Policy Audit Release 1.18 API

November 6, 2026

This release introduces new Policy Compliance Assessment Service (PCAS) APIs to fetch CIS benchmark rules for your CIS policies and to export details of multiple policies in a single request. The PCAS Policy Export API now returns policy creation, modification, and last evaluated details, and the Get Posture Info API now returns the EC2 instance name for your AWS assets.

In the API Release Notes, <qualys_base_url> and <gateway_base_url> are used as a sample API request to represent the API server URL. To learn more about the API server URL for your environment, refer to the Know Your Qualys API Server URL section.

We have implemented versioning for APIs. For more information on API versioning, refer to the  Updates on API Versioning Standards & Deprecation Timelines  blog.

New Feature

PCAS Policy API: Fetch CIS Benchmark Rules for CIS Policies

What's New for You

You can now use a new API to fetch the Center for Internet Security (CIS) benchmark rules for your CIS policies, so you can map control posture to CIS benchmark sections in your reports.

New or Updated API New
API Endpoint /pcas/v1/policy/cis-benchmark-rules
Method GET
DTD or XSD changes Not Applicable

The new CIS Benchmark Rules API returns, for each policy you specify, the CIS benchmark linked to that policy and the rules of that benchmark. 

Previously, the posture APIs returned compliance data for each control separately, without the CIS benchmark structure.


- This API is also available to users with a Security Configuration Assessment (SCA) only subscription.
-  You can specify up to 5 unique policy IDs in a request.

Input ParametersInput Parameters

Parameter Name Required / Optional Data Type Description
policy_id={value} Required Integer Specify one or more policy IDs. Multiple IDs are comma-separated.
You can specify up to 5 unique policy IDs.

Sample - Get CIS benchmark rules for a single policySample - Get CIS benchmark rules for a single policy

API Request

curl -X GET \
  "<gateway_base_url>/pcas/v1/policy/cis-benchmark-rules?policyIds=2723423" \
  -H "Authorization: Bearer <JWT token>"

JSON Response

{
  "results": [
    {
      "policyId": 2723423,
      "hasCisBenchmark": true,
      "cisBenchmarkId": 10601,
      "benchmarkRules": [
        {
          "reference": "1.1.1.1",
          "rule": "28951 AND 29271 AND 29272"
        },
        {
          "reference": "1.1.1.2",
          "rule": "29371 AND 28954 AND 29290"
        },
        {
          "reference": "1.1.1.3",
          "rule": "29373 AND 28955 AND 29293"
        },
      ]
    }
  ]
}

Sample - Get CIS benchmark rules for multiple policiesSample - Get CIS benchmark rules for multiple policies

API Request

curl -X GET \
  "<gateway_base_url>/pcas/v1/policy/cis-benchmark-rules?policyIds=6401312,6398812" \
  -H "Authorization: Bearer <JWT token>"

JSON Response

{
  "results": [
    {
      "policyId": 6401312,
      "hasCisBenchmark": true,
      "cisBenchmarkId": 11727,
      "benchmarkRules": [
        {
          "reference": "1.1.1.1",
          "rule": "28951 AND 29271"
        }
      ]
    },
    {
      "policyId": 6398812,
      "hasCisBenchmark": false,
      "cisBenchmarkId": null,
      "benchmarkRules": []
    }
  ]
}

New Feature

PCAS Policy List API: Export Details of Multiple Policies

What's New for You

With the new PCAS Policy List API, you can now export details of multiple policies in a single request.

New or Updated API New
API Endpoint /pcas/v3/policy/list
Method GET
DTD or XSD changes Not Applicable

Previously, you could export the details of only one policy per request. With the new PCAS Policy List API, you can now export the details of multiple policies in a single request.

The API does not require any input parameters. It returns all policies in the subscription associated with the authentication token used in the request.

Sample - Export details of multiple policiesSample - Export details of multiple policies

API Request

curl -X GET \
  "<gateway_base_url>/pcas/v3/policy/list" \
  -H "Authorization: Bearer <JWT token>"

JSON Response

[
  {
    "policyId": 1494036,
    "policyTitle": "My Policy",
    "createdBy": "John Doe (jdoe)",
    "createdDate": "2026-01-15 10:30:00",
    "lastModifiedBy": "Jane Smith (jsmith)",
    "lastModifiedDate": "2026-02-20 08:00:00",
    "lastEvaluated": "2026-03-25 12:45:00"
  },
  {
    "policyId": 1494037,
    "policyTitle": "Never Evaluated Policy",
    "createdBy": "John Doe (jdoe)",
    "createdDate": "2026-04-01 09:00:00",
    "lastModifiedBy": "John Doe (jdoe)",
    "lastModifiedDate": "2026-04-01 09:00:00"
  }
]

Enhancement

PCAS Policy Export API: View Created, Modified, and Last Evaluated Details for Exported Policies

What Changed For You

The Export Policy API now returns the creation, modification, and evaluation details for a policy.

New or Updated API Updated
API Endpoint /pcas/v3/policy
Method GET
DTD or XSD changes Not Applicable

Previously, the Export Policy APIs did not return a policy's creation, modification, or evaluation details. These details were accessible only in the Policy Audit application. 

You can now view the following fields in the response of the API:

  • createdBy
  • createdDate
  • lastModifiedBy
  • lastModifiedDate
  • lastEvaluated

Sample - Export policy details containing the creation, modification, and evaluation details Sample - Export policy details containing the creation, modification, and evaluation details 

API Request

curl -X GET \
  "<gateway_base_url>/pcas/v3/policy?policyId=1494036" \
  -H "Authorization: Bearer <JWT token>"

JSON Response

{
  "policyId": 1494036,
  "policyTitle": "My Policy",
  "exported": "29-09-2026 10:00:00",
  "coverPage": "cover page data",
  "isActive": true,
  "isLocked": false,
  "createdBy": "John Doe (jdoe)",
  "createdDate": "2026-01-15 10:30:00",
  "lastModifiedBy": "Jane Smith (jsmith)",
  "lastModifiedDate": "2026-02-20 08:00:00",
  "lastEvaluated": "2026-03-25 12:45:00"
}

Enhancement

Get Posture Info API: EC2 Instance Name in Cloud Resource Metadata

What Changed For You

You can now read the EC2 instance name of your AWS assets directly from the Posture Info API.

New or Updated API Updated
API Endpoint /pcrs/5.0/posture/postureInfo
Method POST
DTD or XSD changes Not Applicable

The Posture Streaming API now returns the EC2 instance name for AWS EC2 hosts. This allows you to map posture data to assets by instance name. 

Previously, the cloudMetaData.cloudResourceMetadata object in the Posture Streaming API (V5) response included EC2 details such as instanceType and instanceState, but not the instance name. The instance name was available only under basic details of the assets in the Policy Audit application.

When you request EC2 cloud metadata with the cloudMetaDataRequired=1 parameter, cloudMetaData.cloudResourceMetadata includes the new instanceName field. This field returns the value of the EC2 instance's AWS Name tag.

Sample - Posture record with EC2 instance nameSample - Posture record with EC2 instance name

API Request

curl \
  -H "X-Requested-With: Curl" \
  -H "Content-Type: application/json" \
  -X POST \
  -d '[{"policyId": "11681", "hostIds": ["30234567"]}]' \
  "<qualys_base_url>/pcrs/5.0/posture/postureInfo?cloudMetaDataRequired=1"

JSON Response

{
  "id": 990598626,
  "instance": "os",
  "policyId": 11681,
  "policyTitle": "CIS Window Member server",
  "netBios": "SYS_1_0_4_174",
  "controlId": 1091,
  ...
  "cloudMetaData": {
    "cloudProvider": "AWS",
    "cloudService": "EC2",
    "cloudResourceMetadata": {
      "privateIpAddress": "10.xx.xx.25",
      "instanceType": "t3.medium",
      "instanceState": "RUNNING",
      "instanceName": "prod-web-01",
      "regionCode": "us-east-1",
      ...
    }
  }
}

 

 

© 2026 Qualys, Inc. All rights reserved. Privacy Policy. Last updated: November, 2026