/api/2.0/fo/auth/<web app server}/
where {web app server} is one of apache, ms_iis, ibm_websphere, tomcat
[POST]
Create, update, list and delete application server records for authenticated scans of web application servers. Application Server records are used to authenticate to various web app servers.
Instance discovery and auto record creation is supported for Apache Web Server, IBM WebSphere, JBoss, Tomcat and Oracle. Learn more about instance discovery and auto record creation in online help (log in to your Qualys account, go to Help > Online Help and search for System Authentication Records).
API URL (/api/2.0/fo...) |
Supported Versions |
/auth/apache/ |
- Apache HTTP Server 2.2 and 2.4 - IBM HTTP Server 7.x, 8.x and 9.x - VMware vFabric Web Server 5.x - Pivotal Web Server 6.x Compliance scans are supported (using PC) |
/auth/ms_iis/ |
MS IIS 6.0, 7.x, 8.x and 10 for Windows Compliance scans are supported (using PC) |
/auth/ibm_websphere/ |
IBM WebSphere Application Server 7.x, 8.x and 9.x Compliance scans are supported (using PC) |
/auth/tomcat/ |
Windows: - Apache Tomcat 7.x, 8.x and 9.x Unix: - Apache Tomcat 6.x, 7.x, 8.x and 9.x - VMware vFabric tc Server 2.9.x - Pivotal tc Server 3.x Vulnerability and Compliance scans are supported (using VM, PC) |
Parameter |
Description |
action={action} |
(Required) Specify create, update, delete or list. See List Auth Records for type |
echo_request={0|1} |
(Optional) Specify 1 to view (echo) input parameters in the XML output. By default these are not included. |
ids={value} |
(Required to update or delete record) Record IDs to update/delete. Specify record IDs and/or ID ranges (for example, 1359-1407). Multiple entries are comma separated. |
title={value} |
(Required for create) The title of the Server record. The title must be unique and may include a maximum of 255 characters (ascii). |
comments={value} |
(Optional) User defined notes about the Server record. The comments may include a maximum of 1999 characters (ascii); if comments have 2000 or more characters an error is returned and comments are not saved. Tags (such as <script>) cannot be included; if tags are included an error is returned and the request fails. |
Application Server |
|
unix_apache_config_file={value} |
(Required to create an Apache Web Server record; valid only for this record). The path to the Apache configuration file. |
unix_apache_control_command={value} |
(Required to create an Apache Web Server record; valid only for this record) The path to the Apache control command. For IBM HTTP Server, enter the path to the IBM HTTP Server “bin” directory or the specific location of “apachectl”. For VMware vFabric Web Server, enter the path to the VMware vFabric global “bin” directory or the specific location of “httpdctl” for a web server instance. |
windows_apache_config_file ={value} |
(Required to create Apache HTTP and IBM HTTP server records; valid only for this record). The Windows path to the Apache HTTP and IBM HTTP server configuration file. |
windows_apache_control_command= {value} |
(Required to create Apache HTTP and IBM HTTP server records; valid only for this record) The Windows path to the Apache HTTP and IBM HTTP server control command. For IBM HTTP Server, enter the path to the IBM HTTP Server “bin” directory or the specific location of “apachectl”. |
unix_installation_dir={value} |
(Required to create an IBM WebSphere App Server record; valid only for this record) The directory where the WebSphere application is installed. |
unix_dir_mode={value} |
(Optional for IBM WebSphere App Server record, valid only for this record) The Unix directory mode. Valid values are installation_dir (for installation directory) and server_dir (for server directory). When not specified, installation_dir is used. |
windows_installation_dir={value} |
(Required to create an IBM WebSphere App Server record; valid only for this record) The Windows directory where the WebSphere application is installed. |
installation_path={value} |
(Required to create Tomcat Server record; valid only for this record) The directory where the tomcat server is installed. Examples: /opt/apache-tomcat-7.0.57 (e.g. $CATALINA_HOME) /opt/vmware/vfabric-tc-server-standard /opt/pivotal/pivotal-tc-server-standard |
instance_path={value} |
(Optional to create or update Tomcat Server record; valid only for this record) The directory where the tomcat server instance(s) are installed. You can specify a single tomcat instance (use with auto_discover_instances=0), or multiple instances (use with auto_discover_instances=1). Leave unspecified when the instance directory is the same as the installation directory or when your targets have different types of tomcat servers. Examples: /opt/apache-tomcat-7.0.57 (e.g. $CATALINA_BASE) /opt/vmware/vfabric-tc-server-standard/tc1 /opt/pivotal/pivotal-tc-server-standard/tc1 |
auto_discover_instances={0|1} |
(Optional to create or update Tomcat Server record; valid only for this record) Specify auto_discover_instances=1 and we’ll find all tomcat server instances for you. Applies to VMware vFabric and Pivotal when you’ve specified a directory with multiple instances or you did not specify an instance. When unspecified (auto_discover_instances=0), we will not auto discover instances. Applies to Apache Tomcat or when you’ve specified a single instance. |
installation_path_windows |
(Required to create Tomcat Server record on Windows; valid only for this record) The directory where the tomcat server is installed. Example: C:\tomcat\apache-tomcat-8.5.11 |
instance_path_windows |
(Optional to create or update Tomcat Server record on UNIX; valid only for this record) The directory where the tomcat server instance(s) are installed. Example: C:\tomcat\apache-tomcat-8.5.11 |
service_name |
(Optional) The Tomcat service name that identifies the server instance to be authenticated to. |
Apache Server only |
|
status={0|1} |
(Optional to list, create, update Apache records) For list request (action set to list) - By default active and inactive auth records are listed. Set to 0 to list only inactive records or set to 1 to list only active records. For create/update request (action set to create or update) - By default a new record is set to active (1). Set to 0 for inactive record, or 1 for active record. For update action, this parameter is valid only when user created records are specified in the request. |
is_system_created={0|1} |
(Optional to list Apache records) By default user created records and system created auth records are listed. Set to 0 to list only user created records, or set to 1 to list only system created records. |
Target Hosts |
|
ips={value} |
(Required to create record) Add IP addresses of the hosts you want to scan using this record. |
add_ips={value} |
(Optional and valid only to update record) Add IP address(es) to the IP list for an existing record. You may enter a combination of IPs and IP ranges. Multiple entries are comma separated. |
remove_ips={value} |
(Optional and valid only to update record) IPs to be removed from your record. You may enter a combination of IPs and ranges. Multiple entries are comma separated. |
network_id={value} |
(Optional to create or update record, and valid when the networks feature is enabled) The network ID for the record. |
API request
curl -u "USERNAME:PASSWORD" -H "X-Requested-With: Curl" -X "POST" -d "action=create&title=Apache+Record&unix_apache_config_file=/opt/IBM/HTTPServer/conf/httpd.conf1&unix_apache_control_command=/opt/IBM/HTTPServer/bin2&ips=10.10.25.25" "https://qualysapi.qualys.com/api/2.0/fo/auth/apache/"
API request
curl -u "USERNAME:PASSWORD" -H "X-Requested-With: Curl" -X "POST" -d "action=update&ids=1234&unix_apache_config_file=/opt/IBM/HTTPServer/conf/httpd.conf2" "https://qualysapi.qualys.com/api/2.0/fo/auth/apache/"
<platform API server>/api/2.0/batch_return.dtd
<platform API server>/api/2.0/fo/auth/apache/auth_apache_list_output.dtd
<platform API server>/api/2.0/fo/auth/ms_iis/auth_ms_iis_list_output.dtd
<platform API server>/api/2.0/fo/auth/ibm_websphere/auth_ibm_websphere_list_output.dtd
<platform API server>/api/2.0/fo/auth/tomcat./auth_tomcat_list_output.dtd