Roles

Download AsyncAPI spec

Role events notify you about lifecycle changes to roles in your Qlik Cloud tenant, enabling you to track access control modifications and role management activity.

Deprecation notice

These events are deprecated and will be removed on or after November 30, 2026.

Use the Roles events in the core namespace instead. For the full event mapping, see the deprecation notice.

Published when a role is created. Permission lists are not included in the payload due to payload size limits, but assigned scopes for custom roles will be included.

Payload

object

id string

Required

Identifies the event.

minLength = 1
time string

Timestamp of when the occurrence happened. Must adhere to RFC 3339.

minLength = 1, format = "date-time"
type string

Required

Unique identifier for the event type.

default = "com.qlik.v1.role.created"
source string

Required

Identifies the context in which an event happened.

minLength = 1, format = "uri-reference", default = "com.qlik/identities"
specversion string

Required

The version of the CloudEvents specification which the event uses.

minLength = 1
datacontenttype string

Content type of the data value. Must adhere to RFC 2046 format.

minLength = 1
userid string

Unique identifier for the user triggering the event.
tenantid string

Required

Unique identifier for the tenant related to the event.
data object

Represents a role entity.
Show data properties
- id string
  
  Required
  
  Unique identifier for the role.
  
  format = "uid"
- name string
  
  Required
  
  Name of the role.
- type string
  
  Indicates whether role is system/default or custom.
  
  Can be one of: "default""custom"
- level string
  
  Required
  
  Indicates whether it is a user or admin-level role.
- canEdit boolean
  
  Indicates whether role can be edited by users or not.
- fullUser boolean Deprecated
  
  DEPRECATED. Use userEntitlementType instead for impact of roles on user entitlements with a capacity-based subscription.
- tenantId string
  
  Required
  
  Unique identifier for the tenant associated with the given role.
  
  format = "uid"
- canDelete boolean
  
  Indicates whether role can be deleted by users or not.
- createdAt string
  
  Timestamp when the role was created.
  
  format = "date-time"
- createdBy string
  
  Unique identifier for the user who created the role. Could be Mongo OID or an old ID format in the case of legacy users.
- updatedBy string
  
  Unique identifier for the user who last updated the role. Could be Mongo OID or an old ID format in the case of legacy users.
- description string
  
  A helpful description of the role.
- lastUpdatedAt string
  
  Required
  
  Timestamp when the role was last updated.
  
  format = "date-time"
- assignedScopes array of strings
  
  Selection of scopes added to this role.
- userEntitlementType string
  
  Indicates whether this role will trigger promotion of a user from a basic to a full user on tenants with a capacity-based subscription. Does not apply to tenants with a user-based subscription.

com.qlik.v1.role.created

Example payload of the "Role created" event

{
  "id": "A234-1234-1234",
  "time": "2026-03-22T10:01:02Z",
  "type": "com.qlik.v1.role.created",
  "source": "com.qlik/identities",
  "specversion": "1.0",
  "datacontenttype": "application/json",
  "userid": "VZhiEfgW2bLd7HgR-jjzAh6VnicipweT",
  "tenantid": "VZhiEfgW2bLd7HgR-jjzAh6VnicipweT",
  "data": {
    "id": "507f191e810c19729de860ea",
    "name": "TenantAdmin",
    "type": "default",
    "level": "admin",
    "canEdit": false,
    "fullUser": true,
    "tenantId": "VZhiEfgW2bLd7HgR-jjzAh6VnicipweT",
    "canDelete": false,
    "createdAt": "2021-03-22T10:01:02Z",
    "createdBy": "6228c560543c200449c13255",
    "updatedBy": "6228c560543c200449c13255",
    "description": "Administrator role for the tenant",
    "lastUpdatedAt": "2026-03-22T10:01:02Z",
    "assignedScopes": [
      "scope.read",
      "scope.update"
    ],
    "userEntitlementType": "full"
  }
}

Published when a role is deleted.

Payload

object

id string

Required

Identifies the event.

minLength = 1
time string

Timestamp of when the occurrence happened. Must adhere to RFC 3339.

minLength = 1, format = "date-time"
type string

Required

Unique identifier for the event type.

default = "com.qlik.v1.role.deleted"
source string

Required

Identifies the context in which an event happened.

minLength = 1, format = "uri-reference", default = "com.qlik/identities"
specversion string

Required

The version of the CloudEvents specification which the event uses.

minLength = 1
datacontenttype string

Content type of the data value. Must adhere to RFC 2046 format.

minLength = 1
userid string

Unique identifier for the user triggering the event.
tenantid string

Required

Unique identifier for the tenant related to the event.
data object

Represents a role entity.
Show data properties
- id string
  
  Required
  
  Unique identifier for the role.
  
  format = "uid"
- name string
  
  Required
  
  Name of the role.
- type string
  
  Indicates whether role is system/default or custom.
  
  Can be one of: "default""custom"
- level string
  
  Required
  
  Indicates whether it is a user or admin-level role.
- canEdit boolean
  
  Indicates whether role can be edited by users or not.
- fullUser boolean Deprecated
  
  DEPRECATED. Use userEntitlementType instead for impact of roles on user entitlements with a capacity-based subscription.
- tenantId string
  
  Required
  
  Unique identifier for the tenant associated with the given role.
  
  format = "uid"
- canDelete boolean
  
  Indicates whether role can be deleted by users or not.
- createdAt string
  
  Timestamp when the role was created.
  
  format = "date-time"
- createdBy string
  
  Unique identifier for the user who created the role. Could be Mongo OID or an old ID format in the case of legacy users.
- updatedBy string
  
  Unique identifier for the user who last updated the role. Could be Mongo OID or an old ID format in the case of legacy users.
- description string
  
  A helpful description of the role.
- lastUpdatedAt string
  
  Required
  
  Timestamp when the role was last updated.
  
  format = "date-time"
- assignedScopes array of strings
  
  Selection of scopes added to this role.
- userEntitlementType string
  
  Indicates whether this role will trigger promotion of a user from a basic to a full user on tenants with a capacity-based subscription. Does not apply to tenants with a user-based subscription.

com.qlik.v1.role.deleted

Example payload of the "Role deleted" event

{
  "id": "A234-1234-1234",
  "time": "2026-03-22T10:01:02Z",
  "type": "com.qlik.v1.role.deleted",
  "source": "com.qlik/identities",
  "specversion": "1.0",
  "datacontenttype": "application/json",
  "userid": "VZhiEfgW2bLd7HgR-jjzAh6VnicipweT",
  "tenantid": "VZhiEfgW2bLd7HgR-jjzAh6VnicipweT",
  "data": {
    "id": "507f191e810c19729de860ea",
    "name": "TenantAdmin",
    "type": "default",
    "level": "admin",
    "canEdit": false,
    "fullUser": true,
    "tenantId": "VZhiEfgW2bLd7HgR-jjzAh6VnicipweT",
    "canDelete": false,
    "createdAt": "2021-03-22T10:01:02Z",
    "createdBy": "6228c560543c200449c13255",
    "updatedBy": "6228c560543c200449c13255",
    "description": "Administrator role for the tenant",
    "lastUpdatedAt": "2026-03-22T10:01:02Z",
    "assignedScopes": [
      "scope.read",
      "scope.update"
    ],
    "userEntitlementType": "full"
  }
}

Published when role definitions are synchronized across the platform. Permission lists are not included in the payload due to payload size limits.

Payload

object

id string

Required

Identifies the event.

minLength = 1
time string

Timestamp of when the occurrence happened. Must adhere to RFC 3339.

minLength = 1, format = "date-time"
type string

Required

Unique identifier for the event type.

default = "com.qlik.v1.role.synced"
source string

Required

Identifies the context in which an event happened.

minLength = 1, format = "uri-reference", default = "com.qlik/identities"
specversion string

Required

The version of the CloudEvents specification which the event uses.

minLength = 1
datacontenttype string

Content type of the data value. Must adhere to RFC 2046 format.

minLength = 1
userid string

Unique identifier for the user triggering the event.
tenantid string

Required

Unique identifier for the tenant related to the event.
data object

Payload containing the roles that were synced.
Show data properties
- roles array of objects
  
  Represents a role entity.
  
  Show roles properties
  
  id string
  
  Required
  
  Unique identifier for the role.
  
  format = "uid"
  
  name string
  
  Required
  
  Name of the role.
  
  type string
  
  Indicates whether role is system/default or custom.
  
  Can be one of: "default""custom"
  
  level string
  
  Required
  
  Indicates whether it is a user or admin-level role.
  
  canEdit boolean
  
  Indicates whether role can be edited by users or not.
  
  fullUser boolean Deprecated
  
  DEPRECATED. Use userEntitlementType instead for impact of roles on user entitlements with a capacity-based subscription.
  
  tenantId string
  
  Required
  
  Unique identifier for the tenant associated with the given role.
  
  format = "uid"
  
  canDelete boolean
  
  Indicates whether role can be deleted by users or not.
  
  createdAt string
  
  Timestamp when the role was created.
  
  format = "date-time"
  
  createdBy string
  
  Unique identifier for the user who created the role. Could be Mongo OID or an old ID format in the case of legacy users.
  
  updatedBy string
  
  Unique identifier for the user who last updated the role. Could be Mongo OID or an old ID format in the case of legacy users.
  
  description string
  
  A helpful description of the role.
  
  lastUpdatedAt string
  
  Required
  
  Timestamp when the role was last updated.
  
  format = "date-time"
  
  assignedScopes array of strings
  
  Selection of scopes added to this role.
  
  userEntitlementType string
  
  Indicates whether this role will trigger promotion of a user from a basic to a full user on tenants with a capacity-based subscription. Does not apply to tenants with a user-based subscription.

com.qlik.v1.role.synced

Example payload of the "Role synced" event

{
  "id": "A234-1234-1234",
  "time": "2026-03-22T10:01:02Z",
  "type": "com.qlik.v1.role.synced",
  "source": "com.qlik/identities",
  "specversion": "1.0",
  "datacontenttype": "application/json",
  "userid": "VZhiEfgW2bLd7HgR-jjzAh6VnicipweT",
  "tenantid": "VZhiEfgW2bLd7HgR-jjzAh6VnicipweT",
  "data": {
    "roles": [
      {
        "id": "507f191e810c19729de860ea",
        "name": "TenantAdmin",
        "type": "default",
        "level": "admin",
        "canEdit": false,
        "fullUser": true,
        "tenantId": "VZhiEfgW2bLd7HgR-jjzAh6VnicipweT",
        "canDelete": false,
        "createdAt": "2021-03-22T10:01:02Z",
        "createdBy": "6228c560543c200449c13255",
        "updatedBy": "6228c560543c200449c13255",
        "description": "Administrator role for the tenant",
        "lastUpdatedAt": "2026-03-22T10:01:02Z",
        "assignedScopes": [
          "scope.read",
          "scope.update"
        ],
        "userEntitlementType": "full"
      }
    ]
  }
}

Published when a role is updated by an admin. Permission lists are not included in the payload due to payload size limits.

Payload

object

id string

Required

Identifies the event.

minLength = 1
time string

Timestamp of when the occurrence happened. Must adhere to RFC 3339.

minLength = 1, format = "date-time"
type string

Required

Unique identifier for the event type.

default = "com.qlik.v1.role.updated"
source string

Required

Identifies the context in which an event happened.

minLength = 1, format = "uri-reference", default = "com.qlik/identities"
specversion string

Required

The version of the CloudEvents specification which the event uses.

minLength = 1
datacontenttype string

Content type of the data value. Must adhere to RFC 2046 format.

minLength = 1
userid string

Unique identifier for the user triggering the event.
tenantid string

Required

Unique identifier for the tenant related to the event.
data object

Represents a role entity.
Show data properties
- _updates array of objects
  
  Collection of updates performed on the resource.
  
  Show _updates properties
  
  path string
  
  Field that was updated.
  
  newValue string
  
  Value of the field after the update.
  
  oldValue string
  
  Value of the field before the update.
- id string
  
  Required
  
  Unique identifier for the role.
  
  format = "uid"
- name string
  
  Required
  
  Name of the role.
- type string
  
  Indicates whether role is system/default or custom.
  
  Can be one of: "default""custom"
- level string
  
  Required
  
  Indicates whether it is a user or admin-level role.
- canEdit boolean
  
  Indicates whether role can be edited by users or not.
- fullUser boolean Deprecated
  
  DEPRECATED. Use userEntitlementType instead for impact of roles on user entitlements with a capacity-based subscription.
- tenantId string
  
  Required
  
  Unique identifier for the tenant associated with the given role.
  
  format = "uid"
- canDelete boolean
  
  Indicates whether role can be deleted by users or not.
- createdAt string
  
  Timestamp when the role was created.
  
  format = "date-time"
- createdBy string
  
  Unique identifier for the user who created the role. Could be Mongo OID or an old ID format in the case of legacy users.
- updatedBy string
  
  Unique identifier for the user who last updated the role. Could be Mongo OID or an old ID format in the case of legacy users.
- description string
  
  A helpful description of the role.
- lastUpdatedAt string
  
  Required
  
  Timestamp when the role was last updated.
  
  format = "date-time"
- assignedScopes array of strings
  
  Selection of scopes added to this role.
- userEntitlementType string
  
  Indicates whether this role will trigger promotion of a user from a basic to a full user on tenants with a capacity-based subscription. Does not apply to tenants with a user-based subscription.

com.qlik.v1.role.updated

Example payload of the "Role updated" event

{
  "id": "A234-1234-1234",
  "time": "2026-03-22T10:01:02Z",
  "type": "com.qlik.v1.role.updated",
  "source": "com.qlik/identities",
  "specversion": "1.0",
  "datacontenttype": "application/json",
  "userid": "VZhiEfgW2bLd7HgR-jjzAh6VnicipweT",
  "tenantid": "VZhiEfgW2bLd7HgR-jjzAh6VnicipweT",
  "data": {
    "_updates": [
      {
        "path": "/attributePath",
        "newValue": "Dan",
        "oldValue": "Dylan"
      }
    ],
    "id": "507f191e810c19729de860ea",
    "name": "TenantAdmin",
    "type": "default",
    "level": "admin",
    "canEdit": false,
    "fullUser": true,
    "tenantId": "VZhiEfgW2bLd7HgR-jjzAh6VnicipweT",
    "canDelete": false,
    "createdAt": "2021-03-22T10:01:02Z",
    "createdBy": "6228c560543c200449c13255",
    "updatedBy": "6228c560543c200449c13255",
    "description": "Administrator role for the tenant",
    "lastUpdatedAt": "2026-03-22T10:01:02Z",
    "assignedScopes": [
      "scope.read",
      "scope.update"
    ],
    "userEntitlementType": "full"
  }
}