0,1,2",
        "include_control_criticality": "0,1,2,3,4,5",
        "group.by": "1"
  }
}'

JSON Response

{
    "templateId": 4651201,
    "title": "My Mandate Template",
    "type": "mandate",
    "isGlobal": true,
    "owner": "quays_zd38",
    "createdAt": "2026-07-23T07:22:11Z",
    "settings": {
        "group.by": "1",
        "filter.policy.controls": "true",
        "report.settings": "true",
        "report.summary": "true",
        "graph.mandate": "true",
        "graph.requirement": "true",
        "graph.policy": "true",
        "details": "true",
        "control.posture": "true",
        "glossary": "true",
        "include_posture_status": "0,1,2",
        "include_control_criticality": "0,1,2,3,4,5"
    }
}

Sample - Mandate, Group By Control ObjectiveSample - Mandate, Group By Control Objective

API Request

curl --location '<gateway_base_url>/pcrs/1.0/report/template' \
--header 'Content-Type: application/json' \
--header 'Authorization: Bearer <JWT_Token>' \
--data '{
  "title": "Mandate Report Template - Group By Control Objective",
  "type": "mandate",
  "isGlobal": true,
  "settings": {
        "group.by": "2",
        "filter.policy.controls": "true",
        "report.settings": "true",
        "report.summary": "true",
        "graph.mandate": "true",
        "graph.requirement": "true",
        "graph.policy": "true",
        "details": "true",
        "control.posture": "true",
        "glossary": "true",
        "include_posture_status": "0,1,2",
        "include_control_criticality": "0,1,2,3,4,5"
  }
}'

JSON Response

{
    "templateId": 4652138,
    "title": "Mandate Report Template - Group By Control Objective",
    "type": "mandate",
    "isGlobal": true,
    "owner": "quays_zd38",
    "createdAt": "2026-07-23T08:59:02Z",
    "settings": {
        "group.by": "2",
        "filter.policy.controls": "true",
        "report.settings": "true",
        "report.summary": "true",
        "graph.mandate": "true",
        "graph.requirement": "true",
        "graph.policy": "true",
        "details": "true",
        "control.posture": "true",
        "glossary": "true",
        "include_posture_status": "0,1,2",
        "include_control_criticality": "0,1,2,3,4,5"
    }
}

STIG - group.by

Sample - STIG, Group By Host based on STIG RuleSample - STIG, Group By Host based on STIG Rule

API Request

curl --location '<gateway_base_url>/pcrs/1.0/report/template' \
--header 'Content-Type: application/json' \
--header 'Authorization: Bearer <JWT_Token>' \
--data '{
  "title": "My STIG Template",
  "type": "stig",
  "isGlobal": true,
  "settings": {
        "include_severity": "1,2,3",
        "rule_statistics": "true",
        "compliant_rule_stats_by_severity": "true",
        "report_details": "true",
        "host_statistics": "true",
        "net_bios": "true",
        "tracking_method": "true",
        "dns": "true",
        "operating_system": "true",
        "network": "true",
        "instance": "true",
        "for_passed_control": "true",
        "for_error_control": "true",
        "control_rationale": "true",
        "group.by": "1",
        "include_posture": "0,1,1000",
        "evidence": "true",
        "extended_evidence": "true",
        "for_failed_control": "true",
        "rule_description": "true",
        "rule_posture": "true",
        "cci": "true",
        "vuln_description": "true",
        "vuln_posture": "true",
        "glossary": "true",
        "appendix": "true"
  }
}'

JSON Response

{
    "templateId": 4651205,
    "title": "My STIG Template",
    "type": "stig",
    "isGlobal": true,
    "owner": "quays_zd38",
    "createdAt": "2026-07-23T07:35:34Z",
    "settings": {
        "group.by": "1",
        "include_posture": "0,1,1000",
        "include_severity": "1,2,3",
        "rule_statistics": "true",
        "compliant_rule_stats_by_severity": "true",
        "report_details": "true",
        "host_statistics": "true",
        "net_bios": "true",
        "tracking_method": "true",
        "dns": "true",
        "operating_system": "true",
        "network": "true",
        "instance": "true",
        "for_passed_control": "true",
        "for_error_control": "true",
        "control_rationale": "true",
        "evidence": "true",
        "extended_evidence": "true",
        "for_failed_control": "true",
        "rule_description": "true",
        "rule_posture": "true",
        "cci": "true",
        "vuln_description": "true",
        "vuln_posture": "true",
        "glossary": "true",
        "appendix": "true"
    }
}

Sample - STIG, Group By Host based on STIG VulnerabilitySample - STIG, Group By Host based on STIG Vulnerability

API Request

curl --location '<gateway_base_url>/pcrs/1.0/report/template' \
--header 'Content-Type: application/json' \
--header 'Authorization: Bearer <JWT_Token>' \
--data '{
  "title": "Stig Report Template - Group By Host based on STIG Vuln",
  "type": "stig",
  "isGlobal": true,
  "settings": {
        "include_severity": "1,2,3",
        "rule_statistics": "true",
        "vuln_statistics": "true",
        "compliant_rule_stats_by_severity": "true",
        "report_details": "true",
        "host_statistics": "true",
        "net_bios": "true",
        "tracking_method": "true",
        "dns": "true",
        "operating_system": "true",
        "network": "true",
        "instance": "true",
        "for_passed_control": "true",
        "for_error_control": "true",
        "group.by": "2",
        "include_posture": "0,1,1000",
        "control_rationale": "true",
        "evidence": "true",
        "extended_evidence": "true",
        "for_failed_control": "true",
        "rule_description": "true",
        "rule_posture": "true",
        "cci": "true",
        "vuln_description": "true",
        "vuln_posture": "true",
        "glossary": "true",
        "appendix": "true"
  }
}'

JSON Response

{
    "templateId": 4652142,
    "title": "Stig Report Template - Group By Host based on STIG Vuln",
    "type": "stig",
    "isGlobal": true,
    "owner": "quays_zd38",
    "createdAt": "2026-07-23T09:11:03Z",
    "settings": {
        "group.by": "2",
        "include_posture": "0,1,1000",
        "include_severity": "1,2,3",
        "rule_statistics": "true",
        "vuln_statistics": "true",
        "compliant_rule_stats_by_severity": "true",
        "report_details": "true",
        "host_statistics": "true",
        "net_bios": "true",
        "tracking_method": "true",
        "dns": "true",
        "operating_system": "true",
        "network": "true",
        "instance": "true",
        "for_passed_control": "true",
        "for_error_control": "true",
        "control_rationale": "true",
        "evidence": "true",
        "extended_evidence": "true",
        "for_failed_control": "true",
        "rule_description": "true",
        "rule_posture": "true",
        "cci": "true",
        "vuln_description": "true",
        "vuln_posture": "true",
        "glossary": "true",
        "appendix": "true"
    }
}

Sample - STIG, Group By STIG RuleSample - STIG, Group By STIG Rule

API Request

curl --location '<gateway_base_url>/pcrs/1.0/report/template' \
--header 'Content-Type: application/json' \
--header 'Authorization: Bearer <JWT_Token>' \
--data '{
  "title": "Stig Report Template - Group By Stig Rule",
  "type": "stig",
  "isGlobal": true,
  "settings": {
        "group.by": "3",
        "include_posture": "0,1,1000",
        "include_severity": "1,2,3",
        "rule_statistics": "true",
        "compliant_rule_stats_by_severity": "true",
        "report_details": "true",
        "host_statistics": "true",
        "net_bios": "true",
        "tracking_method": "true",
        "dns": "true",
        "operating_system": "true",
        "network": "true",
        "instance": "true",
        "for_passed_control": "true",
        "for_error_control": "true",
        "control_rationale": "true",
        "evidence": "true",
        "extended_evidence": "true",
        "for_failed_control": "true",
        "rule_description": "true",
        "rule_posture": "true",
        "cci": "true",
        "vuln_description": "true",
        "vuln_posture": "true",
        "glossary": "true",
        "appendix": "true"
  }
}'

JSON Response

{
    "templateId": 4653132,
    "title": "Stig Report Template - Group By Stig Rule",
    "type": "stig",
    "isGlobal": true,
    "owner": "quays_zd38",
    "createdAt": "2026-07-23T09:16:08Z",
    "settings": {
        "include_severity": "1,2,3",
        "rule_statistics": "true",
        "compliant_rule_stats_by_severity": "true",
        "report_details": "true",
        "host_statistics": "true",
        "net_bios": "true",
        "tracking_method": "true",
        "dns": "true",
        "operating_system": "true",
        "network": "true",
        "instance": "true",
        "for_passed_control": "true",
        "group.by": "3",
        "include_posture": "0,1,1000",
        "for_error_control": "true",
        "control_rationale": "true",
        "evidence": "true",
        "extended_evidence": "true",
        "for_failed_control": "true",
        "rule_description": "true",
        "rule_posture": "true",
        "cci": "true",
        "vuln_description": "true",
        "vuln_posture": "true",
        "glossary": "true",
        "appendix": "true"
    }
}

Sample - STIG, Group By STIG VulnerabilitySample - STIG, Group By STIG Vulnerability

API Request

curl --location '<gateway_base_url>/pcrs/1.0/report/template' \
--header 'Content-Type: application/json' \
--header 'Authorization: Bearer <JWT_Token>' \
--data '{
  "title": "Stig Report Template - Group By Stig Vuln",
  "type": "stig",
  "isGlobal": true,
  "settings": {
        "include_posture": "0,1,1000",
        "include_severity": "1,2,3",
        "rule_statistics": "true",
        "vuln_statistics": "true",
        "compliant_rule_stats_by_severity": "true",
        "report_details": "true",
        "host_statistics": "true",
        "net_bios": "true",
        "tracking_method": "true",
        "dns": "true",
        "operating_system": "true",
        "network": "true",
        "instance": "true",
        "for_passed_control": "true",
        "group.by": "4",
        "for_error_control": "true",
        "control_rationale": "true",
        "evidence": "true",
        "extended_evidence": "true",
        "for_failed_control": "true",
        "rule_description": "true",
        "rule_posture": "true",
        "cci": "true",
        "vuln_description": "true",
        "vuln_posture": "true",
        "glossary": "true",
        "appendix": "true"
  }
}'

JSON Response

{
    "templateId": 4653134,
    "title": "Stig Report Template - Group By Stig Vuln",
    "type": "stig",
    "isGlobal": true,
    "owner": "quays_zd38",
    "createdAt": "2026-07-23T09:17:56Z",
    "settings": {
        "group.by": "4",
        "include_posture": "0,1,1000",
        "include_severity": "1,2,3",
        "rule_statistics": "true",
        "vuln_statistics": "true",
        "compliant_rule_stats_by_severity": "true",
        "report_details": "true",
        "host_statistics": "true",
        "net_bios": "true",
        "tracking_method": "true",
        "dns": "true",
        "operating_system": "true",
        "network": "true",
        "instance": "true",
        "for_passed_control": "true",
        "for_error_control": "true",
        "control_rationale": "true",
        "evidence": "true",
        "extended_evidence": "true",
        "for_failed_control": "true",
        "rule_description": "true",
        "rule_posture": "true",
        "cci": "true",
        "vuln_description": "true",
        "vuln_posture": "true",
        "glossary": "true",
        "appendix": "true"
    }
}

Last updated: August, 2026