Qlik Sense Webhooks API

openapi: 3.2.0
info:
  title: Webhooks API
  version: ''
servers:
- url: https://{tenant}.{region}.qlikcloud.com
  variables:
    region:
      default: us
      description: The region the tenant is hosted in
    tenant:
      default: your-tenant
      description: Name of the tenant that will be called
tags:
- name: Webhooks
paths:
  /api/v1/webhooks:
    get:
      tags:
      - Webhooks
      summary: List webhooks
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/WebhookList'
          description: OK Response
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '500':
          $ref: '#/components/responses/InternalServerError'
        '503':
          $ref: '#/components/responses/ServiceUnavailable'
      parameters:
      - in: query
        name: createdByUserId
        schema:
          type: string
        description: Filter resources by user that created it.
      - in: query
        name: enabled
        schema:
          type: boolean
        description: Filter resources by enabled true/false.
      - in: query
        name: eventTypes
        schema:
          type: string
        description: Filter resources by event-type/types, a single webhook item can have multiple event-types.
      - in: query
        name: level
        schema:
          type: string
        description: Filter resources by level that user has access to (either user or level).
      - in: query
        name: limit
        schema:
          type: number
          default: 20
          maximum: 100
          minimum: 1
        description: Maximum number of webhooks to retrieve.
      - in: query
        name: name
        schema:
          type: string
        description: Filter resources by name (wildcard and case insensitive).
      - in: query
        name: next
        schema:
          type: string
        description: Cursor to the next page.
      - in: query
        name: origins
        schema:
          enum:
          - api
          - automations
          - management-console
          type: string
        description: Filter resources by origins, supports multiorigin.
      - in: query
        name: ownerId
        schema:
          type: string
        description: Filter resources by user that owns it, only applicable for user level webhooks.
      - in: query
        name: prev
        schema:
          type: string
        description: Cursor to the previous page.
      - in: query
        name: sort
        schema:
          enum:
          - name
          - +name
          - -name
          - url
          - +url
          - -url
          - createdAt
          - +createdAt
          - -createdAt
          - updatedAt
          - +updatedAt
          - -updatedAt
          type: string
          default: -createdAt
        description: Field to sort by, prefix with -/+ to indicate order.
      - in: query
        name: updatedByUserId
        schema:
          type: string
        description: Filter resources by user that last updated the webhook.
      - in: query
        name: url
        schema:
          type: string
        description: Filter resources by URL (wildcard and case insensitive).
      description: Retrieves all webhooks entries for a tenant that the user has access to. Users assigned the `TenantAdmin` role can retrieve all webhooks. A user can have up to 150 webhooks at one time.
      operationId: listWebhookEntries
      x-qlik-visibility: public
      x-qlik-stability: stable
      x-qlik-deprecated: false
      x-qlik-tier:
        tier: '1'
        limit: 1000
    post:
      tags:
      - Webhooks
      summary: Create a new webhook
      responses:
        '201':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/WebhookResponse'
          description: OK Response
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '500':
          $ref: '#/components/responses/InternalServerError'
        '503':
          $ref: '#/components/responses/ServiceUnavailable'
      description: Creates a new webhook. User must be assigned the `TenantAdmin` role to create `tenant` level webhooks.
      operationId: createWebhook
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/WebhookPost'
        required: true
      x-qlik-visibility: public
      x-qlik-stability: stable
      x-qlik-deprecated: false
      x-qlik-tier:
        tier: '2'
        limit: 100
  /api/v1/webhooks/{id}:
    get:
      tags:
      - Webhooks
      summary: Get a webhook
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/WebhookResponse'
          description: OK Response
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
        '500':
          $ref: '#/components/responses/InternalServerError'
        '503':
          $ref: '#/components/responses/ServiceUnavailable'
      parameters:
      - in: path
        name: id
        schema:
          type: string
        required: true
        description: The webhook's unique identifier.
      description: Returns details for a specific webhook.
      operationId: getWebhook
      x-qlik-visibility: public
      x-qlik-stability: stable
      x-qlik-deprecated: false
      x-qlik-tier:
        tier: '1'
        limit: 1000
    patch:
      tags:
      - Webhooks
      summary: Update one or more webhook properties
      responses:
        '204':
          description: No Content response.
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
        '500':
          $ref: '#/components/responses/InternalServerError'
        '503':
          $ref: '#/components/responses/ServiceUnavailable'
      parameters:
      - in: path
        name: id
        schema:
          type: string
        required: true
        description: The webhook's unique identifier.
      description: Patches a webhook to update one or more properties.
      operationId: patchWebhook
      requestBody:
        content:
          application/json:
            schema:
              type: array
              items:
                $ref: '#/components/schemas/WebhookPatch'
        required: true
      x-qlik-visibility: public
      x-qlik-stability: stable
      x-qlik-deprecated: false
      x-qlik-tier:
        tier: '2'
        limit: 100
    put:
      tags:
      - Webhooks
      summary: Update all webhook properties
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/WebhookResponse'
          description: OK Response
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
        '500':
          $ref: '#/components/responses/InternalServerError'
        '503':
          $ref: '#/components/responses/ServiceUnavailable'
      parameters:
      - in: path
        name: id
        schema:
          type: string
        required: true
        description: The webhook's unique identifier.
      description: Updates a webhook, any omitted fields will be cleared, returns updated webhook.
      operationId: updateWebhook
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/WebhookBase'
        required: true
      x-qlik-visibility: public
      x-qlik-stability: stable
      x-qlik-deprecated: false
      x-qlik-tier:
        tier: '2'
        limit: 100
    delete:
      tags:
      - Webhooks
      summary: Delete a webhook
      responses:
        '204':
          description: No Content response.
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
        '500':
          $ref: '#/components/responses/InternalServerError'
        '503':
          $ref: '#/components/responses/ServiceUnavailable'
      parameters:
      - in: path
        name: id
        schema:
          type: string
        required: true
        description: The webhook's unique identifier.
      description: Deletes a specific webhook.
      operationId: deleteWebhook
      x-qlik-visibility: public
      x-qlik-stability: stable
      x-qlik-deprecated: false
      x-qlik-tier:
        tier: '2'
        limit: 100
  /api/v1/webhooks/event-types:
    get:
      tags:
      - Webhooks
      summary: List event-types
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/EventTypes'
          description: OK Response
        '401':
          $ref: '#/components/responses/Unauthorized'
        '500':
          $ref: '#/components/responses/InternalServerError'
        '503':
          $ref: '#/components/responses/ServiceUnavailable'
      description: Lists event-types that are possible to subscribe to.
      operationId: listEventTypes
      x-qlik-visibility: public
      x-qlik-stability: stable
      x-qlik-deprecated: false
      x-qlik-tier:
        tier: '1'
        limit: 1000
components:
  responses:
    InternalServerError:
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ErrorResponse'
      description: Internal Server Error
    Unauthorized:
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ErrorResponse'
      description: Unauthorized
    NotFound:
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ErrorResponse'
      description: Not found
    ServiceUnavailable:
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ErrorResponse'
      description: Service Unavailable
    Forbidden:
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ErrorResponse'
      description: Forbidden
    BadRequest:
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ErrorResponse'
      description: Bad Request
  schemas:
    ErrorResponse:
      type: object
      properties:
        errors:
          type: array
          items:
            $ref: '#/components/schemas/Error'
        traceId:
          type: string
          description: A way to trace the source of the error.
    EventType:
      type: object
      properties:
        name:
          type: string
          description: Name of the event type.
        title:
          type: string
          description: Title of the event type.
        levels:
          type: array
          items:
            type: string
          description: Specifies which levels that are supported for this event type.
        category:
          type: string
          description: Category of the event type.
        description:
          type: string
          description: Description of the event type.
    WebhookResponseBase:
      type: object
      required:
      - name
      - url
      properties:
        id:
          type: string
          readOnly: true
          description: The webhook's unique identifier.
        url:
          type: string
          maxLength: 2048
          description: Target URL for webhook HTTPS requests.
        name:
          type: string
          maxLength: 512
          description: The name for the webhook.
        level:
          enum:
          - tenant
          - user
          type: string
          default: tenant
          description: 'Defines at what level the webhook should operate: for all resources belonging to a tenant or restricted to only those accessible by the webhook-creator.'
        filter:
          type: string
          example: id eq "id123" or spaceId eq "spaceId123" or spaceId eq "spaceId456" or topLevelResourceId eq "id789"
          description: 'Filter that should match for a webhook to be triggered.

            Supported common attribute names are ''id'', ''spaceId'' and ''topLevelResourceId'', beside the common attributes the "com.qlik.v1.app.reload.finished" event also supports "data.status" that could be either "ok" or "error" but can''t be used together with other event types.

            Supported attribute operators are ''eq'' and ''ne''.

            Supported logical operators are ''and'' and ''or''.

            Note that attribute values must be valid JSON strings, hence they''re enclosed with double quotes.

            For more detailed information regarding the SCIM filter syntax (RFC7644) used please follow the link to external documentation.'
          externalDocs:
            url: https://datatracker.ietf.org/doc/html/rfc7644#section-3.4.2.2
            description: More information about the SCIM filter syntax (RFC7644)
        secret:
          type: string
          maxLength: 64
          minLength: 32
          description: String used as secret for calculating HMAC hash sent as header.
          x-qlik-deprecated: true
          x-qlik-deprecated-sunset: 2025-11
          x-qlik-deprecated-description: secret field in response will be removed to make it non-retrievable and secretKeyAdded field will provide status if the secret key is added or not
        enabled:
          type: boolean
          default: false
          description: Whether the webhook is active and sending requests.
        headers:
          type: object
          example:
            headerName: headerValue
          description: 'Additional headers in the post request. Maximum size: 2048 bytes for non-encrypted headers.'
          additionalProperties:
            type: string
        ownerId:
          type: string
          description: The id of the user that owns the webhook, only applicable for user level webhooks.
        createdAt:
          type: string
          format: date-time
          readOnly: true
          description: The UTC timestamp when the webhook was created.
        updatedAt:
          type: string
          format: date-time
          readOnly: true
          description: The UTC timestamp when the webhook was last updated.
        eventTypes:
          type: array
          items:
            type: string
          description: Types of events for which the webhook should trigger. Retrieve available types from `/v1/webhooks/event-types`.
        description:
          type: string
          maxLength: 1024
          description: The reason for creating the webhook.
        disabledReason:
          type: string
          readOnly: true
          description: The reason for the webhook to be disabled.
        secretKeyAdded:
          type: boolean
          description: Provides status of the string used as secret for calculating HMAC hash sent as header is already added or not.
        createdByUserId:
          type: string
          readOnly: true
          description: The id of the user that created the webhook.
        updatedByUserId:
          type: string
          readOnly: true
          description: The id of the user that last updated the webhook.
        encryptedHeaders:
          type: array
          items:
            type: string
          example:
          - header1
          - header2
          description: 'Additional encrypted headers in the post request. Maximum size: 2048 bytes for encrypted headers.'
        disabledReasonCode:
          type: string
          readOnly: true
          description: The unique code for the reason.
        enableCloudEventDelivery:
          type: boolean
          default: true
          description: If enabled the webhook will be sent as a CloudEvent, once enabled for a webhook it cannot be disabled.
        checkCertificateRevocation:
          type: boolean
          default: false
          description: If enabled the certificate chain of the configured URL will be checked for revocation before sending the webhook.
    WebhookList:
      type: object
      properties:
        data:
          type: array
          items:
            $ref: '#/components/schemas/WebhookResponse'
        links:
          properties:
            next:
              $ref: '#/components/schemas/Link'
            prev:
              $ref: '#/components/schemas/Link'
            self:
              $ref: '#/components/schemas/Link'
    EventTypes:
      type: object
      properties:
        data:
          type: array
          items:
            $ref: '#/components/schemas/EventType'
    WebhookPost:
      allOf:
      - $ref: '#/components/schemas/WebhookBase'
      - type: object
        properties:
          origin:
            enum:
            - api
            - automations
            - management-console
            type: string
            default: api
            description: Indicates from where the webhook was created and its purpose.
    WebhookPatch:
      type: object
      required:
      - op
      - path
      properties:
        op:
          enum:
          - add
          - remove
          - replace
          type: string
          description: The operation to be performed.
        path:
          enum:
          - /name
          - /description
          - /url
          - /eventTypes
          - /headers
          - /enabled
          - /secret
          - /encryptedHeaders
          - /enableCloudEventDelivery
          type: string
          example: /description
          description: The path for the given resource field to patch.
        value:
          oneOf:
          - type: boolean
          - type: integer
          - type: object
          - type: string
          description: The value to be used for this operation.
      description: A JSON Patch document as defined in https://datatracker.ietf.org/doc/html/rfc6902
    Error:
      type: object
      required:
      - code
      - title
      properties:
        code:
          type: string
          description: The unique code for the error.
        title:
          type: string
          description: A summary of what went wrong.
        detail:
          type: string
          description: May be used to provide additional details.
    WebhookBase:
      type: object
      required:
      - name
      - url
      properties:
        id:
          type: string
          readOnly: true
          description: The webhook's unique identifier.
        url:
          type: string
          maxLength: 2048
          description: Target URL for webhook HTTPS requests.
        name:
          type: string
          maxLength: 512
          description: The name for the webhook.
        level:
          enum:
          - tenant
          - user
          type: string
          default: tenant
          description: 'Defines at what level the webhook should operate: for all resources belonging to a tenant or restricted to only those accessible by the webhook-creator.'
        filter:
          type: string
          example: id eq "id123" or spaceId eq "spaceId123" or spaceId eq "spaceId456" or topLevelResourceId eq "id789"
          description: 'Filter that should match for a webhook to be triggered.

            Supported common attribute names are ''id'', ''spaceId'' and ''topLevelResourceId'', beside the common attributes the "com.qlik.v1.app.reload.finished" event also supports "data.status" that could be either "ok" or "error" but can''t be used together with other event types.

            Supported attribute operators are ''eq'' and ''ne''.

            Supported logical operators are ''and'' and ''or''.

            Note that attribute values must be valid JSON strings, hence they''re enclosed with double quotes.

            For more detailed information regarding the SCIM filter syntax (RFC7644) used please follow the link to external documentation.'
          externalDocs:
            url: https://datatracker.ietf.org/doc/html/rfc7644#section-3.4.2.2
            description: More information about the SCIM filter syntax (RFC7644)
        secret:
          type: string
          maxLength: 64
          minLength: 32
          description: String used as secret for calculating HMAC hash sent as header.
        enabled:
          type: boolean
          default: false
          description: Whether the webhook is active and sending requests.
        headers:
          type: object
          example:
            headerName: headerValue
          description: 'Additional headers in the post request (webhook delivery). Note: duplicate headers are not allowed and are case-insensitive. Maximum size: 2048 bytes for non-encrypted headers.'
          additionalProperties:
            type: string
        ownerId:
          type: string
          description: The id of the user that owns the webhook, only applicable for user level webhooks.
        createdAt:
          type: string
          format: date-time
          readOnly: true
          description: The UTC timestamp when the webhook was created.
        updatedAt:
          type: string
          format: date-time
          readOnly: true
          description: The UTC timestamp when the webhook was last updated.
        eventTypes:
          type: array
          items:
            type: string
          description: Types of events for which the webhook should trigger. Retrieve available types from `/v1/webhooks/event-types`.
        description:
          type: string
          maxLength: 1024
          description: The reason for creating the webhook.
        disabledReason:
          type: string
          readOnly: true
          description: The reason for the webhook to be disabled.
        createdByUserId:
          type: string
          readOnly: true
          description: The id of the user that created the webhook.
        updatedByUserId:
          type: string
          readOnly: true
          description: The id of the user that last updated the webhook.
        encryptedHeaders:
          type: object
          example:
            headerName: sensitiveHeaderValue
          description: 'These headers are persisted encrypted and decrypted to be sent as normal headers in post request (webhook delivery), in case of URL change these headers will need to be re-entered. Note: duplicate headers are not allowed and are case-insensitive. Maximum size: 2048 bytes for encrypted headers.'
          additionalProperties:
            type: string
        disabledReasonCode:
          type: string
          readOnly: true
          description: The unique code for the reason.
        enableCloudEventDelivery:
          type: boolean
          default: true
          description: If enabled the webhook will be sent as a CloudEvent, once enabled for a webhook it cannot be disabled.
        checkCertificateRevocation:
          type: boolean
          default: false
          description: If enabled the certificate chain of the configured URL will be checked for revocation before sending the webhook.
    WebhookResponse:
      allOf:
      - $ref: '#/components/schemas/WebhookResponseBase'
      - type: object
        properties:
          origin:
            enum:
            - api
            - automations
            - management-console
            type: string
            default: api
            readOnly: true
            description: Indicates from where the webhook was created and its purpose.
    Link:
      required:
      - href
      properties:
        href:
          type: string
          description: URL to a resource request.