| List Assets | Search for assets in the Qualys inventory using the Gateway asset search API. Supports keyset cursor pagination and field selection. |
| Get Asset | Retrieve a single asset by ID from the Qualys inventory using the Gateway asset search API. |
| Sync Asset | Import third-party assets into Qualys by pushing data through the Gateway connector sync endpoint. Provide the connector metadata (including the Connector UUID from the Qualys Connectors UI) and an array of asset objects with identity and core attributes. Qualys runs identification rules to match or create each asset. |
| List Asset Risk Data | Retrieve TruRisk scores, vulnerability counts, and derived risk bands from the Classic VM host list API. This is the only source for TruRisk data — the modern Gateway asset API does not return vulnerability information. Returns the VM (Classic) TruRisk score, not the CSAM figure. |
| List Tags | Search for tags in Qualys using the Asset Management & Tagging (QPS) API. |
| Create Tag | Create a new tag in Qualys using the Asset Management & Tagging (QPS) API. |
| Update Tag | Update an existing tag in Qualys. This is a partial update — only provided fields are changed; omitted fields are left untouched. |
| Update Asset Tags | Add or remove tags on an asset. Consolidates assign and remove into one action. Static tags only — Qualys rejects dynamic tags. When changing a value-bearing tag (e.g., LS:DomainRole=X), remove the old tag before adding the new one to avoid stale entries. |
| Launch VM Scan | Launch a vulnerability management scan against asset groups or tags. Asynchronous — returns a scan reference immediately, not results. Use List Scans to track status. Requires an existing scan option profile and at least one online scanner appliance or Cloud Agent scoped to the targets. |
| List Scans | List VM scans from the Classic API. This is the only way to check a launched scan's status — there is no dedicated status endpoint. |
| List Remediation Tickets | List remediation tickets from the Classic API. Maximum 1,000 tickets per call — the API truncates silently beyond that limit. The response includes a truncation flag so callers can detect incomplete results. |
| Get Remediation Ticket Info | Retrieve detailed information for specific remediation tickets by ticket number or by last-modified timestamp. |
| Edit Remediation Tickets | Bulk-edit remediation tickets: reassign, change state, or add comments. Up to 20,000 tickets per call. Requires Manager or Unit Manager role — Scanner or Reader credentials silently fail to act on tickets outside the caller's own account. |
| Delete Remediation Tickets | Bulk-delete remediation tickets by filter. Defaults to dry-run mode — set Dry Run to false to perform the actual deletion. Up to 20,000 tickets per call. Requires Manager or Unit Manager role. There is no undo. |
| Raw Request | Send a raw HTTP request to the Qualys API. Select the API plane (Gateway or Classic) since they differ in host, authentication, and content type. |
