wif.tax

Qualys

C Qualys Cloud Platform APIs (VMDR, TotalCloud, CSAM and other modules)

Workloads reach Qualys APIs with a user's password or a Qualys-issued client ID and secret, each traded for a 4-hour JWT. Qualys Support can switch on IdP token auth that trusts your issuer's JWTs, but it is not self-serve, is documented for user logins and skips Web Application Scanning, so it does not count yet. Into your cloud it is keyless on AWS only; Azure, GCP and OCI connectors take a client secret or private key.

Docs: docs.qualys.com · Checked 2026-10-22 · source YAML · dispute via PR

Inbound C

How a workload running anywhere authenticates to this product.

Qualys-managed user-level or subscription-level client ID and client secret posted to /auth/oauth or /auth/oidc for a 4-hour JWT; the default paths are the user's username and password (basic auth, session cookie, or POST /auth for a 4-hour JWT). IdP Provider Tokens (Support-enabled trust of your own issuer) exist but do not count; see notes.

Graded C on Qualys-managed client credentials, short-lived tokens from a static root. Qualys also documents IdP Provider Tokens: you supply the issuer's JWKS URL (or certificates), issuer and audience, and a token whose sub (or a custom claim) equals a Qualys user's External ID is accepted as a Bearer token. On paper that has issuer, audience and subject constraints. It does not earn A or B under the wif.tax rule that federation must be self-serve and documented for workloads: activation is a Qualys Support ticket, the docs frame it around corporate IdPs for user authentication ("IdP is used for user authentication"), whether CI or cloud workload tokens work with it is not publicly verifiable, and Total AppSec/WAS, PCI and "Qualys API Integrations" are still "To be announced". Enabling it also does not switch off passwords. Same call as zscaler-oneapi, whose legacy ZIA API can trust one external OAuth server. Moves to A if Qualys makes IdP token trust self-serve and documents it for workload issuers across all modules.

Outbound Brequires GCP Workload Identity Federation is beta and enabled by TAM or Qualys Support

How this product reaches into your cloud, repos, or other SaaS.

TotalCloud/AssetView AWS connectors assume a cross-account IAM role you create with an external ID. Azure connectors take an App registration client secret (docs recommend "Never" expiry), GCP connectors take an uploaded service-account JSON key (or, in beta, WIF bootstrapped by an Entra ID or Okta client secret you hand Qualys), and OCI connectors take a user API private key.

Checked the TotalCloud/AssetView cloud connectors (shared with CSAM and ETM): AWS (cross-account role with external ID via a Qualys CloudFormation template; keyless), Azure subscription and tenant connectors (Application ID, Directory ID and an "Authentication Key" client secret, with the docs recommending a never-expiring secret; Reader or a listed custom-role permission set is documented), GCP individual and organization connectors (service-account JSON key upload, Viewer/Security Reviewer roles documented), and OCI (user OCID plus API signing private key and fingerprint). GCP Workload Identity Federation (beta) removes the JSON key, but the token comes from an Entra ID or Okta app whose client ID and secret you enter in TotalCloud's Identity Provider Configurations, so it is short-lived from a static root you hand over (C), not keyless. AWS keyless plus static keys elsewhere is B. Ticketing, SIEM and container-registry integrations were not graded here. Would rise to A if Azure accepted admin consent to a Qualys multi-tenant app or a federated credential, and GCP used impersonation by Qualys's own Google identity.

Hygiene for any static credential the product still issues

✓ Expiry enforceable
The credential workloads use by default is a Qualys user's password, and a Manager can enforce "Password expires after N months" for every user in the subscription, which is an org policy that forces expiry (unlike the changeable-default fails on elastic-cloud-api and cloudflare-api). The escape hatch, "Password never expires for API access", has to be activated by Qualys Support or the TAM and accepted by the Manager POC under a risk agreement, so the org controls it. Not documented: any expiry or lifetime limit on Qualys-managed client secrets, which would fail this check on their own.
  • docs.qualys.com checked 2026-10-22
    “Select the password security settings you want to enforce for all users in the subscription.”
  • docs.qualys.com checked 2026-10-22
    “Here you can define how often users will need to change their password.”
  • docs.qualys.com checked 2026-10-22
    “Set the password of such API-only access accounts to never expire.”
✓ Rotation via API
/msp/user.php creates and edits API users and /msp/password_change.php (Manager or Unit Manager) or /api/2.0/fo/user/change_password/ (self) rotates passwords, so password rotation can be scripted. No API for creating or revoking Qualys-managed client secrets is documented; those are managed in the UI's Auth ID Client Management.
  • docs.qualys.com checked 2026-10-22
    “Change passwords for all or some users in the same subscription.”
  • docs.qualys.com checked 2026-10-22
    “To change a Qualys user password using the API, send a POST request to /api/2.0/fo/user/change_password/index.php with the required headers, authenticate using your username and password, and include the new password in the JSON request body using the newPassword key.”
  • docs.qualys.com checked 2026-10-22
    “Add a user account to the API user's subscription.”
✓ Scoped keys
The usual pattern is a dedicated API user (Reader or Scanner role, limited asset groups, API access granted per module), a purpose-built machine principal with its own role, which the rubric counts. Qualys-managed clients also take per-application permissions. Manager API users get everything.
  • docs.qualys.com checked 2026-10-22
    “Specifies the asset groups assigned to the user, when the user role is Scanner, Reader or Contact.”
  • docs.qualys.com checked 2026-10-22
    “Navigate to Roles and Scopes and enable the API Access checkbox.”
  • docs.qualys.com checked 2026-10-22
    “Assign required application permissions for the user-level client.”
✗ Last-used visible
LAST_LOGIN_DATE on the user list is described as logins "into the service", and the activity log says login events are generated only for UI logins, so an API-only account's password use does not appear to be tracked there (not publicly verifiable either way). The Recent API Calls view lists API calls per user but defaults to the past week. No last-used field is documented for Qualys-managed clients. Judgment call: flips to pass if LAST_LOGIN_DATE is shown to include API authentications.
  • docs.qualys.com checked 2026-10-22
    “When the API request is made by a Manager or Unit Manager, the last login date for each user is provided in the XML results.”
  • docs.qualys.com checked 2026-10-22
    “The user logged-in event is generated only when the user logs in through the User Interface (UI), not for API logins.”
  • docs.qualys.com checked 2026-10-22
    “By default, we show you API calls in the past week that were submitted (by users) and/or updated (by our service).”
✗ Leak revocation
Qualys does not appear in GitHub's supported secret-scanning patterns table, partner or user. Passwords have no detectable format, and the Qualys-managed client secret has no listed pattern either.

Notes

One card for the Qualys Cloud Platform APIs: VMDR/Policy Audit (/api/2.0, /msp), the gateway APIs (CSAM, TotalCloud, Patch Management, Container Security, EDR and others) and the TotalCloud connectors. All modules share the same Qualys user accounts and authentication options, so they are not split. Inbound is A only because of the Support-enabled IdP Provider Tokens path; a subscription that has not asked for it is on username/password or client secrets (three of five hygiene checks pass, which would leave plain passwords at D). Hygiene describes the passwords and Qualys-managed client secrets that still exist. Outbound moves to A when Azure and GCP connectors stop needing a secret from you.

Badge

wif.tax grade C

[![wif.tax grade](https://wif.tax/badge/qualys-cloud-platform.svg)](https://wif.tax/p/qualys-cloud-platform/)