API keys

Download AsyncAPI spec

Events emitted when API keys are created, updated, deleted, or validated in a Qlik Cloud tenant. These events enable tracking of API key lifecycle for security and access management.

These events are available for consumption via:

Deprecation notice

These events are deprecated and will be removed on or after November 30, 2026.

Use the API keys events in the core namespace instead. One exception: com.qlik.api-key.validated has no namespaced replacement. For the full event mapping, see the deprecation notice.

API key created

Published when an API key is created.

Payload

object
  • id string
    Required

    Identifies the event.

    minLength = 1

  • time string

    Timestamp of when the occurrence happened. Must adhere to RFC 3339.

    minLength = 1, format = "date-time"

  • type string
    Required

    Unique identifier for the event type.

    default = "com.qlik.api-key.created"

  • source string
    Required

    Identifies the context in which an event happened.

    minLength = 1, format = "uri-reference"

  • specversion string
    Required

    The version of the CloudEvents specification which the event uses.

    minLength = 1

  • datacontenttype string

    Content type of the data value. Must adhere to RFC 2046 format.

    minLength = 1

  • userid string

    Unique identifier for the user triggering the event.

  • originip string

    Origin IP address.

  • tenantid string
    Required

    Unique identifier for the tenant related to the event.

  • sessionid string

    Unique identifier for the session related to the event.

  • data object
    Show data properties
    • id string
      Required

      API key identifier.

    • sub string
      Required

      Subject identifier.

    • subType string
      Required

      Subject type.

    • description string
      Required

      API key description.

    • expiry string
      Required

      API key expiry date.

com.qlik.api-key.created

Example payload of the "API key created" event

{
  "id": "A234-1234-1234",
  "time": "2018-10-30T07:06:22Z",
  "type": "com.qlik.api-key.created",
  "source": "com.qlik/my-service",
  "specversion": "1.0",
  "datacontenttype": "string",
  "userid": "VZhiEfgW2bLd7HgR-jjzAh6VnicipweT",
  "originip": "0.0.0.0",
  "tenantid": "VZhiEfgW2bLd7HgR-jjzAh6VnicipweT",
  "sessionid": "VZhiEfgW2bLd7HgR-jjzAh6VnicipweT",
  "data": {
    "id": "id123",
    "sub": "id123",
    "subType": "user",
    "description": "description text for the key",
    "expiry": "2025-11-08T20:43:24.130Z"
  }
}

API key deleted

Published when an API key is deleted.

Payload

object
  • id string
    Required

    Identifies the event.

    minLength = 1

  • time string

    Timestamp of when the occurrence happened. Must adhere to RFC 3339.

    minLength = 1, format = "date-time"

  • type string
    Required

    Unique identifier for the event type.

    default = "com.qlik.api-key.deleted"

  • source string
    Required

    Identifies the context in which an event happened.

    minLength = 1, format = "uri-reference"

  • specversion string
    Required

    The version of the CloudEvents specification which the event uses.

    minLength = 1

  • datacontenttype string

    Content type of the data value. Must adhere to RFC 2046 format.

    minLength = 1

  • userid string

    Unique identifier for the user triggering the event.

  • originip string

    Origin IP address.

  • tenantid string
    Required

    Unique identifier for the tenant related to the event.

  • sessionid string

    Unique identifier for the session related to the event.

  • data object
    Show data properties
    • id string
      Required

      API key identifier.

    • sub string
      Required

      Subject identifier.

    • subType string
      Required

      Subject type.

    • description string
      Required

      API key description.

    • expiry string
      Required

      API key expiry date.

    • status string
      Required

      Status of the API key. Set to deleted when triggered by the owner, or revoked when triggered by a tenant admin.

com.qlik.api-key.deleted

Example payload of the "API key deleted" event

{
  "id": "A234-1234-1234",
  "time": "2018-10-30T07:06:22Z",
  "type": "com.qlik.api-key.deleted",
  "source": "com.qlik/my-service",
  "specversion": "1.0",
  "datacontenttype": "string",
  "userid": "VZhiEfgW2bLd7HgR-jjzAh6VnicipweT",
  "originip": "0.0.0.0",
  "tenantid": "VZhiEfgW2bLd7HgR-jjzAh6VnicipweT",
  "sessionid": "VZhiEfgW2bLd7HgR-jjzAh6VnicipweT",
  "data": {
    "id": "id123",
    "sub": "id123",
    "subType": "user",
    "description": "description text for the key",
    "expiry": "2025-11-08T20:43:24.130Z",
    "status": "deleted"
  }
}

API key updated

Published when an API key is updated.

Payload

object
  • id string
    Required

    Identifies the event.

    minLength = 1

  • time string

    Timestamp of when the occurrence happened. Must adhere to RFC 3339.

    minLength = 1, format = "date-time"

  • type string
    Required

    Unique identifier for the event type.

    default = "com.qlik.api-key.updated"

  • source string
    Required

    Identifies the context in which an event happened.

    minLength = 1, format = "uri-reference"

  • specversion string
    Required

    The version of the CloudEvents specification which the event uses.

    minLength = 1

  • datacontenttype string

    Content type of the data value. Must adhere to RFC 2046 format.

    minLength = 1

  • userid string

    Unique identifier for the user triggering the event.

  • originip string

    Origin IP address.

  • tenantid string
    Required

    Unique identifier for the tenant related to the event.

  • sessionid string

    Unique identifier for the session related to the event.

  • data object
    Show data properties
    • id string
      Required

      API key identifier.

    • sub string
      Required

      Subject identifier.

    • subType string
      Required

      Subject type.

    • description string
      Required

      API key description.

    • expiry string
      Required

      API key expiry date.

com.qlik.api-key.updated

Example payload of the "API key updated" event

{
  "id": "A234-1234-1234",
  "time": "2018-10-30T07:06:22Z",
  "type": "com.qlik.api-key.updated",
  "source": "com.qlik/my-service",
  "specversion": "1.0",
  "datacontenttype": "string",
  "userid": "VZhiEfgW2bLd7HgR-jjzAh6VnicipweT",
  "originip": "0.0.0.0",
  "tenantid": "VZhiEfgW2bLd7HgR-jjzAh6VnicipweT",
  "sessionid": "VZhiEfgW2bLd7HgR-jjzAh6VnicipweT",
  "data": {
    "id": "id123",
    "sub": "id123",
    "subType": "user",
    "description": "description text for the key",
    "expiry": "2025-11-08T20:43:24.130Z"
  }
}

API key validated

Published when an API key is validated.

Payload

object
  • id string
    Required

    Identifies the event.

    minLength = 1

  • time string

    Timestamp of when the occurrence happened. Must adhere to RFC 3339.

    minLength = 1, format = "date-time"

  • type string
    Required

    Unique identifier for the event type.

    default = "com.qlik.api-key.validated"

  • source string
    Required

    Identifies the context in which an event happened.

    minLength = 1, format = "uri-reference"

  • specversion string
    Required

    The version of the CloudEvents specification which the event uses.

    minLength = 1

  • datacontenttype string

    Content type of the data value. Must adhere to RFC 2046 format.

    minLength = 1

  • userid string

    Unique identifier for the user triggering the event.

  • originip string

    Origin IP address.

  • tenantid string
    Required

    Unique identifier for the tenant related to the event.

  • sessionid string

    Unique identifier for the session related to the event.

  • data object
    Show data properties
    • id string
      Required

      API key identifier.

    • sub string
      Required

      Subject identifier.

    • subType string
      Required

      Subject type.

    • description string
      Required

      API key description.

    • tenantId string
      Required

      API key tenant identifier.

    • createdByUser string
      Required

      Identifier of the user who created the key.

com.qlik.api-key.validated

Example payload of the "API key validated" event

{
  "id": "A234-1234-1234",
  "time": "2018-10-30T07:06:22Z",
  "type": "com.qlik.api-key.validated",
  "source": "com.qlik/my-service",
  "specversion": "1.0",
  "datacontenttype": "string",
  "userid": "VZhiEfgW2bLd7HgR-jjzAh6VnicipweT",
  "originip": "0.0.0.0",
  "tenantid": "VZhiEfgW2bLd7HgR-jjzAh6VnicipweT",
  "sessionid": "VZhiEfgW2bLd7HgR-jjzAh6VnicipweT",
  "data": {
    "id": "id123",
    "sub": "id123",
    "subType": "user",
    "description": "description text for the key",
    "tenantId": "id123",
    "createdByUser": "id123"
  }
}

API key validation failed

Published when API key validation fails. Only published for externalClient API keys.

Payload

object
  • id string
    Required

    Identifies the event.

    minLength = 1

  • time string

    Timestamp of when the occurrence happened. Must adhere to RFC 3339.

    minLength = 1, format = "date-time"

  • type string
    Required

    Unique identifier for the event type.

    default = "com.qlik.v1.api-key.validation.failed"

  • source string
    Required

    Identifies the context in which an event happened.

    minLength = 1, format = "uri-reference"

  • specversion string
    Required

    The version of the CloudEvents specification which the event uses.

    minLength = 1

  • datacontenttype string

    Content type of the data value. Must adhere to RFC 2046 format.

    minLength = 1

  • userid string

    Unique identifier for the user triggering the event.

  • originip string

    Origin IP address.

  • tenantid string
    Required

    Unique identifier for the tenant related to the event.

  • sessionid string

    Unique identifier for the session related to the event.

  • data object
    Show data properties
    • id string
      Required

      API key identifier.

    • sub string
      Required

      Subject identifier.

    • subType string
      Required

      API key subType.

    • description string
      Required

      Error description.

    • jti string
      Required

      API key identifier.

    • code string
      Required

      Error code.

    • idpId string

      Identity provider identifier tied to the externalClient.

    • createdByUser string

      Identifier of the user who created the key.
  • toplevelresourceid string

    API key identifier.

com.qlik.v1.api-key.validation.failed

Example payload of the "API key validation failed" event

{
  "id": "A234-1234-1234",
  "time": "2018-10-30T07:06:22Z",
  "type": "com.qlik.v1.api-key.validation.failed",
  "source": "com.qlik/my-service",
  "specversion": "1.0",
  "datacontenttype": "string",
  "userid": "VZhiEfgW2bLd7HgR-jjzAh6VnicipweT",
  "originip": "0.0.0.0",
  "tenantid": "VZhiEfgW2bLd7HgR-jjzAh6VnicipweT",
  "sessionid": "VZhiEfgW2bLd7HgR-jjzAh6VnicipweT",
  "data": {
    "id": "id123",
    "sub": "id123",
    "subType": "externalClient",
    "description": "The api key is either expired or revoked",
    "jti": "1fc531f9-1964-46d6-9267-256e707fac45",
    "code": "APIKEYS-18",
    "idpId": "62eaddcce5ff30cabc6f67e8",
    "createdByUser": "62eadf5a01f72ccd31f37041"
  },
  "toplevelresourceid": "1fc531f9-1964-46d6-9267-256e707fac45"
}