OAuth tokens

Download AsyncAPI spec

Events emitted when OAuth tokens are issued or revoked in a Qlik Cloud tenant. These events enable tracking of token issuance and revocation for security and auditing.

These events are available for consumption via:

Deprecation notice

These events are deprecated and will be removed on or after November 30, 2026.

Use the OAuth tokens events in the core namespace instead. For the full event mapping, see the deprecation notice.

OAuth token issued

Published when an OAuth token is issued.

Payload

object
  • id string
    Required

    Identifies the event.

    minLength = 1

  • time string

    Timestamp of when the occurrence happened. Must adhere to RFC 3339.

    minLength = 1, format = "date-time"

  • type string
    Required

    The type of event.

    default = "com.qlik.oauth-token.issued"

  • source string
    Required

    Identifies the context in which an event happened.

    minLength = 1, format = "uri-reference"

  • specversion string
    Required

    The version of the CloudEvents specification which the event uses.

    minLength = 1

  • datacontenttype string

    Content type of the data value. Must adhere to RFC 2046 format.

    minLength = 1, default = "application/json"

  • userid string

    Unique identifier for the user triggering the event.

  • authtype string

    The type of principal that triggered the occurrence.

  • originip string

    Origin IP address.

  • tenantid string
    Required

    Unique identifier for the tenant related to the event.

  • sessionid string

    Unique identifier for the session related to the event.

  • authclaims string

    A JSON string representing claims of the principal that triggered the event

  • data object
    Required

    Data specific to the oauth token issued event.

    Show data properties
    • id string

      Identifier of the newly issued token.

    • scopes array

      The list of scopes granted to the token

    • appType string

      The app type of the client that the token was issued to

    • ownerId string

      Identifier of the OAuth client.

    • issuedAt string

      Timestamp when the token was issued.

    • tenantId string

      Identifier of the tenant the token belongs to.

    • createdBy string

      Identifier of the OAuth client who created the token.

    • grantType string

      The grant type that was used to generate the token

      Can be one of: "authorization_code""refresh_token""client_credentials""urn:ietf:params:oauth:grant-type:token-exchange""urn:qlik:oauth:user-impersonation""urn:qlik:oauth:anonymous-embed"

    • deviceType string

      The device manufacturer and model

    • description string

      A description of the token

    • resourceOwner string

      Identifier of the user the token was issued for.

    • issuedToClientId string

      Identifier of the client the token was issued to.

com.qlik.oauth-token.issued

Example payload of the "OAuth token issued" event

{
  "id": "A234-1234-1234",
  "time": "2026-01-01T12:00:00Z",
  "type": "com.qlik.oauth-token.issued",
  "source": "com.qlik/my-service",
  "specversion": "1.0",
  "datacontenttype": "application/json",
  "userid": "605a18af2ab08cdbfad09259",
  "authtype": "service_account",
  "originip": "0.0.0.0",
  "tenantid": "TiQ8GPVr8qI714Lp5ChAAFFaU24MJy69",
  "sessionid": "WZhiEfgW2bLd7HgR-jjzAh6VnicipweT",
  "authclaims": "{\\\"iss\\\":\\\"qlik.api.internal/service\\\",\\\"sub\\\":\\\"service\\\",\\\"subType\\\":\\\"service\\\"}",
  "data": {
    "id": "601abc3fe95f07dbb73ce50f",
    "scopes": [
      "user_default"
    ],
    "ownerId": "LkedCLXCtzdMdZJayyw8LzASxcL9jLTB",
    "issuedAt": "2025-10-30T07:06:22Z",
    "tenantId": "TiQ8GPVr8qI714Lp5ChAAFFaU24MJy69",
    "createdBy": "sEkC_KKE4RYwBzoeqQ4-TEp982A0gNnA",
    "deviceType": "Dell XPS 15",
    "description": "John's PC",
    "resourceOwner": "LkedCLXCtzdMdZJayyw8LzASxcL9jLTB",
    "issuedToClientId": "3e7651d5-98d9-467c-be0b-09623e6aa551"
  }
}

OAuth token revoked

Published when OAuth tokens are revoked.

Payload

object
  • id string
    Required

    Identifies the event.

    minLength = 1

  • time string

    Timestamp of when the occurrence happened. Must adhere to RFC 3339.

    minLength = 1, format = "date-time"

  • type string
    Required

    The type of event.

    default = "com.qlik.oauth-token.revoked"

  • source string
    Required

    Identifies the context in which an event happened.

    minLength = 1, format = "uri-reference"

  • specversion string
    Required

    The version of the CloudEvents specification which the event uses.

    minLength = 1

  • datacontenttype string

    Content type of the data value. Must adhere to RFC 2046 format.

    minLength = 1, default = "application/json"

  • userid string

    Unique identifier for the user triggering the event.

  • authtype string

    The type of principal that triggered the occurrence.

  • originip string

    Origin IP address.

  • tenantid string
    Required

    Unique identifier for the tenant related to the event.

  • sessionid string

    Unique identifier for the session related to the event.

  • authclaims string

    A JSON string representing claims of the principal that triggered the event

  • data object
    Required

    Data specific to the oauth token revoked event.

    Show data properties
    • revokedAt string
      Required

      Timestamp when the token(s) were revoked.

    • revokedBy string

      Identifier of the user who revoked the token(s).

    • revokedContext object
      Required

      Context indicating the scope of the tokens that have been revoked (individual token or many tokens). The revoked tokens are the intersection of the context properties. For example, if both userId and clientId are provided, only tokens belonging to that user issued from that client are revoked (and not tokens from other users or from other clients).

      minProperties = 1

      Show revokedContext properties
      • userId string

        If provided, revoked tokens are limited to this user.

      • grantId string

        Unique identifier of the token. If provided, only this specific token has been revoked.

      • clientId string

        If provided, revoked tokens are limited to this OAuth client.

      • tenantId string

        If provided, revoked tokens are limited to this tenant.
    • revokedByBearer boolean
      Required

      Whether the token was revoked using either the token or refresh token, false when the token is revoked via the REST API.

com.qlik.oauth-token.revoked

Example payload of the "OAuth token revoked" event

{
  "id": "A234-1234-1234",
  "time": "2026-01-01T12:00:00Z",
  "type": "com.qlik.oauth-token.revoked",
  "source": "com.qlik/my-service",
  "specversion": "1.0",
  "datacontenttype": "application/json",
  "userid": "605a18af2ab08cdbfad09259",
  "authtype": "service_account",
  "originip": "0.0.0.0",
  "tenantid": "TiQ8GPVr8qI714Lp5ChAAFFaU24MJy69",
  "sessionid": "WZhiEfgW2bLd7HgR-jjzAh6VnicipweT",
  "authclaims": "{\\\"iss\\\":\\\"qlik.api.internal/service\\\",\\\"sub\\\":\\\"service\\\",\\\"subType\\\":\\\"service\\\"}",
  "data": {
    "revokedAt": "2025-10-30T07:06:22Z",
    "revokedBy": "sEkC_KKE4RYwBzoeqQ4-TEp982A0gNnA",
    "revokedContext": {
      "userId": "605a18af2ab08cdbfad09259",
      "grantId": "601abc3fe95f07dbb73ce50f",
      "clientId": "630201422597f43c47128aa651af2172",
      "tenantId": "TiQ8GPVr8qI714Lp5ChAAFFaU24MJy69"
    },
    "revokedByBearer": true
  }
}