REST APIs

Qlik offers a set of REST APIs to observe and manage a Qlik Cloud tenant. These APIs are generally service-oriented and provide a way of configuring most capabilities in a tenant, enabling programmatic deployments, CI/CD, monitoring, and more.

For access to data in Qlik Sense apps, refer to the QIX API.

What are REST APIs?

REST (Representational State Transfer) is an architectural style for designing networked applications. Qlik REST APIs use a request-response model where a client sends a request to a service, and the service responds with the requested resource.

Authentication

Supported authentication methods

Qlik REST APIs support different authentication methods:

OAuth 2.0: the recommended method for nearly all use cases.
JSON Web Tokens (JWT): used for legacy embedding solutions where a proxy is in use, or third-party cookie blocking isn’t a concern.
API keys: a simple way of providing access to APIs with the same permissions of the creating user.

For more information about how to authenticate your requests, see the Authentication Guide.

CSRF token

When calling Qlik REST APIs in a browser context, you must send a CSRF token with your request. If the CSRF token is missing or invalid, the API will reject the request.

The CSRF token is used to prevent cross-site request forgery (CSRF) attacks. These attacks happen when a malicious website tricks your browser into performing actions, like sending a request, on another website where you’re authenticated, without your consent.

To send the CSRF token, include it in your request using the qlik-csrf-token header. For example:

GET /api/v1/<RESOURCE> HTTP/1.1
Host: <TENANT>.<REGION>.qlikcloud.com
Authorization: Bearer <ACCESS_TOKEN>
qlik-csrf-token: <CSRF_TOKEN>

You can retrieve the CSRF token using the CSRF token API. The response headers will include the CSRF token.

Resources and requests

Each resource is exposed by a uniform resource identifier (URI). You can send an HTTP request to the relevant URI to access a resource.

Each request is made up of the following:

HTTP method
URI
Headers
Request body

URI structure

The URI is the path to a resource. The URI is different for each resource, but the structure remains the same for all resources:

https://your-tenant.region.qlikcloud.com/api/v1/resource

your-tenant is the hostname of your tenant, generated during tenant creation (and cannot be changed), or a custom alias name that you can define.
region is the region where your tenant is deployed, for example eu or us.
resource is the resource you want to access, which could include query or path parameters.

For example, the URI to retrieve the current user info looks like this:

https://mytenant.us.qlikcloud.com/api/v1/users/me

HTTP methods

Qlik REST APIs use the following HTTP methods:

GET: retrieve a resource.
POST: create a new resource.
PUT: update an existing resource.
DELETE: remove a resource.

Headers

Commonly used headers are:

Authorization: specifies the token used to authorize the request. Example: Authorization: Bearer <token>
Content-type: specifies the format of the request body. Example: Content-Type: application/json

Rate limiting

To ensure fair usage, Qlik implements rate limiting on API requests. Be sure to handle rate limit errors (HTTP 429) in your applications.

For more information, see Rate limiting.

Pagination

Qlik uses cursor-based pagination to split results into subsets called pages. After retrieving the first subset of results, you can use the returned links.next URL in the response to retrieve the results from the next page.

For more information, see Pagination.