User sessions

Download AsyncAPI spec

Events emitted when user sessions begin or end in a Qlik Cloud tenant. These events enable monitoring of user authentication events for security and audit purposes.

Preferred events

These events replace the legacy User sessions events. Use these events for all new implementations.

Published when a user session is created.

Payload

object

idstring
Required

Identifies the event.

minLength = 1
timestring

Timestamp of when the occurrence happened. Must adhere to RFC 3339.

minLength = 1, format = "date-time"
typestring
Required

The type of event.

default = "com.qlik.core.user-session.begun"
sourcestring
Required

Identifies the context in which an event happened.

minLength = 1, format = "uri-reference"
specversionstring
Required

The version of the CloudEvents specification which the event uses.

minLength = 1
datacontenttypestring

Content type of the data value. Must adhere to RFC 2046 format.

minLength = 1, default = "application/json"
metaobject

Additional request metadata carried as a CloudEvents extension.
Show meta properties
- userAgentstring
  
  The User-Agent header of the request that triggered the event.
useridstring

Unique identifier for the user triggering the event.
authtypestring

The type of principal that triggered the occurrence.
originipstring

Origin IP address.
tenantidstring
Required

Unique identifier for the tenant related to the event.
sessionidstring

Unique identifier for the session related to the event.
authclaimsstring

A JSON string representing claims of the principal that triggered the event
tracestatestring

W3C Trace Context tracestate header propagated with the event.
traceparentstring

W3C Trace Context traceparent header propagated with the event.
dataobject
Required

Data specific to the user session begun event.
Show data properties
- idpIdstring
  
  Identifier of the identity provider through which the session was initiated. Omitted when no external identity provider was used.
- sourcestring
  
  The authentication flow that initiated the session, for example interactive (interactive browser login) or jwt-login-session (JWT login).
- subjectstring
  
  User's subject identifier in the identity database.
- recoveryboolean
  
  Whether the session is part of a recovery login.
- userTypestring
  
  The user's type, only specified for anonymous users.
  
  Can be one of: "anonymous"

com.qlik.core.user-session.begun

Example payload of the "Session begun" event

{
  "id": "A234-1234-1234",
  "time": "2026-01-01T12:00:00Z",
  "type": "com.qlik.core.user-session.begun",
  "source": "com.qlik/my-service",
  "specversion": "1.0",
  "datacontenttype": "application/json",
  "meta": {
    "userAgent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36"
  },
  "userid": "605a18af2ab08cdbfad09259",
  "authtype": "service_account",
  "originip": "0.0.0.0",
  "tenantid": "TiQ8GPVr8qI714Lp5ChAAFFaU24MJy69",
  "sessionid": "WZhiEfgW2bLd7HgR-jjzAh6VnicipweT",
  "authclaims": "{\\\"iss\\\":\\\"qlik.api.internal/service\\\",\\\"sub\\\":\\\"service\\\",\\\"subType\\\":\\\"service\\\"}",
  "tracestate": "rojo=00f067aa0ba902b7,congo=t61rcWkgMzE",
  "traceparent": "00-0af7651916cd43dd8448eb211c80319c-b7ad6b7169203331-01",
  "data": {
    "idpId": "661d627cef218789bbd67cc9",
    "source": "interactive",
    "subject": "auth0\\foo",
    "recovery": false
  }
}

Published when a user session ends.

Payload

object

idstring
Required

Identifies the event.

minLength = 1
timestring

Timestamp of when the occurrence happened. Must adhere to RFC 3339.

minLength = 1, format = "date-time"
typestring
Required

The type of event.

default = "com.qlik.core.user-session.ended"
sourcestring
Required

Identifies the context in which an event happened.

minLength = 1, format = "uri-reference"
specversionstring
Required

The version of the CloudEvents specification which the event uses.

minLength = 1
datacontenttypestring

Content type of the data value. Must adhere to RFC 2046 format.

minLength = 1, default = "application/json"
metaobject

Additional request metadata carried as a CloudEvents extension.
Show meta properties
- userAgentstring
  
  The User-Agent header of the request that triggered the event.
useridstring

Unique identifier for the user triggering the event.
authtypestring

The type of principal that triggered the occurrence.
originipstring

Origin IP address.
tenantidstring
Required

Unique identifier for the tenant related to the event.
sessionidstring

Unique identifier for the session related to the event.
authclaimsstring

A JSON string representing claims of the principal that triggered the event
tracestatestring

W3C Trace Context tracestate header propagated with the event.
traceparentstring

W3C Trace Context traceparent header propagated with the event.
dataobject
Required

Data specific to the user session end event.
Show data properties
- subjectstring
  
  User's subject identifier in the identity database.

com.qlik.core.user-session.ended

Example payload of the "Session ended" event

{
  "id": "A234-1234-1234",
  "time": "2026-01-01T12:00:00Z",
  "type": "com.qlik.core.user-session.ended",
  "source": "com.qlik/my-service",
  "specversion": "1.0",
  "datacontenttype": "application/json",
  "meta": {
    "userAgent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36"
  },
  "userid": "605a18af2ab08cdbfad09259",
  "authtype": "service_account",
  "originip": "0.0.0.0",
  "tenantid": "TiQ8GPVr8qI714Lp5ChAAFFaU24MJy69",
  "sessionid": "WZhiEfgW2bLd7HgR-jjzAh6VnicipweT",
  "authclaims": "{\\\"iss\\\":\\\"qlik.api.internal/service\\\",\\\"sub\\\":\\\"service\\\",\\\"subType\\\":\\\"service\\\"}",
  "tracestate": "rojo=00f067aa0ba902b7,congo=t61rcWkgMzE",
  "traceparent": "00-0af7651916cd43dd8448eb211c80319c-b7ad6b7169203331-01",
  "data": {
    "subject": "auth0\\foo"
  }
}