Qualys

Proofroom reads Qualys VMDR with a read-only API user. It collects your internal scan cadence, every open vulnerability with its age and remediation target, and, when Qualys is your Approved Scanning Vendor (ASV), the result of each PCI external scan.

Proofroom uses the current API versions from the start: scan list 3.0, host detection 6.0 and KnowledgeBase 4.0. Qualys ends API 2.0 for scans in December 2026.

What each collector shows

Severities. Qualys severity 5 (urgent) is shown as critical, 4 (critical) as high, 3 (serious) as medium and 2 (medium) as low. Severity 1 is informational and left out. Detections ignored in Qualys (often risk-accepted) are included, labelled “ignored in the scanner” and counted, so an accepted critical stays visible; detections of disabled QIDs are left out, as Qualys does by default.

Remediation targets. A critical finding is past target when it is still open more than critical days (default 30, PCI DSS 6.3.3) after Qualys first found it; a high finding after high days (default 90). Set both on the integration. Past-target findings feed the posture score (Vulnerability and patching) and raise a suggested risk. A critical or high finding with no first-found date is never counted as within target. Medium and low findings are listed with their age but have no target, so PCI DSS 11.3.1.1 is not suggested; map it yourself if your own policy covers them.

Internal or external. Qualys’s scan list does not name the scanner that ran a scan, so you name them. List the titles of your internal scans in internal scans (one per line; * matches any text, as in Quarterly internal*) and of scans run from the internet in external scans. Scans with the PCI option profile are external already. A scan that matches neither list is shown as “unknown” and never counts as an internal scan; with no internal titles set, no scan counts. A title that matches no scan in the last year fails the run, so a typing mistake is never filed as “no internal scans”. A finished scan that found no live host (sub-state No_Host or No_Host_Alive) is listed but does not count.

Rescans. A finished scan with the same title and target as one in the 30 days before it is shown as a likely rescan. Fixed detections with their fixed date are the stronger evidence that a rescan confirmed the fix.

Create the user

1. In Qualys, Users → New User. Give it the Reader role, scoped to the asset groups or tags in scope. Readers see scans whose targets include their IPs and the hosts in their scope. A Unit Manager scoped to a business unit sees all scans in that unit, if your scans are launched by others on targets outside the Reader’s scope.
2. Under the user’s permissions, tick API access. If your subscription has no API access, Qualys support enables it (error 2012 means it is off).
3. Do not give the user SecureID or SAML-only sign-in: both block the API.
4. Sign in once in the browser to complete registration and set the password.

ASV scans. The PCI merchant account (pci.qualys.com) is separate. Create a merchant user with read access, and give its username and password in the PCI fields. The PCI API does not work when the merchant account uses SAML sign-in.

Connect

The connection test lists the scans launched in the last day.

Calls

• GET /api/3.0/fo/scan/?action=list with launched_after_datetime, launched_before_datetime, show_op=1, show_status=1, once with pci_only=1. A year is read so the quarters can be shown.
• POST /api/6.0/fo/asset/host/vm/detection/?action=list with status=New,Active,Re-Opened, then status=Fixed with detection_updated_since, severities=2-5, include_ignored=1, show_results=0, truncation_limit=1000, following the WARNING/URL link for the next batch. 6.0 is the version Qualys recommends; 5.0 reaches end of support in February 2027 (API versioning, October 2026).
• POST /api/4.0/fo/knowledge_base/vuln/?action=list&details=Basic&ids=… for the titles of critical and high QIDs. If this call is refused, findings are named by QID and the evidence says so.
• GET https://pci-api.qualys.com/pci/scan/list?sortBy=Scandate&sortOrder=desc&limit=100&offset=… with apiVersion: V1.

Every call sends X-Requested-With, as Qualys requires, and never follows a redirect with the credentials. Rate and concurrency limits (codes 1920, 1960, 1965 with HTTP 409 or 400) are waited out using X-RateLimit-ToWait-Sec; a longer wait fails the run, which is retried later.

Known limits

• UNVERIFIED: basic authentication on the 6.0 detection API long term (Qualys documents no end date for it); the KnowledgeBase 4.0 response element names; the PCI API’s paging by offset (taken as a record number starting at 1) and its date format (“September 12, 2025 at 09:30 AM GMT”); whether 1965 arrives as HTTP 400 or 409.
• The Qualys PCI host is taken to be pci-api.qualys.com for every account.

Live check

After the first runs, check that the internal scans list matches the Scans tab for the period, that the open critical count matches VMDR’s dashboard filtered to severity 5 and status New, Active, Re-Opened, and that an ASV scan’s pass or fail matches the PCI account.