OAuth tokens

Download AsyncAPI spec

Events emitted when OAuth tokens are issued or revoked in a Qlik Cloud tenant. These events enable tracking of token issuance and revocation for security and auditing.

Preferred events

These events replace the legacy OAuth tokens events. Use these events for all new implementations.

OAuth token issued

Published when an OAuth token is issued.

Payload

object
  • idstring
    Required

    Identifies the event.

    minLength = 1

  • timestring

    Timestamp of when the occurrence happened. Must adhere to RFC 3339.

    minLength = 1, format = "date-time"

  • typestring
    Required

    The type of event.

    default = "com.qlik.core.oauth-token.issued"

  • sourcestring
    Required

    Identifies the context in which an event happened.

    minLength = 1, format = "uri-reference"

  • specversionstring
    Required

    The version of the CloudEvents specification which the event uses.

    minLength = 1

  • datacontenttypestring

    Content type of the data value. Must adhere to RFC 2046 format.

    minLength = 1, default = "application/json"

  • metaobject

    Additional request metadata carried as a CloudEvents extension.

    Show meta properties
    • userAgentstring

      The User-Agent header of the request that triggered the event.
  • useridstring

    Unique identifier for the user triggering the event.

  • authtypestring

    The type of principal that triggered the occurrence.

  • originipstring

    Origin IP address.

  • tenantidstring
    Required

    Unique identifier for the tenant related to the event.

  • sessionidstring

    Unique identifier for the session related to the event.

  • authclaimsstring

    A JSON string representing claims of the principal that triggered the event

  • tracestatestring

    W3C Trace Context tracestate header propagated with the event.

  • traceparentstring

    W3C Trace Context traceparent header propagated with the event.

  • dataobject
    Required

    Data specific to the oauth token issued event.

    Show data properties
    • idstring

      Identifier of the newly issued token.

    • scopesarray of strings

      The list of scopes granted to the token.

    • appTypestring

      The app type of the client that the token was issued to.

    • ownerIdstring

      Identifier of the OAuth client.

    • issuedAtstring

      Timestamp when the token was issued.

      format = "date-time"

    • tenantIdstring

      Identifier of the tenant the token belongs to.

    • userTypestring

      The type of user the token was issued for (for example, bot or anonymous). Absent for regular interactive users.

    • createdBystring

      Identifier of the OAuth client who created the token.

    • grantTypestring

      The grant type that was used to generate the token

      Can be one of: "authorization_code""refresh_token""client_credentials""urn:ietf:params:oauth:grant-type:token-exchange""urn:qlik:oauth:user-impersonation""urn:qlik:oauth:anonymous-embed"

    • deviceTypestring

      The device manufacturer and model.

    • descriptionstring

      A description of the token.

    • resourceOwnerstring

      Identifier of the user the token was issued for.

    • issuedToClientIdstring

      Identifier of the client the token was issued to.

com.qlik.core.oauth-token.issued

Example payload of the "OAuth token issued" event

{
  "id": "A234-1234-1234",
  "time": "2026-01-01T12:00:00Z",
  "type": "com.qlik.core.oauth-token.issued",
  "source": "com.qlik/my-service",
  "specversion": "1.0",
  "datacontenttype": "application/json",
  "meta": {
    "userAgent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36"
  },
  "userid": "605a18af2ab08cdbfad09259",
  "authtype": "service_account",
  "originip": "0.0.0.0",
  "tenantid": "TiQ8GPVr8qI714Lp5ChAAFFaU24MJy69",
  "sessionid": "WZhiEfgW2bLd7HgR-jjzAh6VnicipweT",
  "authclaims": "{\\\"iss\\\":\\\"qlik.api.internal/service\\\",\\\"sub\\\":\\\"service\\\",\\\"subType\\\":\\\"service\\\"}",
  "tracestate": "rojo=00f067aa0ba902b7,congo=t61rcWkgMzE",
  "traceparent": "00-0af7651916cd43dd8448eb211c80319c-b7ad6b7169203331-01",
  "data": {
    "id": "601abc3fe95f07dbb73ce50f",
    "scopes": [
      "user_default"
    ],
    "appType": "web",
    "ownerId": "LkedCLXCtzdMdZJayyw8LzASxcL9jLTB",
    "issuedAt": "2025-10-30T07:06:22Z",
    "tenantId": "TiQ8GPVr8qI714Lp5ChAAFFaU24MJy69",
    "createdBy": "sEkC_KKE4RYwBzoeqQ4-TEp982A0gNnA",
    "grantType": "authorization_code",
    "deviceType": "Dell XPS 15",
    "description": "John's PC",
    "resourceOwner": "LkedCLXCtzdMdZJayyw8LzASxcL9jLTB",
    "issuedToClientId": "3e7651d5-98d9-467c-be0b-09623e6aa551"
  }
}

OAuth token revoked

Published when OAuth tokens are revoked.

Payload

object
  • idstring
    Required

    Identifies the event.

    minLength = 1

  • timestring

    Timestamp of when the occurrence happened. Must adhere to RFC 3339.

    minLength = 1, format = "date-time"

  • typestring
    Required

    The type of event.

    default = "com.qlik.core.oauth-token.revoked"

  • sourcestring
    Required

    Identifies the context in which an event happened.

    minLength = 1, format = "uri-reference"

  • specversionstring
    Required

    The version of the CloudEvents specification which the event uses.

    minLength = 1

  • datacontenttypestring

    Content type of the data value. Must adhere to RFC 2046 format.

    minLength = 1, default = "application/json"

  • metaobject

    Additional request metadata carried as a CloudEvents extension.

    Show meta properties
    • userAgentstring

      The User-Agent header of the request that triggered the event.
  • useridstring

    Unique identifier for the user triggering the event.

  • authtypestring

    The type of principal that triggered the occurrence.

  • originipstring

    Origin IP address.

  • tenantidstring
    Required

    Unique identifier for the tenant related to the event.

  • sessionidstring

    Unique identifier for the session related to the event.

  • authclaimsstring

    A JSON string representing claims of the principal that triggered the event

  • tracestatestring

    W3C Trace Context tracestate header propagated with the event.

  • traceparentstring

    W3C Trace Context traceparent header propagated with the event.

  • dataobject
    Required

    Data specific to the oauth token revoked event.

    Show data properties
    • revokedAtstring
      Required

      Timestamp when the token(s) were revoked.

      format = "date-time"

    • revokedBystring

      Identifier of the user who revoked the token(s).

    • revokedContextobject
      Required

      Context indicating the scope of the tokens that have been revoked (individual token or many tokens). The revoked tokens are the intersection of the context properties. For example, if both userId and clientId are provided, only tokens belonging to that user issued from that client are revoked (and not tokens from other users or from other clients).

      minProperties = 1

      Show revokedContext properties
      • userIdstring

        If provided, revoked tokens are limited to this user.

      • grantIdstring

        Unique identifier of the token. If provided, only this specific token has been revoked.

      • clientIdstring

        If provided, revoked tokens are limited to this OAuth client.

      • tenantIdstring

        If provided, revoked tokens are limited to this tenant.
    • revokedByBearerboolean
      Required

      Whether the token was revoked by the bearer using the access or refresh token (true), or revoked via the REST API (false).

com.qlik.core.oauth-token.revoked

Example payload of the "OAuth token revoked" event

{
  "id": "A234-1234-1234",
  "time": "2026-01-01T12:00:00Z",
  "type": "com.qlik.core.oauth-token.revoked",
  "source": "com.qlik/my-service",
  "specversion": "1.0",
  "datacontenttype": "application/json",
  "meta": {
    "userAgent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36"
  },
  "userid": "605a18af2ab08cdbfad09259",
  "authtype": "service_account",
  "originip": "0.0.0.0",
  "tenantid": "TiQ8GPVr8qI714Lp5ChAAFFaU24MJy69",
  "sessionid": "WZhiEfgW2bLd7HgR-jjzAh6VnicipweT",
  "authclaims": "{\\\"iss\\\":\\\"qlik.api.internal/service\\\",\\\"sub\\\":\\\"service\\\",\\\"subType\\\":\\\"service\\\"}",
  "tracestate": "rojo=00f067aa0ba902b7,congo=t61rcWkgMzE",
  "traceparent": "00-0af7651916cd43dd8448eb211c80319c-b7ad6b7169203331-01",
  "data": {
    "revokedAt": "2025-10-30T07:06:22Z",
    "revokedBy": "sEkC_KKE4RYwBzoeqQ4-TEp982A0gNnA",
    "revokedContext": {
      "userId": "605a18af2ab08cdbfad09259",
      "grantId": "601abc3fe95f07dbb73ce50f",
      "clientId": "630201422597f43c47128aa651af2172",
      "tenantId": "TiQ8GPVr8qI714Lp5ChAAFFaU24MJy69"
    },
    "revokedByBearer": true
  }
}