Reset User Password
Reset passwords for all or some users in the same subscription. This API allows Managers, Administrators, Unit Managers to change passwords for multiple users at once as a "batch" process. New passwords are automatically generated by the service. This API does not support session based authentication.
It’s possible to reset passwords for user accounts with a status of ACTIVE, INACTIVE or PENDING ACTIVATION. It’s not possible to reset passwords for deleted accounts. Since Contact users do not have login access to Qualys, it’s not possible to reset passwords for Contacts.
A password reset API request returns a password change XML report indicating the user accounts affected and whether password resets were made for each account. A success message is included when passwords were reset on all target accounts. A warning message is included if passwords for any of the target accounts could not be reset. Upon error, an error message is included.
By default the password changes made by the password_change.php API causes the service to automatically send each affected user an email which notifies them of the password reset. If you do not wish users to receive this email notification, you have the option to return the user login ID and password for affected users as XML value pairs in the password reset report. To do this, make a password_change.php request and specify the email=0 parameter. If you make such a request on an account with the status “pending activation”, the function automatically assigns the “active” status since the login credentials are available in the XML report.
Permissions - Managers can reset passwords for all users in the subscription, except the user making the request. Unit Managers can reset the password for all users in a same business unit, except the user making the request. Administrator can reset password for all users and Managers in the subscription, except the user making the request.
Input ParametersInput Parameters
|
Parameter |
Required/Optional |
Data Type |
Description |
|---|---|---|---|
|
user_logins={value} |
Required |
Integer |
One or more Qualys user login IDs of user accounts to change the password for. Multiple user login IDs are comma separated. |
|
email={0|1} |
Optional |
Integer |
A flag that indicates whether users will receive an email notification alerting them to the password change. 1 - (default) When set to 1, an email notification will be sent to affected users. Each user clicks a secure link in the email to view the new password. 0 - When set to 0, an email notification will not be sent to affected users, and the XML report returned by the function will include the login ID and password for each user account as XML value pairs. If you make such a request on an account with the status “pending activation”, the API automatically assigns the “active” status since the login credentials are available in the XML report. |
Sample 1 - Reset Password Request, Send EmailSample 1 - Reset Password Request, Send Email
Password reset request for two accounts, send affected users an email notification including a secure link to their new password.
API Request
curl -k -s -S -H 'Requested-With:curl demo2' -u "john_d:Qxxxxxx#" "<quays_base_url>/msp/password_change.php?user_logins=fran_m,mike_fn&email=1"
API Response
<?xml version="1.0" encoding="UTF-8" ?>
<!DOCTYPE PASSWORD_CHANGE_OUTPUT SYSTEM "<qualys_base_url>/password_change_output.dtd">
<PASSWORD_CHANGE_OUTPUT>
<API name="password_change.php" username="john_d" at="2025-07-14T12:22:57Z" />
<RETURN status="SUCCESS">
<MESSAGE>The operation was successfully completed</MESSAGE>
<CHANGES count="2">
<USER_LIST>
<USER>
<USER_LOGIN>fran_m</USER_LOGIN>
</USER>
<USER>
<USER_LOGIN>mike_fn</USER_LOGIN>
</USER>
</USER_LIST>
</CHANGES>
</RETURN>
</PASSWORD_CHANGE_OUTPUT>
<!-- CONFIDENTIAL AND PROPRIETARY INFORMATION. Qualys provides it's Service "As Is,"
without any warranty of any kind. Qualys makes no warranty that the information
contained in this report is complete or error-free. Copyright 2025, Qualys, Inc. //-->Sample 2 - Reset Password Request, Return ReportSample 2 - Reset Password Request, Return Report
Password reset request for all users in the API user’s account (except the API user) and returns the login ID and password for each affected user in the password reset XML response.
API Request
curl -k -s -S -H 'Requested-With:curl demo2' -u "john_d:Qxxxxxx#" "<quays_base_url>/msp/password_change.php?user_logins=fran_m,mike_fn&email=0"
API Response
<?xml version="1.0" encoding="UTF-8" ?>
<!DOCTYPE PASSWORD_CHANGE_OUTPUT SYSTEM "
<quays_base_url>/password_change_output.dtd">
<PASSWORD_CHANGE_OUTPUT>
<API name="password_change.php" username="john_d" at="2025-07-14T12:23:11Z" />
<RETURN status="SUCCESS">
<MESSAGE>The operation was successfully completed</MESSAGE>
<CHANGES count="2">
<USER_LIST>
<USER>
<USER_LOGIN>fran_m</USER_LOGIN>
<PASSWORD>
<![xxxxxxxxx]]>
</PASSWORD>
</USER>
<USER>
<USER_LOGIN>mike_fn</USER_LOGIN>
<PASSWORD>
<!xxxxxxxx]]>
</PASSWORD>
</USER>
</USER_LIST>
</CHANGES>
</RETURN>
</PASSWORD_CHANGE_OUTPUT>
<!-- CONFIDENTIAL AND PROPRIETARY INFORMATION. Qualys provides it's Service "As
Is," without any warranty of any kind. Qualys makes no warranty that the information
contained in this report is complete or error-free. Copyright 2025, Qualys, Inc. //-->DTD
<platform API server>/password_change_output.dtd