Why does the API call /api/2.0/fo/compliance/exception/?action=list&details=All not return HOST_ID? It is a required part of creating a Compliance Exception.
The call only returns the IP Address, Tracking Method, and Network. The IP Address can change so it isn't reliable. Without the HOST_ID there's no way to tie the Exception directly to an asset.
Also, the latest API doc, https://www.qualys.com/docs/qualys-api-vmpc-user-guide.pdf shows an example on page 520 that is supposed to be for Compliance Exceptions but is actually for Compliance Posture Info.