Qualys Enterprise TruRisk™ Platform (VM Release 10.40) API Notification 

A new release of Qualys Enterprise TruRisk™ Platform (VM Release 10.40), which is released in September 2026, includes updates to existing APIs. This API notification highlights recently released changes, enabling you to identify use cases that can benefit from the updated APIs. 

What’s New?

Asset Search Report API: Filter Last Scan Dates for Specific Scan Types

GET  /api/3.0/fo/report/asset/ 

DTD or XSD changes: Yes 

You can now retrieve the last VM Agent Scan Date, last VM Scanner (ML) Scan Date, and last VM Flex Scan Date for each asset using the Asset Search Report API. This enhancement provides greater visibility into scan sources and enables more detailed reporting and asset tracking. 

• The API response now includes the LAST_VM_AGENT_SCAN_DATE, LAST_VM_SCANNER_SCAN_DATE, and LAST_VM_FLEX_SCAN_DATE elements. 

• You can filter assets by scan type using the vm_agent_scan_modifier/vm_agent_scan_days, vm_ml_scan_modifier/vm_ml_scan_days, and vm_flex_scan_modifier/vm_flex_scan_days parameters, each supporting a 0–730 day range. 

• An active Vulnerability Management Scan Process (VMSP) subscription is required to use this enhancement.

VM Scan Schedule API: Track Scheduled Scan Health in Real Time with the New Run History Status 

GET   /api/3.0/fo/scan/schedules/runhistory/ 

DTD or XSD changes: Yes 

You can now retrieve the latest execution status for one or more scheduled scans, helping you monitor and track their activity in real time. The response includes only the latest run record for each requested schedule ID, rather than the complete run history, enabling faster, more efficient status checks. 

Use the new action=status parameter to retrieve the latest run status for a scheduled scan. 

The response includes the schedule name and ID, the current execution status, the launch date and time, the scan reference number, the next scheduled launch date, and a status message. 

Both XML and JSON output formats are supported. 

This action requires the Manager, Unit Manager, or Scanner role. 

View Scanner Appliance Hardware Resource Specifications at a Glance 

GET  /api/2.0/fo/appliance/, /api/3.0/fo/appliance/ 

DTD or XSD changes: Yes 

You can now retrieve hardware resource information for scanner appliances using the Scanner Appliance API. This enhancement enables you to access scanner resource details and better understand appliance sizing and capacity. 

The API response now includes the HW_CPU_NUM_VCPUS (total vCPUs), HW_MEM_MEMTOTAL_GB (total memory in GiB), HW_MEM_SWAPTOTAL_GB (total swap in GiB), and HW_DISK_SIZE_GB (total disk in GiB) elements. 

These elements are returned when the output_mode input parameter is set to full. If hardware data is unavailable, the elements are returned empty. 

Retrieve Scanner Platform Versions and End of Support Status for Scanner Appliances 

GET  /api/3.0/fo/appliance/ 

DTD or XSD changes: Yes 

You can now determine whether a scanner platform version has reached End of Support (EOS) through the Scanner Appliance API. This enhancement adds EOS status information to scanner appliance responses, enabling automation and inventory management processes to identify scanner appliances that may require upgrades. 

The SOFTWARE_VERSION element in the API response now includes an eos attribute. 

eos=”yes” indicates the scanner platform version is approaching End of Support; eos=”no” indicates the version is currently supported.

Download Saved Report API: Get Ticket Deadline and Policy Title in Host Based Reports 

GET, POST  /api/3.0/fo/report/ 

DTD or XSD changes: Yes 

You can now retrieve the remediation ticket deadline and remediation policy title directly in the Host Based XML report response, along with the existing ticket number and ticket state. This enhancement lets you retrieve complete remediation ticket context, status, deadline, and policy in a single report response. 

The Host Based XML report response now includes the optional TICKET_DEADLINE element (the due date assigned by the remediation policy). 

The response also includes the optional REMEDIATION_POLICY_TITLE element (the name of the policy rule that generated or last updated the ticket). 

A Vulnerability Management Reporting Service (VMRS) enabled subscription is required.

Change Login Password API: Password Validation Now Aligned with UI

POST  /api/2.0/fo/user/change_password/ 

DTD or XSD changes: No 

Password validation is now aligned across the Qualys UI and the Change Password API. This enhancement ensures passwords created or updated through the API use the same supported character set as UI-based password workflows, providing a consistent authentication experience across both interfaces. 

You can now change your password through this API using a character set identical to the UI. 

If the password contains an unsupported whitespace character (such as a space, tab, or newline), the API returns a specific message stating this. 

If the password contains any other unsupported character, the API returns a message listing the supported password requirements.

For more details, please refer to the release notes here: https://docs.qualys.com/en/vm/release-notes/qweb/release_10_40_api.htm