---
sourceDocument: Australia Security Management
sourceDocumentLink: https://servicenow-prod.fluidtopics.net/r/security-management

 Release :

    - australia

ft:locale :

    - en-US

ft:publication_title :

    - Australia Security Management

ft:clusterId :

    - security

bundleId :

    - security

workflow :

    - Technology


---

# REST messages

# Qualys REST messages {#ariaid-title1}

* Release version: Australia
* 
* Updated August 4, 2026
* 
* ![](https://www.servicenow.com/docs/portal-asset/ico-clock) 7 minutes to read

Summarize  
![AI sparkle icon](https://servicenow.com/docs/portal-asset/ai-sparkle-icon) Summarized using AI  
This content was generated using new OpenAI-powered functionality. Results are provided on an as is basis and are not guaranteed to be accurate or complete.  

## Summary of Qualys REST messages

Qualys REST messages enable ServiceNow integrations to communicate with the Qualys API for retrieving vulnerability, host detection, knowledge base, and ticket data.
From version 12.9.2 onwards, authentication supports Basic Authentication by default, with an option to switch to OAuth, though OAuth requires separate configuration.
These REST messages underpin various Qualys integrations within ServiceNow Security Operations and Unified Security Exposure Management.
Show full answer Show less  

## Key REST Messages and Parameters

* **Qualys Host Detection REST message:** Used to call the Host List Detection API, retrieving host detection data with parameters controlling output format (XML), pagination (truncationlimit), detection statuses, and filtering by detection change dates.
* **Qualys Host Detection Integration REST messages:** Updated to API version 5.0 from ServiceNow version 12.21.0. Parameters include options to return vulnerability sources, asset tags, cloud tags, host metadata, output format, truncation limits for pagination, statuses, and severity filters.
* **Qualys Host List Integration REST message:** Retrieves detailed host information with parameters for asset tags, cloud tags, metadata, pagination, and detail level per host.
* **Qualys Knowledge Base REST messages:** Two variants exist---Date Based and Backfill---both updated to API 5.0. They retrieve vulnerability data filtered by last modified dates or specific QID identifiers, allowing control over detail levels and data ranges for efficient synchronization.
* **Qualys Host Detection Pagination REST message:** Handles API pagination by fetching subsequent pages when provided by Qualys, ensuring complete data retrieval during initial or incremental pulls. This message is specialized and not intended for modification.
* **Qualys Tickets REST message:** Retrieves ticket information with parameters tracking last run date, last ticket number for pagination, and whether to include vulnerability details.

## Practical Implications for ServiceNow Customers

* The REST message parameters allow fine-tuned control over data retrieval volume, filtering, and output format, which helps optimize performance and data synchronization in large environments.
* Using appropriate pagination settings (e.g., truncationlimit values) balances system load and ensures reliable data pulls without timeouts.
* Authentication can be customized to fit organizational security requirements by configuring OAuth, but out-of-the-box uses Basic Authentication.
* Understanding parameter options like status filters, severity levels, and date ranges enables customers to tailor integrations to their operational needs, focusing on relevant vulnerability and host data.
* Modifications to certain specialized REST messages (e.g., pagination handlers) are discouraged to avoid integration failures.

## Expected Results

By leveraging these REST messages, ServiceNow customers can effectively integrate Qualys vulnerability and asset data into their security operations workflows, enabling continuous and granular visibility into asset vulnerabilities, host detections, and ticket statuses. This integration supports timely vulnerability management, accurate asset tracking, and streamlined security incident responses within the ServiceNow platform.  
Qualys REST messages are used to make calls to the Qualys API.

Starting with version 12.9.2 of Qualys, you can authenticate Qualys REST messages using either Basic Authentication or OAuth. By default, the Authentication method integration
parameter is configured to use Basic Authentication.

Setting the Authentication method parameter to OAuth only prevents the integration from applying Basic Authentication credentials to REST
messages. It doesn't configure OAuth authentication.

## Qualys Host Detection REST message

The Qualys Host Detection REST message makes the initial call to the Host List Detection API for the Qualys Host Detection Integration.  
{#qualys-rest-messages__table_v2g_x1q_dt__entry__3}

| Parameter Name | Value | Description |
|-|-|-|
| action | list | Indicates the type of operation requested. Required parameter. Changes aren't required. |
| output_format | XML | Sets the format of the report returned by Qualys. The various scripts and transforms assume XML, so changes to the value aren't recommended. |
| detection_processed_after | ${lastScanDate} | Shows only detections whose detection status changed after a certain date and time. For detections that have never changed, the date is applied to the last detection date. |
| truncation_limit | 500 | The number of hosts to retrieve data from, according to request. This parameter is used for pagination purposes. The default value is 500, but larger or smaller values can be used. Don't set at less than 100 since it significantly increases system load. Smaller values require more calls to the Qualys API and larger values result in larger result sets to process and potential data retrieval/processing timeouts. |
| status | New, Fixed, Active, Reopened | Detection statuses to retrieve from Qualys. The default is to retrieve all statuses. For large data pulls (often the initial pull of data), it can be beneficial to exclude Fixed statuses from this list. It's important to include the Fixed status when updating vulnerabilities already in the system. |
[Table 1. Qualys host detection REST message parameters]

{#qualys-rest-messages__table_v2g_x1q_dt}

## Qualys Host Detection Integration REST message {#qualys-rest-messages__section_xhn_ljw_l3c}

The Qualys Host Detection -- Standard REST message retrieves host detection data from Qualys.  
Starting with v12.21.0 of Qualys Integration for Security Operations and v30.3.0 of Unified Security Exposure Management, the API version has been updated to version 5.0.{#qualys-rest-messages__table_qz4_yjw_l3c__entry__3}

| Parameter Name | Value | Description |
|-|-|-|
| vuln_detection_source | 1 | Returns the vulnerability detection source in the response. |
| show_tags | ${showTag} | Displays asset tags associated with each host in the XML output. |
| show_cloud_tags | 1 | Returns cloud provider tags for each scanned host asset in the output. |
| host_metadata | all | Lists all assets (cloud and non-cloud) and the metadata output applicable for cloud assets. |
| action | ${action} | Action to list host detections. |
| output_format | ${outputFormat} | Specifies the format of the host detection list output. |
| truncation_limit | ${truncationLimit} | Specifies the maximum number of host records processed per request. |
| status | ${status} | Returns only hosts with one or more of these status values. |
| severities | ${severities} | Returns only detection records that have the specified severities. |
[Table 2. Qualys Host Detection Integration REST message parameters]

{#qualys-rest-messages__table_qz4_yjw_l3c}

## Qualys Comprehensive Host Detection Integration REST message {#qualys-rest-messages__section_o52_5kw_l3c}

The Qualys Host Detection - Standard REST message retrieves host detection data from Qualys.  
Starting with v12.21.0 of Qualys Integration for Security Operations and v30.3.0 of Unified Security Exposure Management, the API version has been updated to version 5.0.{#qualys-rest-messages__table_crq_4lw_l3c__entry__3}

| Parameter Name | Value | Description |
|-|-|-|
| vuln_detection_source | 1 | Returns the vulnerability detection source in the response. |
| show_tags | ${showTag} | Displays asset tags associated with each host in the XML output. |
| show_cloud_tags | 1 | Returns cloud provider tags for each scanned host asset in the output. |
| host_metadata | all | Lists all assets (cloud and non-cloud) and the metadata output applicable for cloud assets. |
| action | ${action} | Action to list host detections. |
| output_format | ${outputFormat} | Specifies the format of the host detection list output. |
| truncation_limit | ${truncationLimit} | Specifies the maximum number of host records processed per request. |
| status | ${status} | Returns only hosts with one or more of these status values. |
| severities | ${severities} | Returns only detection records that have the specified severities. |
[Table 3. Qualys Host Detection Integration REST message parameters]

{#qualys-rest-messages__table_crq_4lw_l3c}

## Qualys Host List Integration REST message {#qualys-rest-messages__section_ybp_vkw_l3c}

The Qualys Host Detection - Standard REST message retrieves host detection data from Qualys.  
Starting with v12.21.0 of Qualys Integration for Security Operations and v30.3.0 of Unified Security Exposure Management, the API version has been updated to version 5.0.{#qualys-rest-messages__table_rth_tlw_l3c__entry__3}

| Parameter Name | Value | Description |
|-|-|-|
| show_tags | ${showTag} | Displays asset tags associated with each host in the XML output. |
| show_cloud_tags | 1 | Returns cloud provider tags for each scanned host asset in the output. |
| host_metadata | all | Lists all assets (cloud and non-cloud) and the metadata output applicable for cloud assets. |
| action | ${action} | Action to list host detections. |
| truncation_limit | ${truncationLimit} | Specifies the maximum number of host records processed per request. |
| details | ${status} | Specifies the requested amount of host information for each host to be returned in the response. |
[Table 4. Qualys Host Detection Integration REST message parameters]

{#qualys-rest-messages__table_rth_tlw_l3c}

## Qualys Knowledge Base REST message {#qualys-rest-messages__section_d1r_wkw_l3c}

The Qualys Knowledge Base (Date Based) REST message retrieves vulnerability data from Qualys.  
Starting with v12.21.0 of Qualys Integration for Security Operations and v30.3.0 of Unified Security Exposure Management, the API version has been updated to version 5.0.{#qualys-rest-messages__table_nsw_smw_l3c__entry__3}

| Parameter Name | Value | Description |
|-|-|-|
| action | ${action} | Action to list host detections. |
| details | ${status} | Specifies the requested amount of host information for each host to be returned in the response. |
| last_modified_after | ${dateStart} | Filters the XML output to show only vulnerabilities last modified after a certain date and time. |
| last_modified_before | ${dateEnd} | Filters the XML output to show only vulnerabilities last modified before a certain date and time. |
[Table 5. Qualys Host Detection Integration REST message parameters]

{#qualys-rest-messages__table_nsw_smw_l3c}

## Qualys Knowledge Base (Backfill) REST message {#qualys-rest-messages__section_zpm_xkw_l3c}

The Qualys Knowledge Base (Backfill) REST message retrieves vulnerability backfill data from Qualys.  
Starting with v12.21.0 of Qualys Integration for Security Operations and v30.3.0 of Unified Security Exposure Management, the API version has been updated to version 5.0.{#qualys-rest-messages__table_r4g_dnw_l3c__entry__3}

| Parameter Name | Value | Description |
|-|-|-|
| action | ${action} | Action to list host detections. |
| details | ${status} | Specifies the requested amount of host information for each host to be returned in the response. |
| ids | ${qids} | Filters the XML output to include only vulnerabilities that have QID numbers matching the QID numbers specified. |
[Table 6. Qualys Host Detection Integration REST message parameters]

{#qualys-rest-messages__table_r4g_dnw_l3c}

## Qualys host detection pagination REST message

The Host Detection Pagination REST message handles pagination requests to the Host Detection API.

When the primary host detection runs, if the Qualys API provides a URL to fetch the next page of data, this REST message retrieves that additional data. This data is used by the Host Detection Pagination Handler.

Host detection pagination REST is a specialized REST message and isn't intended to be modified.

## Qualys knowledge base (backfill) REST message

The Qualys Knowledge Base (Backfill) REST message retrieves Qualys knowledge base data based on the last modified timestamp of the vulnerability data for the Qualys Knowledge Base integration.

Changes to the REST message method record impact the request made to Qualys to retrieve knowledge base information.

The following table shows the request parameters that are sent.  
{#qualys-rest-messages__table_v2g_x1q_du__entry__3}

| Parameter | Value | Description |
|-|-|-|
| action | list | Indicates the type of operation being requested. Required parameter. Changes aren't recommended. |
| details | All | Indicates the level of detail shown for vulnerabilities retrieved. Safe to modify as needed. |
| ids | ${qids} | Specifies which QIDs to retrieve from Qualys. Referenced in code. Modifications aren't recommended. |
[Table 7. Qualys knowledge base (backfill) REST message parameters]

{#qualys-rest-messages__table_v2g_x1q_du}

## Qualys knowledge base (date-based) REST message

The Qualys Knowledge Base (Date-Based) REST message is used to retrieve Qualys knowledge base data based on the last modified timestamp of the vulnerability data. This message is used by the Qualys Knowledge Base
integration.

Changes to the REST message method record impact the request made to Qualys to retrieve knowledge base information.

The following table shows the request parameters that are sent.  
{#qualys-rest-messages__table_v2g_x1q_dv__entry__3}

| Source Field | Target Field | Description |
|-|-|-|
| action | list | Indicates the type of operation requested. Required parameter. Changes aren't recommended. |
| details | All | Indicates the level of detail shown for vulnerabilities retrieved. Safe to modify as needed. |
| last_modified_after | ${dateStart} | Indicates when to start retrieving historical data. Used by code to determine both the start time and to assist with pagination. Modifications or removal isn't recommended. |
| last_modifiedbefore | ${dateEnd} | Indicates when to end retrieving historical data. Used by code to determine both the end time and to assist with pagination. Modifications or removal isn't recommended. |
[Table 8. Qualys knowledge base (date-based) REST message parameters]

{#qualys-rest-messages__table_v2g_x1q_dv}

## Qualys tickets REST message

The Qualys tickets REST message retrieves Qualys ticket information for the Qualys Ticket Integration. Changes to the REST message method record impact the requests made to Qualys to retrieve ticket information.

The table shows the request parameters that are sent.  
{#qualys-rest-messages__table_v2g_x1q_dw__entry__3}

| Parameter Name | Value | Description |
|-|-|-|
| modified_since_datetime | ${lastRunDatetime} | Indicates the last run date of the integration and the date after which to pull data. Used by code. Changes aren't recommended. |
| since_ticket_number | ${lastTicketNumber} | Indicates which ticket was last retrieved from Qualys. Used for pagination. Changes aren't recommended. |
| show_vuln_details | 1 | Indicates whether the vulnerability details are retrieved. |
[Table 9. Qualys tickets REST message parameters]

{#qualys-rest-messages__table_v2g_x1q_dw}