Roles

Download AsyncAPI spec

Role events notify you about lifecycle changes to roles in your Qlik Cloud tenant, enabling you to track access control modifications and role management activity.

Preferred events

These events replace the legacy Roles events. Use these events for all new implementations.

Published when a role is created. Permission lists are not included in the payload due to payload size limits, but assigned scopes for custom roles will be included.

Payload

object

id string

Required

Identifies the event.

minLength = 1
time string

Timestamp of when the occurrence happened. Must adhere to RFC 3339.

minLength = 1, format = "date-time"
type string

Required

Unique identifier for the event type.

default = "com.qlik.core.role.created"
source string

Required

Identifies the context in which an event happened.

minLength = 1, format = "uri-reference", default = "com.qlik/identities"
specversion string

Required

The version of the CloudEvents specification which the event uses.

minLength = 1
datacontenttype string

Content type of the data value. Must adhere to RFC 2046 format.

minLength = 1, default = "application/json"
userid string

Unique identifier for the user triggering the event.
tenantid string

Required

Unique identifier for the tenant related to the event.
data object

Represents a role entity.
Show data properties
- id string
  
  Required
  
  Unique identifier for the role.
  
  format = "uid"
- name string
  
  Required
  
  Name of the role. Custom roles can have user-defined names.
- type string
  
  Indicates whether role is system/default or custom.
  
  Can be one of: "default""custom"
- level string
  
  Required
  
  Indicates whether it is a user or admin-level role.
  
  Can be one of: "admin""user"
- canEdit boolean
  
  Indicates whether role can be edited by users or not.
- tenantId string
  
  Required
  
  Unique identifier for the tenant associated with the given role.
  
  format = "uid"
- canDelete boolean
  
  Indicates whether role can be deleted by users or not.
- createdAt string
  
  Timestamp when the role was created.
  
  format = "date-time"
- createdBy string
  
  Unique identifier for the user who created the role.
- updatedBy string
  
  Unique identifier for the user who last updated the role.
- description string
  
  Description of the role.
- lastUpdatedAt string
  
  Required
  
  Timestamp when the role was last updated.
  
  format = "date-time"
- assignedScopes array of strings
  
  Selection of scopes added to this role.
- userEntitlementType string
  
  Indicates whether this role will trigger promotion of a user from a basic to a full user on tenants with a capacity-based subscription. Does not apply to tenants with a user-based subscription.

com.qlik.core.role.created

Example payload of the "Role created" event

{
  "id": "A234-1234-1234",
  "time": "2026-03-22T10:01:02Z",
  "type": "com.qlik.core.role.created",
  "source": "com.qlik/identities",
  "specversion": "1.0",
  "datacontenttype": "application/json",
  "userid": "aBcDeFgH1jKlMnOpQrStUvWxYz012345",
  "tenantid": "VZhiEfgW2bLd7HgR-jjzAh6VnicipweT",
  "data": {
    "id": "507f191e810c19729de860ea",
    "name": "TenantAdmin",
    "type": "default",
    "level": "admin",
    "canEdit": false,
    "tenantId": "VZhiEfgW2bLd7HgR-jjzAh6VnicipweT",
    "canDelete": false,
    "createdAt": "2021-03-22T10:01:02Z",
    "createdBy": "6228c560543c200449c13255",
    "updatedBy": "6228c560543c200449c13255",
    "description": "Administrator role for the tenant",
    "lastUpdatedAt": "2026-03-22T10:01:02Z",
    "assignedScopes": [
      "scope.read",
      "scope.update"
    ],
    "userEntitlementType": "fullUser"
  }
}

Published when a role is deleted.

Payload

object

id string

Required

Identifies the event.

minLength = 1
time string

Timestamp of when the occurrence happened. Must adhere to RFC 3339.

minLength = 1, format = "date-time"
type string

Required

Unique identifier for the event type.

default = "com.qlik.core.role.deleted"
source string

Required

Identifies the context in which an event happened.

minLength = 1, format = "uri-reference", default = "com.qlik/identities"
specversion string

Required

The version of the CloudEvents specification which the event uses.

minLength = 1
datacontenttype string

Content type of the data value. Must adhere to RFC 2046 format.

minLength = 1, default = "application/json"
userid string

Unique identifier for the user triggering the event.
tenantid string

Required

Unique identifier for the tenant related to the event.
data object

Represents a role entity.
Show data properties
- id string
  
  Required
  
  Unique identifier for the role.
  
  format = "uid"
- name string
  
  Required
  
  Name of the role. Custom roles can have user-defined names.
- type string
  
  Indicates whether role is system/default or custom.
  
  Can be one of: "default""custom"
- level string
  
  Required
  
  Indicates whether it is a user or admin-level role.
  
  Can be one of: "admin""user"
- canEdit boolean
  
  Indicates whether role can be edited by users or not.
- tenantId string
  
  Required
  
  Unique identifier for the tenant associated with the given role.
  
  format = "uid"
- canDelete boolean
  
  Indicates whether role can be deleted by users or not.
- createdAt string
  
  Timestamp when the role was created.
  
  format = "date-time"
- createdBy string
  
  Unique identifier for the user who created the role.
- updatedBy string
  
  Unique identifier for the user who last updated the role.
- description string
  
  Description of the role.
- lastUpdatedAt string
  
  Required
  
  Timestamp when the role was last updated.
  
  format = "date-time"
- assignedScopes array of strings
  
  Selection of scopes added to this role.
- userEntitlementType string
  
  Indicates whether this role will trigger promotion of a user from a basic to a full user on tenants with a capacity-based subscription. Does not apply to tenants with a user-based subscription.

com.qlik.core.role.deleted

Example payload of the "Role deleted" event

{
  "id": "A234-1234-1234",
  "time": "2026-03-22T10:01:02Z",
  "type": "com.qlik.core.role.deleted",
  "source": "com.qlik/identities",
  "specversion": "1.0",
  "datacontenttype": "application/json",
  "userid": "aBcDeFgH1jKlMnOpQrStUvWxYz012345",
  "tenantid": "VZhiEfgW2bLd7HgR-jjzAh6VnicipweT",
  "data": {
    "id": "507f191e810c19729de860ea",
    "name": "TenantAdmin",
    "type": "default",
    "level": "admin",
    "canEdit": false,
    "tenantId": "VZhiEfgW2bLd7HgR-jjzAh6VnicipweT",
    "canDelete": false,
    "createdAt": "2021-03-22T10:01:02Z",
    "createdBy": "6228c560543c200449c13255",
    "updatedBy": "6228c560543c200449c13255",
    "description": "Administrator role for the tenant",
    "lastUpdatedAt": "2026-03-22T10:01:02Z",
    "assignedScopes": [
      "scope.read",
      "scope.update"
    ],
    "userEntitlementType": "fullUser"
  }
}

Published when role definitions are synchronized across the platform. This is a platform-wide event, not associated with a tenant or user. The envelope does not include tenantid or userid. Permission lists are not included in the payload due to payload size limits. Retrieve them from the roles API when required.

Payload

object

id string

Required

Identifies the event.

minLength = 1
time string

Timestamp of when the occurrence happened. Must adhere to RFC 3339.

minLength = 1, format = "date-time"
type string

Required

Unique identifier for the event type.

default = "com.qlik.core.role.synced"
source string

Required

Identifies the context in which an event happened.

minLength = 1, format = "uri-reference", default = "com.qlik/identities"
specversion string

Required

The version of the CloudEvents specification which the event uses.

minLength = 1
datacontenttype string

Content type of the data value. Must adhere to RFC 2046 format.

minLength = 1, default = "application/json"
data object

Payload containing the roles that were synced.
Show data properties
- roles array of objects
  
  Represents a role entity.
  
  Show roles properties
  
  id string
  
  Required
  
  Unique identifier for the role.
  
  format = "uid"
  
  name string
  
  Required
  
  Name of the role. Custom roles can have user-defined names.
  
  type string
  
  Indicates whether role is system/default or custom.
  
  Can be one of: "default""custom"
  
  level string
  
  Required
  
  Indicates whether it is a user or admin-level role.
  
  Can be one of: "admin""user"
  
  canEdit boolean
  
  Indicates whether role can be edited by users or not.
  
  tenantId string
  
  Required
  
  Unique identifier for the tenant associated with the given role.
  
  format = "uid"
  
  canDelete boolean
  
  Indicates whether role can be deleted by users or not.
  
  createdAt string
  
  Timestamp when the role was created.
  
  format = "date-time"
  
  createdBy string
  
  Unique identifier for the user who created the role.
  
  updatedBy string
  
  Unique identifier for the user who last updated the role.
  
  description string
  
  Description of the role.
  
  lastUpdatedAt string
  
  Required
  
  Timestamp when the role was last updated.
  
  format = "date-time"
  
  assignedScopes array of strings
  
  Selection of scopes added to this role.
  
  userEntitlementType string
  
  Indicates whether this role will trigger promotion of a user from a basic to a full user on tenants with a capacity-based subscription. Does not apply to tenants with a user-based subscription.

com.qlik.core.role.synced

Example payload of the "Role synced" event

{
  "id": "A234-1234-1234",
  "time": "2026-03-22T10:01:02Z",
  "type": "com.qlik.core.role.synced",
  "source": "com.qlik/identities",
  "specversion": "1.0",
  "datacontenttype": "application/json",
  "data": {
    "roles": [
      {
        "id": "507f191e810c19729de860ea",
        "name": "TenantAdmin",
        "type": "default",
        "level": "admin",
        "canEdit": false,
        "tenantId": "VZhiEfgW2bLd7HgR-jjzAh6VnicipweT",
        "canDelete": false,
        "createdAt": "2021-03-22T10:01:02Z",
        "createdBy": "6228c560543c200449c13255",
        "updatedBy": "6228c560543c200449c13255",
        "description": "Administrator role for the tenant",
        "lastUpdatedAt": "2026-03-22T10:01:02Z",
        "assignedScopes": [
          "scope.read",
          "scope.update"
        ],
        "userEntitlementType": "fullUser"
      }
    ]
  }
}

Published when a role is updated. Permission lists are not included in the payload due to payload size limits.

Payload

object

id string

Required

Identifies the event.

minLength = 1
time string

Timestamp of when the occurrence happened. Must adhere to RFC 3339.

minLength = 1, format = "date-time"
type string

Required

Unique identifier for the event type.

default = "com.qlik.core.role.updated"
source string

Required

Identifies the context in which an event happened.

minLength = 1, format = "uri-reference", default = "com.qlik/identities"
specversion string

Required

The version of the CloudEvents specification which the event uses.

minLength = 1
datacontenttype string

Content type of the data value. Must adhere to RFC 2046 format.

minLength = 1, default = "application/json"
userid string

Unique identifier for the user triggering the event.
tenantid string

Required

Unique identifier for the tenant related to the event.
data object

The event data payload containing the updated role and the _updates field-level change set.
Show data properties
- _updates array of objects
  
  Collection of updates performed on the resource.
  
  Show _updates properties
  
  path string
  
  Field that was updated.
  
  newValue any
  
  JSON value of the field after the update. The value can be a scalar, array, object, or null, depending on the field.
  
  oldValue any
  
  JSON value of the field before the update. The value can be a scalar, array, object, or null, depending on the field.
- id string
  
  Required
  
  Unique identifier for the role.
  
  format = "uid"
- name string
  
  Required
  
  Name of the role. Custom roles can have user-defined names.
- type string
  
  Indicates whether role is system/default or custom.
  
  Can be one of: "default""custom"
- level string
  
  Required
  
  Indicates whether it is a user or admin-level role.
  
  Can be one of: "admin""user"
- canEdit boolean
  
  Indicates whether role can be edited by users or not.
- tenantId string
  
  Required
  
  Unique identifier for the tenant associated with the given role.
  
  format = "uid"
- canDelete boolean
  
  Indicates whether role can be deleted by users or not.
- createdAt string
  
  Timestamp when the role was created.
  
  format = "date-time"
- createdBy string
  
  Unique identifier for the user who created the role.
- updatedBy string
  
  Unique identifier for the user who last updated the role.
- description string
  
  Description of the role.
- lastUpdatedAt string
  
  Required
  
  Timestamp when the role was last updated.
  
  format = "date-time"
- assignedScopes array of strings
  
  Selection of scopes added to this role.
- userEntitlementType string
  
  Indicates whether this role will trigger promotion of a user from a basic to a full user on tenants with a capacity-based subscription. Does not apply to tenants with a user-based subscription.

com.qlik.core.role.updated

Example payload of the "Role updated" event

{
  "id": "A234-1234-1234",
  "time": "2026-03-22T10:01:02Z",
  "type": "com.qlik.core.role.updated",
  "source": "com.qlik/identities",
  "specversion": "1.0",
  "datacontenttype": "application/json",
  "userid": "aBcDeFgH1jKlMnOpQrStUvWxYz012345",
  "tenantid": "VZhiEfgW2bLd7HgR-jjzAh6VnicipweT",
  "data": {
    "_updates": [
      {
        "path": "/attributePath",
        "newValue": "Dan",
        "oldValue": "Dylan"
      }
    ],
    "id": "507f191e810c19729de860ea",
    "name": "TenantAdmin",
    "type": "default",
    "level": "admin",
    "canEdit": false,
    "tenantId": "VZhiEfgW2bLd7HgR-jjzAh6VnicipweT",
    "canDelete": false,
    "createdAt": "2021-03-22T10:01:02Z",
    "createdBy": "6228c560543c200449c13255",
    "updatedBy": "6228c560543c200449c13255",
    "description": "Administrator role for the tenant",
    "lastUpdatedAt": "2026-03-22T10:01:02Z",
    "assignedScopes": [
      "scope.read",
      "scope.update"
    ],
    "userEntitlementType": "fullUser"
  }
}