> ## Documentation Index
> Fetch the complete documentation index at: https://docs.serval.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Qualys

> Connect Serval to the Qualys VM/PC API to read vulnerability data, manage scans, and work with reports and assets.

## About Qualys

The Qualys integration lets Serval workflows work with your Qualys Vulnerability
Management subscription through the VM/PC v2 API: per-host vulnerability
detections, the vulnerability KnowledgeBase, VM scans, scan schedules, reports,
asset groups, and asset IPs. Qualys's XML responses are converted to JSON
automatically.

**Authentication:** A Qualys username and password. Serval stores the
credentials securely and sends them (HTTP Basic) only to the API server of the
platform you select.

**Access level:** You choose what Serval may do when you connect — and Serval
enforces it server-side on every request:

* **Read-only** — list and fetch data only.
* **Scanner** — read, plus launch and manage scans and reports.
* **Full** — read, scan, and manage assets (asset groups and asset IPs).

**Data sync:** On demand. Serval reads data from Qualys when a workflow runs
and does not perform a background sync.

## Create a Qualys API user

<Steps>
  <Step title="Check API access">
    Your Qualys subscription must include API access (most VMDR subscriptions
    do). Contact your Technical Account Manager if API calls return an access
    error.
  </Step>

  <Step title="Create a dedicated user">
    In Qualys, open **Users**, then create a user dedicated to Serval. A
    **Reader** role is sufficient for the Read-only access level; use a
    **Scanner** role if Serval should launch scans, or **Manager** for full
    asset management.
  </Step>

  <Step title="Confirm the platform">
    Note your platform (shown under **Help > About** in the Qualys UI, e.g.
    US Platform 2) — you will select it in Serval.
  </Step>
</Steps>

## Connect in Serval

<Steps>
  <Step title="Name the connection">Enter a recognizable instance name, such as Production.</Step>

  <Step title="Select the platform">
    Choose the Qualys platform where your subscription is hosted. Serval only
    sends credentials to that platform's published API server.
  </Step>

  <Step title="Enter the credentials">Enter the API user's username and password.</Step>

  <Step title="Choose the access level">
    Select Read-only, Scanner, or Full. Serval blocks any request beyond the
    selected level before credentials are attached, regardless of the Qualys
    user's own permissions.
  </Step>
</Steps>

## Verify the connection

Serval checks that it can list host assets, VM scans, and reports, and read the
vulnerability KnowledgeBase. A failed check normally means the credentials are
invalid, the wrong platform was selected, or the Qualys user lacks the
corresponding permission or module.

<Note>
  Qualys enforces per-subscription API rate and concurrency limits and returns
  Retry-After headers when they are exceeded; Serval honors these
  automatically. Large detection queries should use the truncation\_limit
  parameter — Serval follows the pagination URL Qualys returns.
</Note>

***

Need help? Contact **[support@serval.com](mailto:support@serval.com)** for assistance with your Qualys integration.