OAuth tokens

Download AsyncAPI spec

Events emitted when OAuth tokens are issued or revoked in a Qlik Cloud tenant. These events enable tracking of token issuance and revocation for security and auditing.

Preferred events

These events replace the legacy OAuth tokens events. Use these events for all new implementations.

OAuth token issued

Published when an OAuth token is issued.

Payload

object
  • id string
    Required

    Identifies the event.

    minLength = 1

  • time string

    Timestamp of when the occurrence happened. Must adhere to RFC 3339.

    minLength = 1, format = "date-time"

  • type string
    Required

    The type of event.

    default = "com.qlik.core.oauth-token.issued"

  • source string
    Required

    Identifies the context in which an event happened.

    minLength = 1, format = "uri-reference"

  • specversion string
    Required

    The version of the CloudEvents specification which the event uses.

    minLength = 1

  • datacontenttype string

    Content type of the data value. Must adhere to RFC 2046 format.

    minLength = 1, default = "application/json"

  • meta object

    Additional request metadata carried as a CloudEvents extension.

    Show meta properties
    • userAgent string

      The User-Agent header of the request that triggered the event.
  • userid string

    Unique identifier for the user triggering the event.

  • authtype string

    The type of principal that triggered the occurrence.

  • originip string

    Origin IP address.

  • tenantid string
    Required

    Unique identifier for the tenant related to the event.

  • sessionid string

    Unique identifier for the session related to the event.

  • authclaims string

    A JSON string representing claims of the principal that triggered the event

  • tracestate string

    W3C Trace Context tracestate header propagated with the event.

  • traceparent string

    W3C Trace Context traceparent header propagated with the event.

  • data object
    Required

    Data specific to the oauth token issued event.

    Show data properties
    • id string

      Identifier of the newly issued token.

    • scopes array of strings

      The list of scopes granted to the token.

    • appType string

      The app type of the client that the token was issued to.

    • ownerId string

      Identifier of the OAuth client.

    • issuedAt string

      Timestamp when the token was issued.

      format = "date-time"

    • tenantId string

      Identifier of the tenant the token belongs to.

    • userType string

      The type of user the token was issued for (for example, bot or anonymous). Absent for regular interactive users.

    • createdBy string

      Identifier of the OAuth client who created the token.

    • grantType string

      The grant type that was used to generate the token

      Can be one of: "authorization_code""refresh_token""client_credentials""urn:ietf:params:oauth:grant-type:token-exchange""urn:qlik:oauth:user-impersonation""urn:qlik:oauth:anonymous-embed"

    • deviceType string

      The device manufacturer and model.

    • description string

      A description of the token.

    • resourceOwner string

      Identifier of the user the token was issued for.

    • issuedToClientId string

      Identifier of the client the token was issued to.

com.qlik.core.oauth-token.issued

Example payload of the "OAuth token issued" event

{
  "id": "A234-1234-1234",
  "time": "2026-01-01T12:00:00Z",
  "type": "com.qlik.core.oauth-token.issued",
  "source": "com.qlik/my-service",
  "specversion": "1.0",
  "datacontenttype": "application/json",
  "meta": {
    "userAgent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36"
  },
  "userid": "605a18af2ab08cdbfad09259",
  "authtype": "service_account",
  "originip": "0.0.0.0",
  "tenantid": "TiQ8GPVr8qI714Lp5ChAAFFaU24MJy69",
  "sessionid": "WZhiEfgW2bLd7HgR-jjzAh6VnicipweT",
  "authclaims": "{\\\"iss\\\":\\\"qlik.api.internal/service\\\",\\\"sub\\\":\\\"service\\\",\\\"subType\\\":\\\"service\\\"}",
  "tracestate": "rojo=00f067aa0ba902b7,congo=t61rcWkgMzE",
  "traceparent": "00-0af7651916cd43dd8448eb211c80319c-b7ad6b7169203331-01",
  "data": {
    "id": "601abc3fe95f07dbb73ce50f",
    "scopes": [
      "user_default"
    ],
    "appType": "web",
    "ownerId": "LkedCLXCtzdMdZJayyw8LzASxcL9jLTB",
    "issuedAt": "2025-10-30T07:06:22Z",
    "tenantId": "TiQ8GPVr8qI714Lp5ChAAFFaU24MJy69",
    "createdBy": "sEkC_KKE4RYwBzoeqQ4-TEp982A0gNnA",
    "grantType": "authorization_code",
    "deviceType": "Dell XPS 15",
    "description": "John's PC",
    "resourceOwner": "LkedCLXCtzdMdZJayyw8LzASxcL9jLTB",
    "issuedToClientId": "3e7651d5-98d9-467c-be0b-09623e6aa551"
  }
}

OAuth token revoked

Published when OAuth tokens are revoked.

Payload

object
  • id string
    Required

    Identifies the event.

    minLength = 1

  • time string

    Timestamp of when the occurrence happened. Must adhere to RFC 3339.

    minLength = 1, format = "date-time"

  • type string
    Required

    The type of event.

    default = "com.qlik.core.oauth-token.revoked"

  • source string
    Required

    Identifies the context in which an event happened.

    minLength = 1, format = "uri-reference"

  • specversion string
    Required

    The version of the CloudEvents specification which the event uses.

    minLength = 1

  • datacontenttype string

    Content type of the data value. Must adhere to RFC 2046 format.

    minLength = 1, default = "application/json"

  • meta object

    Additional request metadata carried as a CloudEvents extension.

    Show meta properties
    • userAgent string

      The User-Agent header of the request that triggered the event.
  • userid string

    Unique identifier for the user triggering the event.

  • authtype string

    The type of principal that triggered the occurrence.

  • originip string

    Origin IP address.

  • tenantid string
    Required

    Unique identifier for the tenant related to the event.

  • sessionid string

    Unique identifier for the session related to the event.

  • authclaims string

    A JSON string representing claims of the principal that triggered the event

  • tracestate string

    W3C Trace Context tracestate header propagated with the event.

  • traceparent string

    W3C Trace Context traceparent header propagated with the event.

  • data object
    Required

    Data specific to the oauth token revoked event.

    Show data properties
    • revokedAt string
      Required

      Timestamp when the token(s) were revoked.

      format = "date-time"

    • revokedBy string

      Identifier of the user who revoked the token(s).

    • revokedContext object
      Required

      Context indicating the scope of the tokens that have been revoked (individual token or many tokens). The revoked tokens are the intersection of the context properties. For example, if both userId and clientId are provided, only tokens belonging to that user issued from that client are revoked (and not tokens from other users or from other clients).

      minProperties = 1

      Show revokedContext properties
      • userId string

        If provided, revoked tokens are limited to this user.

      • grantId string

        Unique identifier of the token. If provided, only this specific token has been revoked.

      • clientId string

        If provided, revoked tokens are limited to this OAuth client.

      • tenantId string

        If provided, revoked tokens are limited to this tenant.
    • revokedByBearer boolean
      Required

      Whether the token was revoked by the bearer using the access or refresh token (true), or revoked via the REST API (false).

com.qlik.core.oauth-token.revoked

Example payload of the "OAuth token revoked" event

{
  "id": "A234-1234-1234",
  "time": "2026-01-01T12:00:00Z",
  "type": "com.qlik.core.oauth-token.revoked",
  "source": "com.qlik/my-service",
  "specversion": "1.0",
  "datacontenttype": "application/json",
  "meta": {
    "userAgent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36"
  },
  "userid": "605a18af2ab08cdbfad09259",
  "authtype": "service_account",
  "originip": "0.0.0.0",
  "tenantid": "TiQ8GPVr8qI714Lp5ChAAFFaU24MJy69",
  "sessionid": "WZhiEfgW2bLd7HgR-jjzAh6VnicipweT",
  "authclaims": "{\\\"iss\\\":\\\"qlik.api.internal/service\\\",\\\"sub\\\":\\\"service\\\",\\\"subType\\\":\\\"service\\\"}",
  "tracestate": "rojo=00f067aa0ba902b7,congo=t61rcWkgMzE",
  "traceparent": "00-0af7651916cd43dd8448eb211c80319c-b7ad6b7169203331-01",
  "data": {
    "revokedAt": "2025-10-30T07:06:22Z",
    "revokedBy": "sEkC_KKE4RYwBzoeqQ4-TEp982A0gNnA",
    "revokedContext": {
      "userId": "605a18af2ab08cdbfad09259",
      "grantId": "601abc3fe95f07dbb73ce50f",
      "clientId": "630201422597f43c47128aa651af2172",
      "tenantId": "TiQ8GPVr8qI714Lp5ChAAFFaU24MJy69"
    },
    "revokedByBearer": true
  }
}