Scan Report

[POST] /qps/rest/3.0/create/was/report

Using the Report Creation API you can create the Scan Report. A scan report shows you the results of scans on a particular web application.

Permissions required - User must have WAS module enabled. User account must have these permissions: Access Permission, “API Access” and “Create Report”.

Input ParametersInput Parameters

These elements are optional and act as filters. When multiple elements are specified, parameters are combined using a logical AND. The element “target” is required and at least one “scans” child element is required. For details, refer to Reference: Report Creation.

Click here for available operators

Parameter	Mandatory /Optional	Data Type	Description
target.scans	Optional	WasScan	The web applications to be scanned.
filters.searchlists	Optional	SearchList	Number of search lists to report on vulnerabilities in those lists. If no search lists are selected, the report will include all findings.
filters.url	Optional	text	Number of URLs of the web applications to being scanned.
filters.status	Optional	ScanFindingStatus	Select status of vulnerabilities to be included in this report: New, Active, Re-opened, Fixed, Protected.
filters.remediation. showPatched	Optional	keyword	Specify the filter to include ignored or patched findings (vulnerabilities and sensitive content) in this report. Show patched filter: SHOW_ONLY, SHOW_NONE, SHOW_BOTH - default.
filters.remediation. ignoredReasons	Optional	keyword	The reason to ignore a finding: FALSE_POSITIVE, RISK_ACCEPTED, NOT_APPLICABLE.
display.contents	Optional	ScanAppReportContent	The report content: Description, Summary, Results, Individual Records, Details, AllResults, Appendix, Severity Levels.
display.graphs	Optional	ScanAppReportGraph	The graphs to be included in the report: Vulnerabilities by severity, Vulnerabilities by status, Vulnerabilities by group, Sensitive contents by group, Vulnerabilities by OWASP, Vulnerabilities by WASC, Most vulnerable URLs.
display.groups	Optional	ScanAppReportGroup	The group category to be included in the report: URL, OWASP, WASC, State, Category, QID, Group.
display.options	Optional	rawLevels	(Urgent), 4 (Critical), 3 (Serious), 2 (Medium), 1 (Minimal)
filters.remediation. showIgnored	Optional	boolean	Specify if you wish to include ignored or patched findings.
format	Optional	keyword	Report format, one of: WORD, HTML_ZIPPED, HTML_BASE64, PDF, PDF_ENCRYPTED, CSV, CSV_V2, XML, POWERPOINT

Sample - Create a scan reportSample - Create a scan report

Let us create a scan report in HTML ZIPPED format, selecting a single scan for the target.

API request

curl -u "USERNAME:PASSWORD" -H "content-type: text/xml" -X "POST" --data-binary @-
"<qualys_base_url>/qps/rest/3.0/create/was/report" < file.xml
Note: “file.xml” contains the request POST data.

Request POST data

<ServiceRequest>
    <data>
    <Report>
        <name>
        <![CDATA[with all parameters HTML_ZIPPED]]>
        </name>
        <description>
        <![CDATA[A simple scan report]]>
        </description>
        <format>HTML_ZIPPED</format>
        <type>WAS_SCAN_REPORT</type>
        <config>
        <scanReport>
            <target>
            <scans>
                <WasScan>
                <id>104268</id>
                </WasScan>
            </scans>
            </target>
            <display>
            <contents>
                <ScanReportContent>DESCRIPTION</ScanReportContent>
                <ScanReportContent>SUMMARY</ScanReportContent>
                <ScanReportContent>GRAPHS</ScanReportContent>
                <ScanReportContent>RESULTS</ScanReportContent>
                <ScanReportContent>INDIVIDUAL_RECORDS</ScanReportContent>
                <ScanReportContent>RECORD_DETAILS</ScanReportContent>
                <ScanReportContent>ALL_RESULTS</ScanReportContent>
                <ScanReportContent>APPENDIX</ScanReportContent>
            </contents>
            <graphs>
                <ScanReportGraph>VULNERABILITIES_BY_SEVERITY</ScanReportGraph>
                <ScanReportGraph>VULNERABILITIES_BY_GROUP</ScanReportGraph>
                <ScanReportGraph>VULNERABILITIES_BY_OWASP</ScanReportGraph>
                <ScanReportGraph>VULNERABILITIES_BY_WASC</ScanReportGraph>
                <ScanReportGraph>SENSITIVE_CONTENTS_BY_GROUP</ScanReportGraph>
            </graphs>
            <groups>
                <ScanReportGroup>URL</ScanReportGroup>
                <ScanReportGroup>GROUP</ScanReportGroup>
                <ScanReportGroup>OWASP</ScanReportGroup>
                <ScanReportGroup>WASC</ScanReportGroup>
                <ScanReportGroup>STATUS</ScanReportGroup>
                <ScanReportGroup>CATEGORY</ScanReportGroup>
                <ScanReportGroup>QID</ScanReportGroup>
            </groups>
            <options>
                <rawLevels>true</rawLevels>
            </options>
            </display>
            <filters>
            <searchlists>
                <SearchList>
                <id>43147</id>
                </SearchList>
            </searchlists>
            <url>http://www.mysite.com/help.html</url>
            <status>
                <ScanFindingStatus>NEW</ScanFindingStatus>
                <ScanFindingStatus>ACTIVE</ScanFindingStatus>
                <ScanFindingStatus>REOPENED</ScanFindingStatus>
                <ScanFindingStatus>FIXED</ScanFindingStatus>
            </status>
            </filters>
        </scanReport>
        </config>
    </Report>
    </data>
</ServiceRequest>

XML response

<?xml version="1.0" encoding="UTF-8"?>
<ServiceResponse xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:noNamespaceSchemaLocation="<qualys_base_url>/qps/xsd/3.0/was/report.xsd">
    <responseCode>SUCCESS</responseCode>
    <count>1</count>
    <data>
        <Report>
            <id>3629</id>
        </Report>
    </data>
</ServiceResponse>

Sample - Create a scan report with remediation filter optionsSample - Create a scan report with remediation filter options

Let us create a scan report with remediation filter options to either include ignored findings.

API request

curl -u "USERNAME:PASSWORD" -H "content-type: text/xml" -X "POST" --data-binary @-
"<qualys_base_url>/qps/rest/3.0/create/was/report" < file.xml
Note: “file.xml” contains the request POST data.

Request POST data

<ServiceRequest>
    <data>
    <Report>
        <name>
        <![CDATA[with all parameters HTML_ZIPPED]]>
        </name>
        <description>
        <![CDATA[A scan report with ignored
       findings]]>
        </description>
        <format>HTML_ZIPPED</format>
        <type>WAS_SCAN_REPORT</type>
        <config>
        <scanReport>
            <target>
            <scans>
                <WasScan>
                <id>104268</id>
                </WasScan>
            </scans>
            </target>
            <display>
            <contents>
                <ScanReportContent>DESCRIPTION</ScanReportContent>
                <ScanReportContent>SUMMARY</ScanReportContent>
                <ScanReportContent>GRAPHS</ScanReportContent>
                <ScanReportContent>RESULTS</ScanReportContent>
                <ScanReportContent>INDIVIDUAL_RECORDS</ScanReportContent>
                <ScanReportContent>RECORD_DETAILS</ScanReportContent>
                <ScanReportContent>ALL_RESULTS</ScanReportContent>
                <ScanReportContent>APPENDIX</ScanReportContent>
            </contents>
            <graphs>
                <ScanReportGraph>VULNERABILITIES_BY_SEVERITY</ScanReportGraph>
                <ScanReportGraph>VULNERABILITIES_BY_GROUP</ScanReportGraph>
                <ScanReportGraph>VULNERABILITIES_BY_OWASP</ScanReportGraph>
                <ScanReportGraph>VULNERABILITIES_BY_WASC</ScanReportGraph>
                <ScanReportGraph>SENSITIVE_CONTENTS_BY_GROUP</ScanReportGraph>
            </graphs>
            <groups>
                <ScanReportGroup>URL</ScanReportGroup>
                <ScanReportGroup>GROUP</ScanReportGroup>
                <ScanReportGroup>OWASP</ScanReportGroup>
                <ScanReportGroup>WASC</ScanReportGroup>
                <ScanReportGroup>STATUS</ScanReportGroup>
                <ScanReportGroup>CATEGORY</ScanReportGroup>
                <ScanReportGroup>QID</ScanReportGroup>
            </groups>
            <options>
                <rawLevels>true</rawLevels>
            </options>
            </display>
            <filters>
            <searchlists>
                <SearchList>
                <id>43147</id>
                </SearchList>
            </searchlists>
            <url>http://www.mysite.com/help.html</url>
            <remediation>
                <showIgnored>SHOW_BOTH</showIgnored>
                <ignoredReasons>
                <IgnoredReason>FALSE_POSITIVE</IgnoredReason>
                <IgnoredReason>RISK_ACCEPTED</IgnoredReason>
                <IgnoredReason>NOT_APPLICABLE</IgnoredReason>
                </ignoredReasons>
            </remediation>
            </filters>
        </scanReport>
        </config>
    </Report>
    </data>
</ServiceRequest>

XML response

<?xml version="1.0" encoding="UTF-8"?>
<ServiceResponse xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:noNamespaceSchemaLocation="<qualys_base_url>/qps/xsd/3.0/was/report.xsd">
    <responseCode>SUCCESS</responseCode>
    <count>1</count>
    <data>
        <Report>
            <id>202447</id>
        </Report>
    </data>
</ServiceResponse>

Sample - Create a scan report using report templateSample - Create a scan report using report template

Let’s generate a scan report in PDF format using a specific template (identified by its template ID).

API request

curl -u "USERNAME:PASSWORD" -H "content-type: text/xml" -X "POST" --data-binary @-
"<qualys_base_url>/qps/rest/3.0/create/was/report/" < file.xml
Note: “file.xml” contains the request POST data.

Request POST data

<?xml version="1.0" encoding="UTF-8"?>
<ServiceRequest>
    <data>
        <Report>
            <name>
                <![CDATA[Scan Report for Servers]]>
            </name>
            <format>PDF</format>
            <template>
                <id>876049</id>
            </template>
            <config>
                <scanReport>
                    <target>
                        <scans>
                            <WasScan>
                                <id>2252466</id>
                            </WasScan>
                        </scans>
                    </target>
                </scanReport>
            </config>
        </Report>
    </data>
</ServiceRequest>

XML response

<?xml version="1.0" encoding="UTF-8"?>
<ServiceResponse xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:noNamespaceSchemaLocation="<qualys_base_url>/qps/xsd/3.0/
was/report.xsd">
    <responseCode>SUCCESS</responseCode>
    <count>1</count>
    <data>
        <Report>
            <id>973057</id>
        </Report>
    </data>
</ServiceResponse>

Sample - Create a scan report in CSV_V2 formatSample - Create a scan report in CSV_V2 format

Let’s generate a scan report in CSV-V2 format.

API request

curl -u "USERNAME:PASSWORD" -H "content-type: text/xml" -X "POST" --data-binary @-
"<qualys_base_url>/qps/rest/3.0/create/was/report/" < file.xml
Note: “file.xml” contains the request POST data.

Request POST data

<?xml version="1.0" encoding="UTF-8"?>
<ServiceRequest>
    <data>
        <Report>
            <name>
                <![CDATA[Scan Report for Servers]]>
            </name>
            <format>CSV_V2</format>
            <template>
                <id>46441</id>
            </template>
            <config>
                <scanReport>
                    <target>
                        <scans>
                            <WasScan>
                                <id>1667002</id>
                            </WasScan>
                        </scans>
                    </target>
                </scanReport>
            </config>
        </Report>
    </data>
</ServiceRequest>

XML response

<?xml version="1.0" encoding="UTF-8"?>
<ServiceResponse xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:noNamespaceSchemaLocation="<qualys_base_url>/qps/xsd/3.0/was/report.xsd">
    <responseCode>SUCCESS</responseCode>
    <count>1</count>
    <data>
        <Report>
            <id>214159</id>
        </Report>
    </data>
</ServiceResponse>

XSD

<platform API server>/qps/xsd/3.0/was/report.xsd