User sessions

Download AsyncAPI spec

Events emitted when user sessions begin or end in a Qlik Cloud tenant. These events enable monitoring of user authentication events for security and audit purposes.

Preferred events

These events replace the legacy User sessions events. Use these events for all new implementations.

Published when a user session is created.

Payload

object

id string

Required

Identifies the event.

minLength = 1
time string

Timestamp of when the occurrence happened. Must adhere to RFC 3339.

minLength = 1, format = "date-time"
type string

Required

The type of event.

default = "com.qlik.core.user-session.begun"
source string

Required

Identifies the context in which an event happened.

minLength = 1, format = "uri-reference"
specversion string

Required

The version of the CloudEvents specification which the event uses.

minLength = 1
datacontenttype string

Content type of the data value. Must adhere to RFC 2046 format.

minLength = 1, default = "application/json"
meta object

Additional request metadata carried as a CloudEvents extension.
Show meta properties
- userAgent string
  
  The User-Agent header of the request that triggered the event.
userid string

Unique identifier for the user triggering the event.
authtype string

The type of principal that triggered the occurrence.
originip string

Origin IP address.
tenantid string

Required

Unique identifier for the tenant related to the event.
sessionid string

Unique identifier for the session related to the event.
authclaims string

A JSON string representing claims of the principal that triggered the event
tracestate string

W3C Trace Context tracestate header propagated with the event.
traceparent string

W3C Trace Context traceparent header propagated with the event.
data object

Required

Data specific to the user session begun event.
Show data properties
- idpId string
  
  Identifier of the identity provider through which the session was initiated. Omitted when no external identity provider was used.
- source string
  
  The authentication flow that initiated the session, for example interactive (interactive browser login) or jwt-login-session (JWT login).
- subject string
  
  User's subject identifier in the identity database.
- recovery boolean
  
  Whether the session is part of a recovery login.
- userType string
  
  The user's type, only specified for anonymous users.
  
  Can be one of: "anonymous"

com.qlik.core.user-session.begun

Example payload of the "Session begun" event

{
  "id": "A234-1234-1234",
  "time": "2026-01-01T12:00:00Z",
  "type": "com.qlik.core.user-session.begun",
  "source": "com.qlik/my-service",
  "specversion": "1.0",
  "datacontenttype": "application/json",
  "meta": {
    "userAgent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36"
  },
  "userid": "605a18af2ab08cdbfad09259",
  "authtype": "service_account",
  "originip": "0.0.0.0",
  "tenantid": "TiQ8GPVr8qI714Lp5ChAAFFaU24MJy69",
  "sessionid": "WZhiEfgW2bLd7HgR-jjzAh6VnicipweT",
  "authclaims": "{\\\"iss\\\":\\\"qlik.api.internal/service\\\",\\\"sub\\\":\\\"service\\\",\\\"subType\\\":\\\"service\\\"}",
  "tracestate": "rojo=00f067aa0ba902b7,congo=t61rcWkgMzE",
  "traceparent": "00-0af7651916cd43dd8448eb211c80319c-b7ad6b7169203331-01",
  "data": {
    "idpId": "661d627cef218789bbd67cc9",
    "source": "interactive",
    "subject": "auth0\\foo",
    "recovery": false
  }
}

Published when a user session ends.

Payload

object

id string

Required

Identifies the event.

minLength = 1
time string

Timestamp of when the occurrence happened. Must adhere to RFC 3339.

minLength = 1, format = "date-time"
type string

Required

The type of event.

default = "com.qlik.core.user-session.ended"
source string

Required

Identifies the context in which an event happened.

minLength = 1, format = "uri-reference"
specversion string

Required

The version of the CloudEvents specification which the event uses.

minLength = 1
datacontenttype string

Content type of the data value. Must adhere to RFC 2046 format.

minLength = 1, default = "application/json"
meta object

Additional request metadata carried as a CloudEvents extension.
Show meta properties
- userAgent string
  
  The User-Agent header of the request that triggered the event.
userid string

Unique identifier for the user triggering the event.
authtype string

The type of principal that triggered the occurrence.
originip string

Origin IP address.
tenantid string

Required

Unique identifier for the tenant related to the event.
sessionid string

Unique identifier for the session related to the event.
authclaims string

A JSON string representing claims of the principal that triggered the event
tracestate string

W3C Trace Context tracestate header propagated with the event.
traceparent string

W3C Trace Context traceparent header propagated with the event.
data object

Required

Data specific to the user session end event.
Show data properties
- subject string
  
  User's subject identifier in the identity database.

com.qlik.core.user-session.ended

Example payload of the "Session ended" event

{
  "id": "A234-1234-1234",
  "time": "2026-01-01T12:00:00Z",
  "type": "com.qlik.core.user-session.ended",
  "source": "com.qlik/my-service",
  "specversion": "1.0",
  "datacontenttype": "application/json",
  "meta": {
    "userAgent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36"
  },
  "userid": "605a18af2ab08cdbfad09259",
  "authtype": "service_account",
  "originip": "0.0.0.0",
  "tenantid": "TiQ8GPVr8qI714Lp5ChAAFFaU24MJy69",
  "sessionid": "WZhiEfgW2bLd7HgR-jjzAh6VnicipweT",
  "authclaims": "{\\\"iss\\\":\\\"qlik.api.internal/service\\\",\\\"sub\\\":\\\"service\\\",\\\"subType\\\":\\\"service\\\"}",
  "tracestate": "rojo=00f067aa0ba902b7,congo=t61rcWkgMzE",
  "traceparent": "00-0af7651916cd43dd8448eb211c80319c-b7ad6b7169203331-01",
  "data": {
    "subject": "auth0\\foo"
  }
}