OAuth clients

Download AsyncAPI spec

Events emitted when OAuth clients are created, updated, deleted, published, or when their secrets and connection configurations are modified. These events enable monitoring of OAuth client lifecycle and security configurations.

Preferred events

These events replace the legacy OAuth clients events. Use these events for all new implementations.

Published when a tenant admin approves an OAuth client.

Payload

object

id string

Required

Identifies the event.

minLength = 1
time string

Timestamp of when the occurrence happened. Must adhere to RFC 3339.

minLength = 1, format = "date-time"
type string

Required

Unique identifier for the event type.

default = "com.qlik.core.oauth-client.connection-config.approved"
source string

Required

Identifies the context in which an event happened.

minLength = 1, format = "uri-reference"
specversion string

Required

The version of the CloudEvents specification which the event uses.

minLength = 1
datacontenttype string

Content type of the data value. Must adhere to RFC 2046 format.

minLength = 1
userid string

Unique identifier for the user related to the event.
tenantid string

Required

Unique identifier for the tenant related to the event.
sessionid string

Unique identifier for the session related to the event.
data object

Full client connection config resource after the event was published.
Show data properties
- status string
  
  Status of the connection-config for the tenant.
- clientId string
  
  Required
  
  Identifier of the OAuth client the connection-config relates to.
- tenantId string
  
  Required
  
  Identifier of the tenant the connection-config relates to.
- createdAt string
  
  Required
  
  Timestamp when the connection-config was created.
  
  format = "date-time"
- updatedAt string
  
  Required
  
  Timestamp when the connection-config was updated.
  
  format = "date-time"
- consentMethod string
  
  Required
  
  Consent method for the connection-config.
  
  Can be one of: "required""trusted"

com.qlik.core.oauth-client.connection-config.approved

Example payload of the "OAuth client connection config approved" event

{
  "id": "A234-1234-1234",
  "time": "2026-04-05T17:31:00Z",
  "type": "com.qlik.core.oauth-client.connection-config.approved",
  "source": "com.qlik/my-service",
  "specversion": "1.0",
  "datacontenttype": "application/json",
  "userid": "id123",
  "tenantid": "id123",
  "sessionid": "id123",
  "data": {
    "status": "approved",
    "clientId": "000000000000000000000000",
    "tenantId": "00000000-0000-0000-0000-000000000000",
    "createdAt": "2026-10-30T07:06:22Z",
    "updatedAt": "2026-10-30T07:06:22Z",
    "consentMethod": "trusted"
  }
}

Published when a tenant admin revokes their access to another tenant's OAuth client by deleting the connection config.

Payload

object

id string

Required

Identifies the event.

minLength = 1
time string

Timestamp of when the occurrence happened. Must adhere to RFC 3339.

minLength = 1, format = "date-time"
type string

Required

Unique identifier for the event type.

default = "com.qlik.core.oauth-client.connection-config.deleted"
source string

Required

Identifies the context in which an event happened.

minLength = 1, format = "uri-reference"
specversion string

Required

The version of the CloudEvents specification which the event uses.

minLength = 1
datacontenttype string

Content type of the data value. Must adhere to RFC 2046 format.

minLength = 1
userid string

Unique identifier for the user related to the event.
tenantid string

Required

Unique identifier for the tenant related to the event.
sessionid string

Unique identifier for the session related to the event.
data object

Full client connection config resource after the event was published.
Show data properties
- status string
  
  Status of the connection-config for the tenant.
- clientId string
  
  Required
  
  Identifier of the OAuth client the connection-config relates to.
- tenantId string
  
  Required
  
  Identifier of the tenant the connection-config relates to.
- createdAt string
  
  Required
  
  Timestamp when the connection-config was created.
  
  format = "date-time"
- updatedAt string
  
  Required
  
  Timestamp when the connection-config was updated.
  
  format = "date-time"
- consentMethod string
  
  Required
  
  Consent method for the connection-config.
  
  Can be one of: "required""trusted"

com.qlik.core.oauth-client.connection-config.deleted

Example payload of the "OAuth client connection config deleted" event

{
  "id": "A234-1234-1234",
  "time": "2026-04-05T17:31:00Z",
  "type": "com.qlik.core.oauth-client.connection-config.deleted",
  "source": "com.qlik/my-service",
  "specversion": "1.0",
  "datacontenttype": "application/json",
  "userid": "id123",
  "tenantid": "id123",
  "sessionid": "id123",
  "data": {
    "status": "approved",
    "clientId": "000000000000000000000000",
    "tenantId": "00000000-0000-0000-0000-000000000000",
    "createdAt": "2026-10-30T07:06:22Z",
    "updatedAt": "2026-10-30T07:06:22Z",
    "consentMethod": "trusted"
  }
}

Published when a connection config is updated by a tenant admin.

Payload

object

id string

Required

Identifies the event.

minLength = 1
time string

Timestamp of when the occurrence happened. Must adhere to RFC 3339.

minLength = 1, format = "date-time"
type string

Required

Unique identifier for the event type.

default = "com.qlik.core.oauth-client.connection-config.updated"
source string

Required

Identifies the context in which an event happened.

minLength = 1, format = "uri-reference"
specversion string

Required

The version of the CloudEvents specification which the event uses.

minLength = 1
datacontenttype string

Content type of the data value. Must adhere to RFC 2046 format.

minLength = 1
userid string

Unique identifier for the user related to the event.
tenantid string

Required

Unique identifier for the tenant related to the event.
sessionid string

Unique identifier for the session related to the event.
data object

Full client connection config resource after the event was published.
Show data properties
- status string
  
  Status of the connection-config for the tenant.
- clientId string
  
  Required
  
  Identifier of the OAuth client the connection-config relates to.
- tenantId string
  
  Required
  
  Identifier of the tenant the connection-config relates to.
- createdAt string
  
  Required
  
  Timestamp when the connection-config was created.
  
  format = "date-time"
- updatedAt string
  
  Required
  
  Timestamp when the connection-config was updated.
  
  format = "date-time"
- consentMethod string
  
  Required
  
  Consent method for the connection-config.
  
  Can be one of: "required""trusted"
- _updates array of objects
  
  Field-level changes applied by this update. Present only when the update carried a diff.
  
  Show _updates properties
  
  path string
  
  Required
  
  Path of the field that changed.
  
  newValue any
  
  Required
  
  Value of the field after the update.
  
  oldValue any
  
  Required
  
  Value of the field before the update.

com.qlik.core.oauth-client.connection-config.updated

Example payload of the "OAuth client connection config updated" event

{
  "id": "A234-1234-1234",
  "time": "2026-04-05T17:31:00Z",
  "type": "com.qlik.core.oauth-client.connection-config.updated",
  "source": "com.qlik/my-service",
  "specversion": "1.0",
  "datacontenttype": "application/json",
  "userid": "id123",
  "tenantid": "id123",
  "sessionid": "id123",
  "data": {
    "status": "approved",
    "clientId": "000000000000000000000000",
    "tenantId": "00000000-0000-0000-0000-000000000000",
    "createdAt": "2026-10-30T07:06:22Z",
    "updatedAt": "2026-10-30T07:06:22Z",
    "consentMethod": "trusted",
    "_updates": [
      {
        "path": "clientName",
        "newValue": "My new client name",
        "oldValue": "My old client name"
      }
    ]
  }
}

Published when an OAuth client is created.

Payload

object

id string

Required

Identifies the event.

minLength = 1
time string

Timestamp of when the occurrence happened. Must adhere to RFC 3339.

minLength = 1, format = "date-time"
type string

Required

Unique identifier for the event type.

default = "com.qlik.core.oauth-client.created"
source string

Required

Identifies the context in which an event happened.

minLength = 1, format = "uri-reference"
specversion string

Required

The version of the CloudEvents specification which the event uses.

minLength = 1
datacontenttype string

Content type of the data value. Must adhere to RFC 2046 format.

minLength = 1
userid string

Unique identifier for the user related to the event.
tenantid string

Required

Unique identifier for the tenant related to the event.
sessionid string

Unique identifier for the session related to the event.
data object

Full oauth-client resource at the time the event was published.
Show data properties
- appType string
  
  Required
  
  Application type for the client.
  
  Can be one of: "web""native""spa""anonymous-embed"
- logoUri string
  
  URI for the logo of the client.
  
  format = "uri"
- ownerId string
  
  Required
  
  Identifier of the owner of the client.
- clientId string
  
  Required
  
  Identifier of the client.
- tenantId string
  
  Required
  
  Identifier of the tenant where the client was created.
- clientUri string
  
  URI for the homepage of the client.
  
  format = "uri"
- createdAt string
  
  Required
  
  Timestamp when the client was created.
  
  format = "date-time"
- deletedAt string
  
  Timestamp when the client was deleted.
  
  format = "date-time"
- ownerType string
  
  Required
  
  Type of owner that created the client.
- clientName string
  
  Required
  
  Name of the client.
- disableTag string
  
  Tag value indicating the reason the client is disabled, if any.
- createdById string
  
  Required
  
  Identifier of the resource that created the client.
- publishedAt string
  
  Timestamp when the client was published.
  
  format = "date-time"
- redirectUris array of strings
  
  List of allowed redirect URIs for logins with the client.
- allowedScopes array of strings
  
  List of allowed scopes for the client.
- createdByType string
  
  Required
  
  Type of the resource that created the client.
- allowedOrigins array of strings
  
  List of allowed origins for the client.
  
  maxItems = 5
- organizationId string
  
  Identifier of the owning organization. Present only when ownerType is organization.
- connectionPolicy array of objects
  
  Connection policies for the client.

com.qlik.core.oauth-client.created

Example payload of the "OAuth client created" event

{
  "id": "A234-1234-1234",
  "time": "2026-04-05T17:31:00Z",
  "type": "com.qlik.core.oauth-client.created",
  "source": "com.qlik/my-service",
  "specversion": "1.0",
  "datacontenttype": "application/json",
  "userid": "id123",
  "tenantid": "id123",
  "sessionid": "id123",
  "data": {
    "appType": "web",
    "ownerId": "00000000-0000-0000-0000-000000000000",
    "clientId": "000000000000000000000000",
    "tenantId": "00000000-0000-0000-0000-000000000000",
    "createdAt": "2026-10-30T07:06:22Z",
    "ownerType": "tenant",
    "clientName": "New oauth client",
    "createdById": "00000000-0000-0000-0000-000000000000",
    "createdByType": "user"
  }
}

Published when an OAuth client is deleted.

Payload

object

id string

Required

Identifies the event.

minLength = 1
time string

Timestamp of when the occurrence happened. Must adhere to RFC 3339.

minLength = 1, format = "date-time"
type string

Required

Unique identifier for the event type.

default = "com.qlik.core.oauth-client.deleted"
source string

Required

Identifies the context in which an event happened.

minLength = 1, format = "uri-reference"
specversion string

Required

The version of the CloudEvents specification which the event uses.

minLength = 1
datacontenttype string

Content type of the data value. Must adhere to RFC 2046 format.

minLength = 1
userid string

Unique identifier for the user related to the event.
tenantid string

Required

Unique identifier for the tenant related to the event.
sessionid string

Unique identifier for the session related to the event.
data object

Full oauth-client resource at the time the event was published.
Show data properties
- appType string
  
  Required
  
  Application type for the client.
  
  Can be one of: "web""native""spa""anonymous-embed"
- logoUri string
  
  URI for the logo of the client.
  
  format = "uri"
- ownerId string
  
  Required
  
  Identifier of the owner of the client.
- clientId string
  
  Required
  
  Identifier of the client.
- tenantId string
  
  Required
  
  Identifier of the tenant where the client was created.
- clientUri string
  
  URI for the homepage of the client.
  
  format = "uri"
- createdAt string
  
  Required
  
  Timestamp when the client was created.
  
  format = "date-time"
- deletedAt string
  
  Timestamp when the client was deleted.
  
  format = "date-time"
- ownerType string
  
  Required
  
  Type of owner that created the client.
- clientName string
  
  Required
  
  Name of the client.
- disableTag string
  
  Tag value indicating the reason the client is disabled, if any.
- createdById string
  
  Required
  
  Identifier of the resource that created the client.
- publishedAt string
  
  Timestamp when the client was published.
  
  format = "date-time"
- redirectUris array of strings
  
  List of allowed redirect URIs for logins with the client.
- allowedScopes array of strings
  
  List of allowed scopes for the client.
- createdByType string
  
  Required
  
  Type of the resource that created the client.
- allowedOrigins array of strings
  
  List of allowed origins for the client.
  
  maxItems = 5
- organizationId string
  
  Identifier of the owning organization. Present only when ownerType is organization.
- connectionPolicy array of objects
  
  Connection policies for the client.

com.qlik.core.oauth-client.deleted

Example payload of the "OAuth client deleted" event

{
  "id": "A234-1234-1234",
  "time": "2026-04-05T17:31:00Z",
  "type": "com.qlik.core.oauth-client.deleted",
  "source": "com.qlik/my-service",
  "specversion": "1.0",
  "datacontenttype": "application/json",
  "userid": "id123",
  "tenantid": "id123",
  "sessionid": "id123",
  "data": {
    "appType": "web",
    "ownerId": "00000000-0000-0000-0000-000000000000",
    "clientId": "000000000000000000000000",
    "tenantId": "00000000-0000-0000-0000-000000000000",
    "createdAt": "2026-10-30T07:06:22Z",
    "ownerType": "tenant",
    "clientName": "New oauth client",
    "createdById": "00000000-0000-0000-0000-000000000000",
    "createdByType": "user"
  }
}

Published when an OAuth client is published.

Payload

object

id string

Required

Identifies the event.

minLength = 1
time string

Timestamp of when the occurrence happened. Must adhere to RFC 3339.

minLength = 1, format = "date-time"
type string

Required

Unique identifier for the event type.

default = "com.qlik.core.oauth-client.published"
source string

Required

Identifies the context in which an event happened.

minLength = 1, format = "uri-reference"
specversion string

Required

The version of the CloudEvents specification which the event uses.

minLength = 1
datacontenttype string

Content type of the data value. Must adhere to RFC 2046 format.

minLength = 1
userid string

Unique identifier for the user related to the event.
tenantid string

Required

Unique identifier for the tenant related to the event.
sessionid string

Unique identifier for the session related to the event.
data object

Full oauth-client resource at the time the event was published.
Show data properties
- appType string
  
  Required
  
  Application type for the client.
  
  Can be one of: "web""native""spa""anonymous-embed"
- logoUri string
  
  URI for the logo of the client.
  
  format = "uri"
- ownerId string
  
  Required
  
  Identifier of the owner of the client.
- clientId string
  
  Required
  
  Identifier of the client.
- tenantId string
  
  Required
  
  Identifier of the tenant where the client was created.
- clientUri string
  
  URI for the homepage of the client.
  
  format = "uri"
- createdAt string
  
  Required
  
  Timestamp when the client was created.
  
  format = "date-time"
- deletedAt string
  
  Timestamp when the client was deleted.
  
  format = "date-time"
- ownerType string
  
  Required
  
  Type of owner that created the client.
- clientName string
  
  Required
  
  Name of the client.
- disableTag string
  
  Tag value indicating the reason the client is disabled, if any.
- createdById string
  
  Required
  
  Identifier of the resource that created the client.
- publishedAt string
  
  Timestamp when the client was published.
  
  format = "date-time"
- redirectUris array of strings
  
  List of allowed redirect URIs for logins with the client.
- allowedScopes array of strings
  
  List of allowed scopes for the client.
- createdByType string
  
  Required
  
  Type of the resource that created the client.
- allowedOrigins array of strings
  
  List of allowed origins for the client.
  
  maxItems = 5
- organizationId string
  
  Identifier of the owning organization. Present only when ownerType is organization.
- connectionPolicy array of objects
  
  Connection policies for the client.

com.qlik.core.oauth-client.published

Example payload of the "OAuth client published" event

{
  "id": "A234-1234-1234",
  "time": "2026-04-05T17:31:00Z",
  "type": "com.qlik.core.oauth-client.published",
  "source": "com.qlik/my-service",
  "specversion": "1.0",
  "datacontenttype": "application/json",
  "userid": "id123",
  "tenantid": "id123",
  "sessionid": "id123",
  "data": {
    "appType": "web",
    "ownerId": "00000000-0000-0000-0000-000000000000",
    "clientId": "000000000000000000000000",
    "tenantId": "00000000-0000-0000-0000-000000000000",
    "createdAt": "2026-10-30T07:06:22Z",
    "ownerType": "tenant",
    "clientName": "New oauth client",
    "createdById": "00000000-0000-0000-0000-000000000000",
    "createdByType": "user"
  }
}

Published when an OAuth client secret is created.

Payload

object

id string

Required

Identifies the event.

minLength = 1
time string

Timestamp of when the occurrence happened. Must adhere to RFC 3339.

minLength = 1, format = "date-time"
type string

Required

Unique identifier for the event type.

default = "com.qlik.core.oauth-client.secret.created"
source string

Required

Identifies the context in which an event happened.

minLength = 1, format = "uri-reference"
specversion string

Required

The version of the CloudEvents specification which the event uses.

minLength = 1
datacontenttype string

Content type of the data value. Must adhere to RFC 2046 format.

minLength = 1
userid string

Unique identifier for the user related to the event.
tenantid string

Required

Unique identifier for the tenant related to the event.
sessionid string

Unique identifier for the session related to the event.
data object

OAuth client identifier and hint for the secret the event is related to.
Show data properties
- hint string
  
  Required
  
  Hint for the client secret.
- clientId string
  
  Required
  
  Identifier of the client.

com.qlik.core.oauth-client.secret.created

Example payload of the "OAuth client secret created" event

{
  "id": "A234-1234-1234",
  "time": "2026-04-05T17:31:00Z",
  "type": "com.qlik.core.oauth-client.secret.created",
  "source": "com.qlik/my-service",
  "specversion": "1.0",
  "datacontenttype": "application/json",
  "userid": "id123",
  "tenantid": "id123",
  "sessionid": "id123",
  "data": {
    "hint": "00000",
    "clientId": "000000000000000000000000"
  }
}

Published when an OAuth client secret is deleted.

Payload

object

id string

Required

Identifies the event.

minLength = 1
time string

Timestamp of when the occurrence happened. Must adhere to RFC 3339.

minLength = 1, format = "date-time"
type string

Required

Unique identifier for the event type.

default = "com.qlik.core.oauth-client.secret.deleted"
source string

Required

Identifies the context in which an event happened.

minLength = 1, format = "uri-reference"
specversion string

Required

The version of the CloudEvents specification which the event uses.

minLength = 1
datacontenttype string

Content type of the data value. Must adhere to RFC 2046 format.

minLength = 1
userid string

Unique identifier for the user related to the event.
tenantid string

Required

Unique identifier for the tenant related to the event.
sessionid string

Unique identifier for the session related to the event.
data object

OAuth client identifier and hint for the secret the event is related to.
Show data properties
- hint string
  
  Required
  
  Hint for the client secret.
- clientId string
  
  Required
  
  Identifier of the client.

com.qlik.core.oauth-client.secret.deleted

Example payload of the "OAuth client secret deleted" event

{
  "id": "A234-1234-1234",
  "time": "2026-04-05T17:31:00Z",
  "type": "com.qlik.core.oauth-client.secret.deleted",
  "source": "com.qlik/my-service",
  "specversion": "1.0",
  "datacontenttype": "application/json",
  "userid": "id123",
  "tenantid": "id123",
  "sessionid": "id123",
  "data": {
    "hint": "00000",
    "clientId": "000000000000000000000000"
  }
}

Published when an OAuth client is updated.

Payload

object

id string

Required

Identifies the event.

minLength = 1
time string

Timestamp of when the occurrence happened. Must adhere to RFC 3339.

minLength = 1, format = "date-time"
type string

Required

Unique identifier for the event type.

default = "com.qlik.core.oauth-client.updated"
source string

Required

Identifies the context in which an event happened.

minLength = 1, format = "uri-reference"
specversion string

Required

The version of the CloudEvents specification which the event uses.

minLength = 1
datacontenttype string

Content type of the data value. Must adhere to RFC 2046 format.

minLength = 1
userid string

Unique identifier for the user related to the event.
tenantid string

Required

Unique identifier for the tenant related to the event.
sessionid string

Unique identifier for the session related to the event.
data object

Full oauth-client resource at the time the event was published.
Show data properties
- appType string
  
  Required
  
  Application type for the client.
  
  Can be one of: "web""native""spa""anonymous-embed"
- logoUri string
  
  URI for the logo of the client.
  
  format = "uri"
- ownerId string
  
  Required
  
  Identifier of the owner of the client.
- clientId string
  
  Required
  
  Identifier of the client.
- tenantId string
  
  Required
  
  Identifier of the tenant where the client was created.
- clientUri string
  
  URI for the homepage of the client.
  
  format = "uri"
- createdAt string
  
  Required
  
  Timestamp when the client was created.
  
  format = "date-time"
- deletedAt string
  
  Timestamp when the client was deleted.
  
  format = "date-time"
- ownerType string
  
  Required
  
  Type of owner that created the client.
- clientName string
  
  Required
  
  Name of the client.
- disableTag string
  
  Tag value indicating the reason the client is disabled, if any.
- createdById string
  
  Required
  
  Identifier of the resource that created the client.
- publishedAt string
  
  Timestamp when the client was published.
  
  format = "date-time"
- redirectUris array of strings
  
  List of allowed redirect URIs for logins with the client.
- allowedScopes array of strings
  
  List of allowed scopes for the client.
- createdByType string
  
  Required
  
  Type of the resource that created the client.
- allowedOrigins array of strings
  
  List of allowed origins for the client.
  
  maxItems = 5
- organizationId string
  
  Identifier of the owning organization. Present only when ownerType is organization.
- connectionPolicy array of objects
  
  Connection policies for the client.
- _updates array of objects
  
  Field-level changes applied by this update. Present only when the update carried a diff.
  
  Show _updates properties
  
  path string
  
  Required
  
  Path of the field that changed.
  
  newValue any
  
  Required
  
  Value of the field after the update.
  
  oldValue any
  
  Required
  
  Value of the field before the update.

com.qlik.core.oauth-client.updated

Example payload of the "OAuth client updated" event

{
  "id": "A234-1234-1234",
  "time": "2026-04-05T17:31:00Z",
  "type": "com.qlik.core.oauth-client.updated",
  "source": "com.qlik/my-service",
  "specversion": "1.0",
  "datacontenttype": "application/json",
  "userid": "id123",
  "tenantid": "id123",
  "sessionid": "id123",
  "data": {
    "appType": "web",
    "ownerId": "00000000-0000-0000-0000-000000000000",
    "clientId": "000000000000000000000000",
    "tenantId": "00000000-0000-0000-0000-000000000000",
    "createdAt": "2026-10-30T07:06:22Z",
    "ownerType": "tenant",
    "clientName": "New oauth client",
    "createdById": "00000000-0000-0000-0000-000000000000",
    "createdByType": "user",
    "_updates": [
      {
        "path": "clientName",
        "newValue": "My new client name",
        "oldValue": "My old client name"
      }
    ]
  }
}