Qualys Policy Audit API Notification

A new release of Qualys Policy Audit (PA Release 1.14), which is released in August 2026, includes new and updates to an existing API. This API notification highlights recently released changes, enabling you to identify use cases that can benefit from the updated APIs.

What’s New? 

Manage Compliance Frameworks Using Various Framework Policy APIs

GET and POST  

DTD or XSD changes: Not Applicable 

Compliance Framework policies help you meet specific technical and regulatory requirements. To assess a framework’s overall posture, policies must be created using controls mapped to that framework. Creating these policies involves a defined process with several repetitive steps that can be automated. 

With this release, we have introduced the following framework APIs that can help you automate the repetitive steps: 

• Frameworks List API – GET /pcas/v1/frameworks – Lists available frameworks with their names and IDs. 

• Technologies List API – GET /pcas/v1/technology – Lists available technologies for a particular category. 

• Benchmarks List API – GET /pcas/v1/frameworks/benchmarks – Lists available benchmarks, such as CIS, DISA STIG, Qualys, and Vendor benchmarks, with their names and IDs. 

• Asset Groups List API – GET /pcas/v1/asset/group/list – Lists available asset groups with their names and IDs. 

• Asset Tags List API – GET /pcas/v1/asset/tags – Lists available asset tags with their names and IDs. 

• Configure Controls API – POST /pcas/v1/frameworks/configure/controls – Gets the list of controls, grouped by sections, for the selected framework and technologies. 

• Create Framework Policy API – POST /pcas/v3/policy – Creates a new framework policy. 

Middleware Asset API 

GET and POST /api/2.0/fo/compliance/middleware/ 

DTD or XSD changes: No 

We now support the Middleware Asset API that helps you list, activate, or deactivate middleware assets.

List Reports API: View Response Progress Updates

GET  /api/2.0/fo/report/?action=list and /api/3.0/fo/report/?action=list 

DTD or XSD changes: No 

The List Reports API now provides progress updates in the response, showing the number of reports processed out of the total reports being retrieved. 

For reports, if the API response takes longer to generate, a progress message is displayed every 15 seconds indicating the current processing status (for example, 9/581, 25/581, and so on) until all are retrieved. 

Report Template APIs

GET   

DTD or XSD changes: No 

With this release, we have introduced the report template APIs that enable you to list, retrieve, and create compliance report templates. 

Using this API, you can list, retrieve, and create policy, mandate, STIG, and scorecard report templates.  

• List Report Templates – GET /pcrs/1.0/report/template/list – Retrieves all report templates, with optional filtering by type. 

• Retrieve Report Template – GET /pcrs/1.0/report/template/{id} – Retrieves the details of a single report template. 

• Create Report Template – POST /pcrs/1.0/report/template – Creates a new report template. 

For more details, please refer to the release notes here: https://docs.qualys.com/en/vm/release-notes/mergedProjects/qualys_pa/pa/release_1_14_api.htm