API requirements for Qualys

Qualys API requirements

The Qualys API enforces limits on the API calls a customer can make based on their subscription settings. The limits apply to the use of all Qualys APIs except “session” V2 API (session login/logout). Default API control settings are provided by the service. Note these settings may be customized per subscription by Qualys Support.

For more details, refer to the link: https://www.qualys.com/docs/qualys-api-limits.pdf.

To estimate the number of API calls, use the below formula: 
Total number of API calls = (number of devices / batch size ) + (number of unique vulnerabilities / 350)

where;

  • batch size - configurable parameter that describes the maximum number of devices which can be fetched in a single API call
  • number of devices - number of available devices in the scanned network
  • number of unique vulnerabilities - number of unique vulnerabilities discovered in the scanned network
  • 350 - maximum number of vulnerabilities that can be fetched in a single API call into the Qualys Knowledge Base API.

Qualys API User requirements

It is recommended to use 'Reader' user role. To edit user account, select Users tab in the Vulnerability Management dashboard. Hover the cursor over the Login and click Edit.

In the User Role tab, select Reader as a user role and Allow access to API.

In the Asset Groups tab, you can select asset groups that you wish to have access to.

For more information on how to assign asset groups to the user, refer to the link.

In the Permissions tab select Manage VM module.

Refer to the link to find more information on User roles and permissions.