Webhooks

Webhooks are a way for Qlik Cloud to provide other applications with real-time information.

Endpoints

GET

/api/core/webhooks
POST

/api/core/webhooks
GET

/api/core/webhooks/{id}
PATCH

/api/core/webhooks/{id}
PUT

/api/core/webhooks/{id}
DELETE

/api/core/webhooks/{id}
GET

/api/core/webhooks/{id}/deliveries
GET

/api/core/webhooks/{id}/deliveries/{deliveryId}
POST

/api/core/webhooks/{id}/deliveries/{deliveryId}/actions/resend
GET

/api/core/webhooks/event-types

Retrieves all webhook entries for a tenant that the user has access to. Users assigned the TenantAdmin role can retrieve all webhooks of the tenant; other users only retrieve the webhooks they own. Values of encryptedHeaders are never returned, only their header names.

Facts

	Rate limit	Tier 1 (1000 requests per minute)
	Replaces	GET v1/webhooks

Query Parameters

createdByUserId string

Filter resources by user that created it
enabled boolean

Filter resources by enabled true/false
eventTypes string

Filter resources by event-type. Accepts a comma-separated list, and a webhook must subscribe to every listed event-type to match (AND semantics). A single webhook can subscribe to multiple event-types. Values must be event-types returned by GET /core/webhooks/event-types.
level string

Filter resources by the level the webhook operates at: tenant for all resources of the tenant, or user for only the resources accessible to the webhook owner.
limit number

Maximum number of webhooks to retrieve

minimum = 1, maximum = 100, default = 20, default = 20
name string

Filter resources by name. The value is matched as a case-insensitive substring, not as a glob pattern, so prod matches Production webhook.
next string

Cursor to the next page
origins string

Filter resources by origin. The implementation also accepts a comma-separated list, in which case a webhook matches if its origin is any of the listed values (OR semantics).

Can be one of: "api""automations""management-console"
ownerId string

Filter resources by user that owns it, only applicable for user level webhooks
prev string

Cursor to the previous page.
sort string

Field to sort by, prefix with -/+ to indicate order

Can be one of: "name""+name""-name""url""+url""-url""createdAt""+createdAt""-createdAt""updatedAt""+updatedAt""-updatedAt"
default = "-createdAt"
updatedByUserId string

Filter resources by user that last updated the webhook
url string

Filter resources by URL. The value is matched as a case-insensitive substring, not as a glob pattern, so example.com matches https://example.com/hook.

Responses

200

OK Response

application/json object
Show application/json properties
- data array of objects
  
  Show data properties
  
  id string
  
  The webhook's unique identifier
  
  url string
  
  Required
  
  Target URL for webhook HTTPS requests
  
  maxLength = 2048
  
  name string
  
  Required
  
  The name for the webhook
  
  maxLength = 512
  
  level string
  
  Defines at what level the webhook should operate: for all resources belonging to a tenant or restricted to only those accessible by the webhook-creator.
  
  Can be one of: "tenant""user"
  default = "tenant"
  
  filter string
  
  Filter that should match for a webhook to be triggered. Supported common attribute names are 'id', 'spaceId' and 'topLevelResourceId'. Individual event-types can support additional event-specific attributes, which cannot be combined with other event-types in the same webhook. For example "com.qlik.v1.app.reload.finished" supports "data.status" with the allowed values "SUCCEEDED", "FAILED", "CANCELED" and "EXCEEDED_LIMIT". The authoritative set of filterable attributes and their allowed values for each event-type is returned in the allowedFilters property of GET /core/webhooks/event-types. Supported attribute operators are 'eq' and 'ne'. Supported logical operators are 'and' and 'or'. Note that attribute values must be valid JSON strings, hence they're enclosed with double quotes. For more detailed information regarding the SCIM filter syntax (RFC7644) used please follow the link to external documentation.
  
  enabled boolean
  
  Whether the webhook is active and sending requests
  
  default = false
  
  headers object
  
  Additional headers in the post request. Maximum combined size: 2048 bytes (total of all header names and values).
  
  Show additional optional properties
  
  string string
  
  ownerId string
  
  The id of the user that owns the webhook, only applicable for user level webhooks
  
  createdAt string
  
  The UTC timestamp when the webhook was created
  
  format = "date-time"
  
  updatedAt string
  
  The UTC timestamp when the webhook was last updated
  
  format = "date-time"
  
  eventTypes array of strings
  
  Types of events for which the webhook should trigger. Retrieve available types from /core/webhooks/event-types.
  
  description string
  
  The reason for creating the webhook
  
  maxLength = 1024
  
  disabledReason string
  
  The reason for the webhook to be disabled
  
  secretKeyAdded boolean
  
  Whether a signing secret is currently stored for this webhook. The secret itself is never returned.
  
  createdByUserId string
  
  The id of the user that created the webhook
  
  updatedByUserId string
  
  The id of the user that last updated the webhook
  
  encryptedHeaders array of strings
  
  Names of the encrypted headers that are sent with the post request. Only the header names are returned; the values are never disclosed. Maximum combined size: 2048 bytes (total of all encrypted header names and values).
  
  disabledReasonCode string
  
  The unique code for the reason
  
  enableCloudEventDelivery boolean
  
  Whether this webhook delivers events as CloudEvents. Once enabled, it cannot be disabled.
  
  checkCertificateRevocation boolean
  
  If enabled the certificate chain of the configured URL will be checked for revocation before sending the webhook.
  
  default = false
  
  origin string
  
  Indicates from where the webhook was created and its purpose
  
  Can be one of: "api""automations""management-console"
  default = "api"
- links object
  
  Show links properties
  
  next object
  
  Show next properties
  
  href string
  
  Required
  
  URL to a resource request
  
  prev object
  
  Show prev properties
  
  href string
  
  Required
  
  URL to a resource request
  
  self object
  
  Show self properties
  
  href string
  
  Required
  
  URL to a resource request

400

Bad Request

application/json object
Show application/json properties
- errors array of objects
  
  Show errors properties
  
  code string
  
  Required
  
  The unique code for the error
  
  title string
  
  Required
  
  A summary of what went wrong
  
  detail string
  
  May be used to provide additional details
- traceId string
  
  A way to trace the source of the error.

401

Unauthorized

application/json object
Show application/json properties
- errors array of objects
  
  Show errors properties
  
  code string
  
  Required
  
  The unique code for the error
  
  title string
  
  Required
  
  A summary of what went wrong
  
  detail string
  
  May be used to provide additional details
- traceId string
  
  A way to trace the source of the error.

403

Forbidden

application/json object
Show application/json properties
- errors array of objects
  
  Show errors properties
  
  code string
  
  Required
  
  The unique code for the error
  
  title string
  
  Required
  
  A summary of what went wrong
  
  detail string
  
  May be used to provide additional details
- traceId string
  
  A way to trace the source of the error.

500

Internal Server Error

application/json object
Show application/json properties
- errors array of objects
  
  Show errors properties
  
  code string
  
  Required
  
  The unique code for the error
  
  title string
  
  Required
  
  A summary of what went wrong
  
  detail string
  
  May be used to provide additional details
- traceId string
  
  A way to trace the source of the error.

503

Service Unavailable

application/json object
Show application/json properties
- errors array of objects
  
  Show errors properties
  
  code string
  
  Required
  
  The unique code for the error
  
  title string
  
  Required
  
  A summary of what went wrong
  
  detail string
  
  May be used to provide additional details
- traceId string
  
  A way to trace the source of the error.

GET /api/core/webhooks

// qlik-api has not implemented support for `GET /api/core/webhooks` yet.
// In the meantime, you can use fetch like this:

const response = await fetch(
  '/api/core/webhooks',
  {
    method: 'GET',
    headers: {
      'Content-Type': 'application/json',
    },
  },
)

# qlik-cli has not implemented support for GET /api/core/webhooks yet.

curl "https://{tenant}.{region}.qlikcloud.com/api/core/webhooks" \
-H "Authorization: Bearer <access_token>"

Example Response

{
  "data": [
    {
      "id": "string",
      "url": "string",
      "name": "string",
      "level": "tenant",
      "filter": "id eq \"id123\" or spaceId eq \"spaceId123\" or spaceId eq \"spaceId456\" or topLevelResourceId eq \"id789\"",
      "enabled": false,
      "headers": {
        "headerName": "headerValue"
      },
      "ownerId": "string",
      "createdAt": "2025-07-02T08:20:35.49Z",
      "updatedAt": "2025-07-02T08:20:35.49Z",
      "eventTypes": [
        "string"
      ],
      "description": "string",
      "disabledReason": "string",
      "secretKeyAdded": true,
      "createdByUserId": "string",
      "updatedByUserId": "string",
      "encryptedHeaders": [
        "header1",
        "header2"
      ],
      "disabledReasonCode": "string",
      "enableCloudEventDelivery": true,
      "checkCertificateRevocation": false,
      "origin": "api"
    }
  ],
  "links": {
    "next": {
      "href": "string"
    },
    "prev": {
      "href": "string"
    },
    "self": {
      "href": "string"
    }
  }
}

Creates a new webhook. User must be assigned the TenantAdmin role to create tenant level webhooks. Each user can own up to 150 webhooks per tenant; creating a webhook beyond that quota is rejected with 403.

Facts

	Rate limit	Tier 2 (100 requests per minute)
	Replaces	POST v1/webhooks

Request Body

Required

application/json object
Show application/json properties
- url string
  
  Required
  
  Target URL for webhook HTTPS requests
  
  maxLength = 2048
- name string
  
  Required
  
  The name for the webhook
  
  maxLength = 512
- level string
  
  Defines at what level the webhook should operate: for all resources belonging to a tenant or restricted to only those accessible by the webhook-creator.
  
  Can be one of: "tenant""user"
  default = "tenant"
- filter string
  
  Filter that should match for a webhook to be triggered. Supported common attribute names are 'id', 'spaceId' and 'topLevelResourceId'. Individual event-types can support additional event-specific attributes, which cannot be combined with other event-types in the same webhook. For example "com.qlik.v1.app.reload.finished" supports "data.status" with the allowed values "SUCCEEDED", "FAILED", "CANCELED" and "EXCEEDED_LIMIT". The authoritative set of filterable attributes and their allowed values for each event-type is returned in the allowedFilters property of GET /core/webhooks/event-types. Supported attribute operators are 'eq' and 'ne'. Supported logical operators are 'and' and 'or'. Note that attribute values must be valid JSON strings, hence they're enclosed with double quotes. For more detailed information regarding the SCIM filter syntax (RFC7644) used please follow the link to external documentation.
- secret string
  
  Shared secret used to sign the webhook delivery. Each delivery is sent with a Qlik-Signature header containing the hex-encoded HMAC-SHA256 of the raw request body, computed with this secret, so the receiver can verify that the payload is genuine and unmodified. The secret is stored encrypted and is never returned by the API; responses report only secretKeyAdded.
  
  minLength = 32, maxLength = 64
- enabled boolean
  
  Whether the webhook is active and sending requests
  
  default = false
- headers object
  
  Additional headers in the post request (webhook delivery). Note: duplicate headers are not allowed and are case-insensitive. Maximum combined size: 2048 bytes (total of all header names and values).
  
  Show additional optional properties
  
  string string
- ownerId string
  
  The id of the user that owns the webhook, only applicable for user level webhooks
- eventTypes array of strings
  
  Types of events for which the webhook should trigger. Retrieve available types from /core/webhooks/event-types.
- description string
  
  The reason for creating the webhook
  
  maxLength = 1024
- encryptedHeaders object
  
  Headers that are persisted encrypted and decrypted again to be sent as normal headers in the post request (webhook delivery). In requests they are supplied as name/value pairs, but responses return only the header names as a list of strings, because the values are never disclosed. If the URL changes, these headers must be re-entered. Note: duplicate headers are not allowed and are case-insensitive. Maximum combined size: 2048 bytes (total of all encrypted header names and values).
  
  Show additional optional properties
  
  string string
- enableCloudEventDelivery boolean
  
  Whether this webhook delivers events as CloudEvents. On creation, the service determines the effective value from tenant feature flags and webhook origin; the supplied value is not authoritative. On PUT, omission is treated as false. When feature flags are enabled, the service may automatically enable this for exclusive Data Integration webhooks. Once enabled, it cannot be disabled; omitting it when replacing an enabled webhook therefore returns 403.
- checkCertificateRevocation boolean
  
  If enabled the certificate chain of the configured URL will be checked for revocation before sending the webhook.
  
  default = false
- origin string
  
  Indicates from where the webhook was created and its purpose
  
  Can be one of: "api""automations""management-console"
  default = "api"

Responses

201

The webhook was created. The response contains the stored webhook, where secret is replaced by secretKeyAdded and encryptedHeaders is returned as a list of header names.

application/json object
Show application/json properties
- id string
  
  The webhook's unique identifier
- url string
  
  Required
  
  Target URL for webhook HTTPS requests
  
  maxLength = 2048
- name string
  
  Required
  
  The name for the webhook
  
  maxLength = 512
- level string
  
  Defines at what level the webhook should operate: for all resources belonging to a tenant or restricted to only those accessible by the webhook-creator.
  
  Can be one of: "tenant""user"
  default = "tenant"
- filter string
  
  Filter that should match for a webhook to be triggered. Supported common attribute names are 'id', 'spaceId' and 'topLevelResourceId'. Individual event-types can support additional event-specific attributes, which cannot be combined with other event-types in the same webhook. For example "com.qlik.v1.app.reload.finished" supports "data.status" with the allowed values "SUCCEEDED", "FAILED", "CANCELED" and "EXCEEDED_LIMIT". The authoritative set of filterable attributes and their allowed values for each event-type is returned in the allowedFilters property of GET /core/webhooks/event-types. Supported attribute operators are 'eq' and 'ne'. Supported logical operators are 'and' and 'or'. Note that attribute values must be valid JSON strings, hence they're enclosed with double quotes. For more detailed information regarding the SCIM filter syntax (RFC7644) used please follow the link to external documentation.
- enabled boolean
  
  Whether the webhook is active and sending requests
  
  default = false
- headers object
  
  Additional headers in the post request. Maximum combined size: 2048 bytes (total of all header names and values).
  
  Show additional optional properties
  
  string string
- ownerId string
  
  The id of the user that owns the webhook, only applicable for user level webhooks
- createdAt string
  
  The UTC timestamp when the webhook was created
  
  format = "date-time"
- updatedAt string
  
  The UTC timestamp when the webhook was last updated
  
  format = "date-time"
- eventTypes array of strings
  
  Types of events for which the webhook should trigger. Retrieve available types from /core/webhooks/event-types.
- description string
  
  The reason for creating the webhook
  
  maxLength = 1024
- disabledReason string
  
  The reason for the webhook to be disabled
- secretKeyAdded boolean
  
  Whether a signing secret is currently stored for this webhook. The secret itself is never returned.
- createdByUserId string
  
  The id of the user that created the webhook
- updatedByUserId string
  
  The id of the user that last updated the webhook
- encryptedHeaders array of strings
  
  Names of the encrypted headers that are sent with the post request. Only the header names are returned; the values are never disclosed. Maximum combined size: 2048 bytes (total of all encrypted header names and values).
- disabledReasonCode string
  
  The unique code for the reason
- enableCloudEventDelivery boolean
  
  Whether this webhook delivers events as CloudEvents. Once enabled, it cannot be disabled.
- checkCertificateRevocation boolean
  
  If enabled the certificate chain of the configured URL will be checked for revocation before sending the webhook.
  
  default = false
- origin string
  
  Indicates from where the webhook was created and its purpose
  
  Can be one of: "api""automations""management-console"
  default = "api"

400

Bad Request

application/json object
Show application/json properties
- errors array of objects
  
  Show errors properties
  
  code string
  
  Required
  
  The unique code for the error
  
  title string
  
  Required
  
  A summary of what went wrong
  
  detail string
  
  May be used to provide additional details
- traceId string
  
  A way to trace the source of the error.

401

Unauthorized

application/json object
Show application/json properties
- errors array of objects
  
  Show errors properties
  
  code string
  
  Required
  
  The unique code for the error
  
  title string
  
  Required
  
  A summary of what went wrong
  
  detail string
  
  May be used to provide additional details
- traceId string
  
  A way to trace the source of the error.

403

The request is not allowed, for example because the user lacks the required permissions, the target URL is forbidden, the event-type is not enabled for the tenant, or the user's 150-webhook quota is reached.

application/json object
Show application/json properties
- errors array of objects
  
  Show errors properties
  
  code string
  
  Required
  
  The unique code for the error
  
  title string
  
  Required
  
  A summary of what went wrong
  
  detail string
  
  May be used to provide additional details
- traceId string
  
  A way to trace the source of the error.

500

Internal Server Error

application/json object
Show application/json properties
- errors array of objects
  
  Show errors properties
  
  code string
  
  Required
  
  The unique code for the error
  
  title string
  
  Required
  
  A summary of what went wrong
  
  detail string
  
  May be used to provide additional details
- traceId string
  
  A way to trace the source of the error.

503

Service Unavailable

application/json object
Show application/json properties
- errors array of objects
  
  Show errors properties
  
  code string
  
  Required
  
  The unique code for the error
  
  title string
  
  Required
  
  A summary of what went wrong
  
  detail string
  
  May be used to provide additional details
- traceId string
  
  A way to trace the source of the error.

POST /api/core/webhooks

// qlik-api has not implemented support for `POST /api/core/webhooks` yet.
// In the meantime, you can use fetch like this:

const response = await fetch(
  '/api/core/webhooks',
  {
    method: 'POST',
    headers: {
      'Content-Type': 'application/json',
    },
    body: JSON.stringify({
      url: 'https://www.valid-url.com',
      name: 'Apps-Webhook',
      level: 'tenant',
      filter:
        'id eq "id123" or spaceId eq "spaceId123" or spaceId eq "spaceId456" or topLevelResourceId eq "id789"',
      secret:
        'ItsA32To64BitLongSecretForQlikSignature',
      enabled: false,
      headers: { headerName: 'headerValue' },
      ownerId: '6863a23242ecf6179670ee97',
      eventTypes: [
        'com.qlik.v1.reload.finished',
        'com.qlik.v1.app.created',
      ],
      description:
        'this webhook provides a real time update of an action occurred by delivering an event through a post call',
      encryptedHeaders: {
        headerName: 'sensitiveHeaderValue',
      },
      enableCloudEventDelivery: true,
      checkCertificateRevocation: false,
      origin: 'api',
    }),
  },
)

# qlik-cli has not implemented support for POST /api/core/webhooks yet.

curl "https://{tenant}.{region}.qlikcloud.com/api/core/webhooks" \
-X POST \
-H "Content-type: application/json" \
-H "Authorization: Bearer <access_token>" \
-d '{"url":"https://www.valid-url.com","name":"Apps-Webhook","level":"tenant","filter":"id eq \"id123\" or spaceId eq \"spaceId123\" or spaceId eq \"spaceId456\" or topLevelResourceId eq \"id789\"","secret":"ItsA32To64BitLongSecretForQlikSignature","enabled":false,"headers":{"headerName":"headerValue"},"ownerId":"6863a23242ecf6179670ee97","eventTypes":["com.qlik.v1.reload.finished","com.qlik.v1.app.created"],"description":"this webhook provides a real time update of an action occurred by delivering an event through a post call","encryptedHeaders":{"headerName":"sensitiveHeaderValue"},"enableCloudEventDelivery":true,"checkCertificateRevocation":false,"origin":"api"}'

Example Response

{
  "id": "string",
  "url": "string",
  "name": "string",
  "level": "tenant",
  "filter": "id eq \"id123\" or spaceId eq \"spaceId123\" or spaceId eq \"spaceId456\" or topLevelResourceId eq \"id789\"",
  "enabled": false,
  "headers": {
    "headerName": "headerValue"
  },
  "ownerId": "string",
  "createdAt": "2025-07-02T08:20:35.49Z",
  "updatedAt": "2025-07-02T08:20:35.49Z",
  "eventTypes": [
    "string"
  ],
  "description": "string",
  "disabledReason": "string",
  "secretKeyAdded": true,
  "createdByUserId": "string",
  "updatedByUserId": "string",
  "encryptedHeaders": [
    "header1",
    "header2"
  ],
  "disabledReasonCode": "string",
  "enableCloudEventDelivery": true,
  "checkCertificateRevocation": false,
  "origin": "api"
}

Returns details for a specific webhook.

Facts

	Rate limit	Tier 1 (1000 requests per minute)
	Replaces	GET v1/webhooks/{id}

Path Parameters

id string

Required

The webhook's unique identifier.

Responses

200

OK Response

application/json object
Show application/json properties
- id string
  
  The webhook's unique identifier
- url string
  
  Required
  
  Target URL for webhook HTTPS requests
  
  maxLength = 2048
- name string
  
  Required
  
  The name for the webhook
  
  maxLength = 512
- level string
  
  Defines at what level the webhook should operate: for all resources belonging to a tenant or restricted to only those accessible by the webhook-creator.
  
  Can be one of: "tenant""user"
  default = "tenant"
- filter string
  
  Filter that should match for a webhook to be triggered. Supported common attribute names are 'id', 'spaceId' and 'topLevelResourceId'. Individual event-types can support additional event-specific attributes, which cannot be combined with other event-types in the same webhook. For example "com.qlik.v1.app.reload.finished" supports "data.status" with the allowed values "SUCCEEDED", "FAILED", "CANCELED" and "EXCEEDED_LIMIT". The authoritative set of filterable attributes and their allowed values for each event-type is returned in the allowedFilters property of GET /core/webhooks/event-types. Supported attribute operators are 'eq' and 'ne'. Supported logical operators are 'and' and 'or'. Note that attribute values must be valid JSON strings, hence they're enclosed with double quotes. For more detailed information regarding the SCIM filter syntax (RFC7644) used please follow the link to external documentation.
- enabled boolean
  
  Whether the webhook is active and sending requests
  
  default = false
- headers object
  
  Additional headers in the post request. Maximum combined size: 2048 bytes (total of all header names and values).
  
  Show additional optional properties
  
  string string
- ownerId string
  
  The id of the user that owns the webhook, only applicable for user level webhooks
- createdAt string
  
  The UTC timestamp when the webhook was created
  
  format = "date-time"
- updatedAt string
  
  The UTC timestamp when the webhook was last updated
  
  format = "date-time"
- eventTypes array of strings
  
  Types of events for which the webhook should trigger. Retrieve available types from /core/webhooks/event-types.
- description string
  
  The reason for creating the webhook
  
  maxLength = 1024
- disabledReason string
  
  The reason for the webhook to be disabled
- secretKeyAdded boolean
  
  Whether a signing secret is currently stored for this webhook. The secret itself is never returned.
- createdByUserId string
  
  The id of the user that created the webhook
- updatedByUserId string
  
  The id of the user that last updated the webhook
- encryptedHeaders array of strings
  
  Names of the encrypted headers that are sent with the post request. Only the header names are returned; the values are never disclosed. Maximum combined size: 2048 bytes (total of all encrypted header names and values).
- disabledReasonCode string
  
  The unique code for the reason
- enableCloudEventDelivery boolean
  
  Whether this webhook delivers events as CloudEvents. Once enabled, it cannot be disabled.
- checkCertificateRevocation boolean
  
  If enabled the certificate chain of the configured URL will be checked for revocation before sending the webhook.
  
  default = false
- origin string
  
  Indicates from where the webhook was created and its purpose
  
  Can be one of: "api""automations""management-console"
  default = "api"

400

Bad Request

application/json object
Show application/json properties
- errors array of objects
  
  Show errors properties
  
  code string
  
  Required
  
  The unique code for the error
  
  title string
  
  Required
  
  A summary of what went wrong
  
  detail string
  
  May be used to provide additional details
- traceId string
  
  A way to trace the source of the error.

401

Unauthorized

application/json object
Show application/json properties
- errors array of objects
  
  Show errors properties
  
  code string
  
  Required
  
  The unique code for the error
  
  title string
  
  Required
  
  A summary of what went wrong
  
  detail string
  
  May be used to provide additional details
- traceId string
  
  A way to trace the source of the error.

403

Forbidden

application/json object
Show application/json properties
- errors array of objects
  
  Show errors properties
  
  code string
  
  Required
  
  The unique code for the error
  
  title string
  
  Required
  
  A summary of what went wrong
  
  detail string
  
  May be used to provide additional details
- traceId string
  
  A way to trace the source of the error.

404

Not found

application/json object
Show application/json properties
- errors array of objects
  
  Show errors properties
  
  code string
  
  Required
  
  The unique code for the error
  
  title string
  
  Required
  
  A summary of what went wrong
  
  detail string
  
  May be used to provide additional details
- traceId string
  
  A way to trace the source of the error.

500

Internal Server Error

application/json object
Show application/json properties
- errors array of objects
  
  Show errors properties
  
  code string
  
  Required
  
  The unique code for the error
  
  title string
  
  Required
  
  A summary of what went wrong
  
  detail string
  
  May be used to provide additional details
- traceId string
  
  A way to trace the source of the error.

503

Service Unavailable

application/json object
Show application/json properties
- errors array of objects
  
  Show errors properties
  
  code string
  
  Required
  
  The unique code for the error
  
  title string
  
  Required
  
  A summary of what went wrong
  
  detail string
  
  May be used to provide additional details
- traceId string
  
  A way to trace the source of the error.

GET /api/core/webhooks/{id}

// qlik-api has not implemented support for `GET /api/core/webhooks/{id}` yet.
// In the meantime, you can use fetch like this:

const response = await fetch(
  '/api/core/webhooks/{id}',
  {
    method: 'GET',
    headers: {
      'Content-Type': 'application/json',
    },
  },
)

# qlik-cli has not implemented support for GET /api/core/webhooks/{id} yet.

curl "https://{tenant}.{region}.qlikcloud.com/api/core/webhooks/{id}" \
-H "Authorization: Bearer <access_token>"

Example Response

{
  "id": "string",
  "url": "string",
  "name": "string",
  "level": "tenant",
  "filter": "id eq \"id123\" or spaceId eq \"spaceId123\" or spaceId eq \"spaceId456\" or topLevelResourceId eq \"id789\"",
  "enabled": false,
  "headers": {
    "headerName": "headerValue"
  },
  "ownerId": "string",
  "createdAt": "2025-07-02T08:20:35.49Z",
  "updatedAt": "2025-07-02T08:20:35.49Z",
  "eventTypes": [
    "string"
  ],
  "description": "string",
  "disabledReason": "string",
  "secretKeyAdded": true,
  "createdByUserId": "string",
  "updatedByUserId": "string",
  "encryptedHeaders": [
    "header1",
    "header2"
  ],
  "disabledReasonCode": "string",
  "enableCloudEventDelivery": true,
  "checkCertificateRevocation": false,
  "origin": "api"
}

Updates one or more individual properties of a webhook using a JSON Patch document, leaving all other properties unchanged. The patch is applied to the stored webhook and the result is validated as a whole, so a patch that produces an invalid webhook is rejected. When /url is changed on a webhook that has encrypted headers, every existing encrypted header must also be replaced or removed in the same patch, otherwise the request is rejected with 400. Changing read-only properties is rejected with 409, and changing /ownerId requires permission to transfer ownership.

Facts

	Rate limit	Tier 2 (100 requests per minute)
	Replaces	PATCH v1/webhooks/{id}

Path Parameters

id string

Required

The webhook's unique identifier.

Request Body

Required

application/json array of objects

A JSON Patch document as defined in https://datatracker.ietf.org/doc/html/rfc6902
Show application/json properties
- op string
  
  Required
  
  The operation to be performed
  
  Can be one of: "add""remove""replace"
- path string
  
  Required
  
  The path of the webhook property to patch. Only writable properties can be patched; read-only properties such as /id, /createdAt, /createdByUserId and /origin are rejected. Individual members of /headers and /encryptedHeaders can also be addressed directly, for example /encryptedHeaders/myHeader.
  
  Can be one of: "/name""/description""/url""/eventTypes""/headers""/enabled""/secret""/encryptedHeaders""/enableCloudEventDelivery""/filter""/level""/ownerId""/checkCertificateRevocation"
- value boolean|integer|object|string|array
  
  The value to be used for this operation. The type must match the patched property, for example an array of event-type names for /eventTypes or an object of header name/value pairs for /headers. Not used by the remove operation.
  
  One of:
  
  boolean
  
  integer
  
  object
  
  string
  
  array

Responses

204

No Content response.

400

Bad Request

application/json object
Show application/json properties
- errors array of objects
  
  Show errors properties
  
  code string
  
  Required
  
  The unique code for the error
  
  title string
  
  Required
  
  A summary of what went wrong
  
  detail string
  
  May be used to provide additional details
- traceId string
  
  A way to trace the source of the error.

401

Unauthorized

application/json object
Show application/json properties
- errors array of objects
  
  Show errors properties
  
  code string
  
  Required
  
  The unique code for the error
  
  title string
  
  Required
  
  A summary of what went wrong
  
  detail string
  
  May be used to provide additional details
- traceId string
  
  A way to trace the source of the error.

403

Forbidden

application/json object
Show application/json properties
- errors array of objects
  
  Show errors properties
  
  code string
  
  Required
  
  The unique code for the error
  
  title string
  
  Required
  
  A summary of what went wrong
  
  detail string
  
  May be used to provide additional details
- traceId string
  
  A way to trace the source of the error.

404

Not found

application/json object
Show application/json properties
- errors array of objects
  
  Show errors properties
  
  code string
  
  Required
  
  The unique code for the error
  
  title string
  
  Required
  
  A summary of what went wrong
  
  detail string
  
  May be used to provide additional details
- traceId string
  
  A way to trace the source of the error.

409

Conflict

application/json object
Show application/json properties
- errors array of objects
  
  Show errors properties
  
  code string
  
  Required
  
  The unique code for the error
  
  title string
  
  Required
  
  A summary of what went wrong
  
  detail string
  
  May be used to provide additional details
- traceId string
  
  A way to trace the source of the error.

500

Internal Server Error

application/json object
Show application/json properties
- errors array of objects
  
  Show errors properties
  
  code string
  
  Required
  
  The unique code for the error
  
  title string
  
  Required
  
  A summary of what went wrong
  
  detail string
  
  May be used to provide additional details
- traceId string
  
  A way to trace the source of the error.

503

Service Unavailable

application/json object
Show application/json properties
- errors array of objects
  
  Show errors properties
  
  code string
  
  Required
  
  The unique code for the error
  
  title string
  
  Required
  
  A summary of what went wrong
  
  detail string
  
  May be used to provide additional details
- traceId string
  
  A way to trace the source of the error.

PATCH /api/core/webhooks/{id}

// qlik-api has not implemented support for `PATCH /api/core/webhooks/{id}` yet.
// In the meantime, you can use fetch like this:

const response = await fetch(
  '/api/core/webhooks/{id}',
  {
    method: 'PATCH',
    headers: {
      'Content-Type': 'application/json',
    },
    body: JSON.stringify([
      {
        op: 'add',
        path: '/description',
        value: true,
      },
    ]),
  },
)

# qlik-cli has not implemented support for PATCH /api/core/webhooks/{id} yet.

curl "https://{tenant}.{region}.qlikcloud.com/api/core/webhooks/{id}" \
-X PATCH \
-H "Content-type: application/json" \
-H "Authorization: Bearer <access_token>" \
-d '[{"op":"add","path":"/description","value":true}]'

Replaces all writable properties of a webhook and returns the updated webhook. This is a full replacement: every writable property that is omitted from the request body is reset to its default, so omitting secret, encryptedHeaders, headers or filter clears them, and omitting enabled disables the webhook. Because secret is never returned and encryptedHeaders is returned as a list of header names, a GET response cannot be sent back unchanged as a PUT request body; re-send those values explicitly, and use PATCH to change individual properties. Read-only properties such as id, createdAt, createdByUserId and origin cannot be changed and are rejected with 409.

Facts

	Rate limit	Tier 2 (100 requests per minute)
	Replaces	PUT v1/webhooks/{id}

Path Parameters

id string

Required

The webhook's unique identifier.

Request Body

Required

application/json object
Show application/json properties
- url string
  
  Required
  
  Target URL for webhook HTTPS requests
  
  maxLength = 2048
- name string
  
  Required
  
  The name for the webhook
  
  maxLength = 512
- level string
  
  Defines at what level the webhook should operate: for all resources belonging to a tenant or restricted to only those accessible by the webhook-creator.
  
  Can be one of: "tenant""user"
  default = "tenant"
- filter string
  
  Filter that should match for a webhook to be triggered. Supported common attribute names are 'id', 'spaceId' and 'topLevelResourceId'. Individual event-types can support additional event-specific attributes, which cannot be combined with other event-types in the same webhook. For example "com.qlik.v1.app.reload.finished" supports "data.status" with the allowed values "SUCCEEDED", "FAILED", "CANCELED" and "EXCEEDED_LIMIT". The authoritative set of filterable attributes and their allowed values for each event-type is returned in the allowedFilters property of GET /core/webhooks/event-types. Supported attribute operators are 'eq' and 'ne'. Supported logical operators are 'and' and 'or'. Note that attribute values must be valid JSON strings, hence they're enclosed with double quotes. For more detailed information regarding the SCIM filter syntax (RFC7644) used please follow the link to external documentation.
- secret string
  
  Shared secret used to sign the webhook delivery. Each delivery is sent with a Qlik-Signature header containing the hex-encoded HMAC-SHA256 of the raw request body, computed with this secret, so the receiver can verify that the payload is genuine and unmodified. The secret is stored encrypted and is never returned by the API; responses report only secretKeyAdded.
  
  minLength = 32, maxLength = 64
- enabled boolean
  
  Whether the webhook is active and sending requests
  
  default = false
- headers object
  
  Additional headers in the post request (webhook delivery). Note: duplicate headers are not allowed and are case-insensitive. Maximum combined size: 2048 bytes (total of all header names and values).
  
  Show additional optional properties
  
  string string
- ownerId string
  
  The id of the user that owns the webhook, only applicable for user level webhooks
- eventTypes array of strings
  
  Types of events for which the webhook should trigger. Retrieve available types from /core/webhooks/event-types.
- description string
  
  The reason for creating the webhook
  
  maxLength = 1024
- encryptedHeaders object
  
  Headers that are persisted encrypted and decrypted again to be sent as normal headers in the post request (webhook delivery). In requests they are supplied as name/value pairs, but responses return only the header names as a list of strings, because the values are never disclosed. If the URL changes, these headers must be re-entered. Note: duplicate headers are not allowed and are case-insensitive. Maximum combined size: 2048 bytes (total of all encrypted header names and values).
  
  Show additional optional properties
  
  string string
- enableCloudEventDelivery boolean
  
  Whether this webhook delivers events as CloudEvents. On creation, the service determines the effective value from tenant feature flags and webhook origin; the supplied value is not authoritative. On PUT, omission is treated as false. When feature flags are enabled, the service may automatically enable this for exclusive Data Integration webhooks. Once enabled, it cannot be disabled; omitting it when replacing an enabled webhook therefore returns 403.
- checkCertificateRevocation boolean
  
  If enabled the certificate chain of the configured URL will be checked for revocation before sending the webhook.
  
  default = false

Responses

200

OK Response

application/json object
Show application/json properties
- id string
  
  The webhook's unique identifier
- url string
  
  Required
  
  Target URL for webhook HTTPS requests
  
  maxLength = 2048
- name string
  
  Required
  
  The name for the webhook
  
  maxLength = 512
- level string
  
  Defines at what level the webhook should operate: for all resources belonging to a tenant or restricted to only those accessible by the webhook-creator.
  
  Can be one of: "tenant""user"
  default = "tenant"
- filter string
  
  Filter that should match for a webhook to be triggered. Supported common attribute names are 'id', 'spaceId' and 'topLevelResourceId'. Individual event-types can support additional event-specific attributes, which cannot be combined with other event-types in the same webhook. For example "com.qlik.v1.app.reload.finished" supports "data.status" with the allowed values "SUCCEEDED", "FAILED", "CANCELED" and "EXCEEDED_LIMIT". The authoritative set of filterable attributes and their allowed values for each event-type is returned in the allowedFilters property of GET /core/webhooks/event-types. Supported attribute operators are 'eq' and 'ne'. Supported logical operators are 'and' and 'or'. Note that attribute values must be valid JSON strings, hence they're enclosed with double quotes. For more detailed information regarding the SCIM filter syntax (RFC7644) used please follow the link to external documentation.
- enabled boolean
  
  Whether the webhook is active and sending requests
  
  default = false
- headers object
  
  Additional headers in the post request. Maximum combined size: 2048 bytes (total of all header names and values).
  
  Show additional optional properties
  
  string string
- ownerId string
  
  The id of the user that owns the webhook, only applicable for user level webhooks
- createdAt string
  
  The UTC timestamp when the webhook was created
  
  format = "date-time"
- updatedAt string
  
  The UTC timestamp when the webhook was last updated
  
  format = "date-time"
- eventTypes array of strings
  
  Types of events for which the webhook should trigger. Retrieve available types from /core/webhooks/event-types.
- description string
  
  The reason for creating the webhook
  
  maxLength = 1024
- disabledReason string
  
  The reason for the webhook to be disabled
- secretKeyAdded boolean
  
  Whether a signing secret is currently stored for this webhook. The secret itself is never returned.
- createdByUserId string
  
  The id of the user that created the webhook
- updatedByUserId string
  
  The id of the user that last updated the webhook
- encryptedHeaders array of strings
  
  Names of the encrypted headers that are sent with the post request. Only the header names are returned; the values are never disclosed. Maximum combined size: 2048 bytes (total of all encrypted header names and values).
- disabledReasonCode string
  
  The unique code for the reason
- enableCloudEventDelivery boolean
  
  Whether this webhook delivers events as CloudEvents. Once enabled, it cannot be disabled.
- checkCertificateRevocation boolean
  
  If enabled the certificate chain of the configured URL will be checked for revocation before sending the webhook.
  
  default = false
- origin string
  
  Indicates from where the webhook was created and its purpose
  
  Can be one of: "api""automations""management-console"
  default = "api"

400

Bad Request

application/json object
Show application/json properties
- errors array of objects
  
  Show errors properties
  
  code string
  
  Required
  
  The unique code for the error
  
  title string
  
  Required
  
  A summary of what went wrong
  
  detail string
  
  May be used to provide additional details
- traceId string
  
  A way to trace the source of the error.

401

Unauthorized

application/json object
Show application/json properties
- errors array of objects
  
  Show errors properties
  
  code string
  
  Required
  
  The unique code for the error
  
  title string
  
  Required
  
  A summary of what went wrong
  
  detail string
  
  May be used to provide additional details
- traceId string
  
  A way to trace the source of the error.

403

Forbidden

application/json object
Show application/json properties
- errors array of objects
  
  Show errors properties
  
  code string
  
  Required
  
  The unique code for the error
  
  title string
  
  Required
  
  A summary of what went wrong
  
  detail string
  
  May be used to provide additional details
- traceId string
  
  A way to trace the source of the error.

404

Not found

application/json object
Show application/json properties
- errors array of objects
  
  Show errors properties
  
  code string
  
  Required
  
  The unique code for the error
  
  title string
  
  Required
  
  A summary of what went wrong
  
  detail string
  
  May be used to provide additional details
- traceId string
  
  A way to trace the source of the error.

409

Conflict

application/json object
Show application/json properties
- errors array of objects
  
  Show errors properties
  
  code string
  
  Required
  
  The unique code for the error
  
  title string
  
  Required
  
  A summary of what went wrong
  
  detail string
  
  May be used to provide additional details
- traceId string
  
  A way to trace the source of the error.

500

Internal Server Error

application/json object
Show application/json properties
- errors array of objects
  
  Show errors properties
  
  code string
  
  Required
  
  The unique code for the error
  
  title string
  
  Required
  
  A summary of what went wrong
  
  detail string
  
  May be used to provide additional details
- traceId string
  
  A way to trace the source of the error.

503

Service Unavailable

application/json object
Show application/json properties
- errors array of objects
  
  Show errors properties
  
  code string
  
  Required
  
  The unique code for the error
  
  title string
  
  Required
  
  A summary of what went wrong
  
  detail string
  
  May be used to provide additional details
- traceId string
  
  A way to trace the source of the error.

PUT /api/core/webhooks/{id}

// qlik-api has not implemented support for `PUT /api/core/webhooks/{id}` yet.
// In the meantime, you can use fetch like this:

const response = await fetch(
  '/api/core/webhooks/{id}',
  {
    method: 'PUT',
    headers: {
      'Content-Type': 'application/json',
    },
    body: JSON.stringify({
      url: 'https://www.valid-url.com',
      name: 'Apps-Webhook',
      level: 'tenant',
      filter:
        'id eq "id123" or spaceId eq "spaceId123" or spaceId eq "spaceId456" or topLevelResourceId eq "id789"',
      secret:
        'ItsA32To64BitLongSecretForQlikSignature',
      enabled: false,
      headers: { headerName: 'headerValue' },
      ownerId: '6863a23242ecf6179670ee97',
      eventTypes: [
        'com.qlik.v1.reload.finished',
        'com.qlik.v1.app.created',
      ],
      description:
        'this webhook provides a real time update of an action occurred by delivering an event through a post call',
      encryptedHeaders: {
        headerName: 'sensitiveHeaderValue',
      },
      enableCloudEventDelivery: true,
      checkCertificateRevocation: false,
    }),
  },
)

# qlik-cli has not implemented support for PUT /api/core/webhooks/{id} yet.

curl "https://{tenant}.{region}.qlikcloud.com/api/core/webhooks/{id}" \
-X PUT \
-H "Content-type: application/json" \
-H "Authorization: Bearer <access_token>" \
-d '{"url":"https://www.valid-url.com","name":"Apps-Webhook","level":"tenant","filter":"id eq \"id123\" or spaceId eq \"spaceId123\" or spaceId eq \"spaceId456\" or topLevelResourceId eq \"id789\"","secret":"ItsA32To64BitLongSecretForQlikSignature","enabled":false,"headers":{"headerName":"headerValue"},"ownerId":"6863a23242ecf6179670ee97","eventTypes":["com.qlik.v1.reload.finished","com.qlik.v1.app.created"],"description":"this webhook provides a real time update of an action occurred by delivering an event through a post call","encryptedHeaders":{"headerName":"sensitiveHeaderValue"},"enableCloudEventDelivery":true,"checkCertificateRevocation":false}'

Example Response

{
  "id": "string",
  "url": "string",
  "name": "string",
  "level": "tenant",
  "filter": "id eq \"id123\" or spaceId eq \"spaceId123\" or spaceId eq \"spaceId456\" or topLevelResourceId eq \"id789\"",
  "enabled": false,
  "headers": {
    "headerName": "headerValue"
  },
  "ownerId": "string",
  "createdAt": "2025-07-02T08:20:35.49Z",
  "updatedAt": "2025-07-02T08:20:35.49Z",
  "eventTypes": [
    "string"
  ],
  "description": "string",
  "disabledReason": "string",
  "secretKeyAdded": true,
  "createdByUserId": "string",
  "updatedByUserId": "string",
  "encryptedHeaders": [
    "header1",
    "header2"
  ],
  "disabledReasonCode": "string",
  "enableCloudEventDelivery": true,
  "checkCertificateRevocation": false,
  "origin": "api"
}

Deletes a specific webhook.

Facts

	Rate limit	Tier 2 (100 requests per minute)
	Replaces	DELETE v1/webhooks/{id}

Path Parameters

id string

Required

The webhook's unique identifier.

Responses

204

No Content response.

400

Bad Request

application/json object
Show application/json properties
- errors array of objects
  
  Show errors properties
  
  code string
  
  Required
  
  The unique code for the error
  
  title string
  
  Required
  
  A summary of what went wrong
  
  detail string
  
  May be used to provide additional details
- traceId string
  
  A way to trace the source of the error.

401

Unauthorized

application/json object
Show application/json properties
- errors array of objects
  
  Show errors properties
  
  code string
  
  Required
  
  The unique code for the error
  
  title string
  
  Required
  
  A summary of what went wrong
  
  detail string
  
  May be used to provide additional details
- traceId string
  
  A way to trace the source of the error.

403

Forbidden

application/json object
Show application/json properties
- errors array of objects
  
  Show errors properties
  
  code string
  
  Required
  
  The unique code for the error
  
  title string
  
  Required
  
  A summary of what went wrong
  
  detail string
  
  May be used to provide additional details
- traceId string
  
  A way to trace the source of the error.

404

Not found

application/json object
Show application/json properties
- errors array of objects
  
  Show errors properties
  
  code string
  
  Required
  
  The unique code for the error
  
  title string
  
  Required
  
  A summary of what went wrong
  
  detail string
  
  May be used to provide additional details
- traceId string
  
  A way to trace the source of the error.

500

Internal Server Error

application/json object
Show application/json properties
- errors array of objects
  
  Show errors properties
  
  code string
  
  Required
  
  The unique code for the error
  
  title string
  
  Required
  
  A summary of what went wrong
  
  detail string
  
  May be used to provide additional details
- traceId string
  
  A way to trace the source of the error.

503

Service Unavailable

application/json object
Show application/json properties
- errors array of objects
  
  Show errors properties
  
  code string
  
  Required
  
  The unique code for the error
  
  title string
  
  Required
  
  A summary of what went wrong
  
  detail string
  
  May be used to provide additional details
- traceId string
  
  A way to trace the source of the error.

DELETE /api/core/webhooks/{id}

// qlik-api has not implemented support for `DELETE /api/core/webhooks/{id}` yet.
// In the meantime, you can use fetch like this:

const response = await fetch(
  '/api/core/webhooks/{id}',
  {
    method: 'DELETE',
    headers: {
      'Content-Type': 'application/json',
    },
  },
)

# qlik-cli has not implemented support for DELETE /api/core/webhooks/{id} yet.

curl "https://{tenant}.{region}.qlikcloud.com/api/core/webhooks/{id}" \
-X DELETE \
-H "Authorization: Bearer <access_token>"

Returns deliveries for a specific webhook. Delivery history is stored for 1 week.

Facts

	Rate limit	Tier 1 (1000 requests per minute)
	Replaces	GET v1/webhooks/{id}/deliveries

Query Parameters

eventType string

Filter resources by event-type
limit number

Maximum number of deliveries to retrieve

minimum = 1, maximum = 100, default = 20, default = 20
next string

Cursor to the next page
prev string

Cursor to the previous page.
sort string

Field to sort by, prefix with -/+ to indicate order

Can be one of: "status""+status""-status""triggeredAt""+triggeredAt""-triggeredAt"
default = "-triggeredAt"
status string

Filter resources by status (success or fail)

Can be one of: "success""fail"

Path Parameters

id string

Required

The webhook's unique identifier.

Responses

200

OK Response

application/json object
Show application/json properties
- data array of objects
  
  Show data properties
  
  id string
  
  Required
  
  The delivery's unique identifier
  
  status string
  
  Required
  
  The status of delivery
  
  Can be one of: "success""fail"
  
  request object
  
  The request that was sent to the webhook URL for this delivery.
  
  Show request properties
  
  url string
  
  URL used for this delivery
  
  body object
  
  The sent body/payload of the delivery
  
  headers object
  
  Headers sent for this delivery, values of encryptedHeaders are omitted as such "OMITTED". Maximum combined size: 2048 bytes for non-encrypted headers + 2048 bytes for encrypted headers.
  
  Show additional optional properties
  
  string string
  
  response object
  
  The response that was received from the webhook URL for this delivery. Absent if no response was received.
  
  Show response properties
  
  body string
  
  The received body of the delivery
  
  headers object
  
  Headers received for this delivery, values of encryptedHeaders are omitted as such "OMITTED". Maximum combined size: 2048 bytes for non-encrypted headers + 2048 bytes for encrypted headers.
  
  Show additional optional properties
  
  string string
  
  statusCode number
  
  The HTTP status code of the response
  
  eventType string
  
  Required
  
  The name of the triggering event-type
  
  webhookId string
  
  Required
  
  The unique webhook identifier that the delivery is for
  
  triggeredAt string
  
  Required
  
  The UTC timestamp when the delivery was triggered
  
  format = "date-time"
  
  statusMessage string
  
  The status message of the delivery
- links object
  
  Show links properties
  
  next object
  
  Show next properties
  
  href string
  
  Required
  
  URL to a resource request
  
  prev object
  
  Show prev properties
  
  href string
  
  Required
  
  URL to a resource request
  
  self object
  
  Show self properties
  
  href string
  
  Required
  
  URL to a resource request

400

Bad Request

application/json object
Show application/json properties
- errors array of objects
  
  Show errors properties
  
  code string
  
  Required
  
  The unique code for the error
  
  title string
  
  Required
  
  A summary of what went wrong
  
  detail string
  
  May be used to provide additional details
- traceId string
  
  A way to trace the source of the error.

401

Unauthorized

application/json object
Show application/json properties
- errors array of objects
  
  Show errors properties
  
  code string
  
  Required
  
  The unique code for the error
  
  title string
  
  Required
  
  A summary of what went wrong
  
  detail string
  
  May be used to provide additional details
- traceId string
  
  A way to trace the source of the error.

403

Forbidden

application/json object
Show application/json properties
- errors array of objects
  
  Show errors properties
  
  code string
  
  Required
  
  The unique code for the error
  
  title string
  
  Required
  
  A summary of what went wrong
  
  detail string
  
  May be used to provide additional details
- traceId string
  
  A way to trace the source of the error.

404

Not found

application/json object
Show application/json properties
- errors array of objects
  
  Show errors properties
  
  code string
  
  Required
  
  The unique code for the error
  
  title string
  
  Required
  
  A summary of what went wrong
  
  detail string
  
  May be used to provide additional details
- traceId string
  
  A way to trace the source of the error.

500

Internal Server Error

application/json object
Show application/json properties
- errors array of objects
  
  Show errors properties
  
  code string
  
  Required
  
  The unique code for the error
  
  title string
  
  Required
  
  A summary of what went wrong
  
  detail string
  
  May be used to provide additional details
- traceId string
  
  A way to trace the source of the error.

503

Service Unavailable

application/json object
Show application/json properties
- errors array of objects
  
  Show errors properties
  
  code string
  
  Required
  
  The unique code for the error
  
  title string
  
  Required
  
  A summary of what went wrong
  
  detail string
  
  May be used to provide additional details
- traceId string
  
  A way to trace the source of the error.

GET /api/core/webhooks/{id}/deliveries

// qlik-api has not implemented support for `GET /api/core/webhooks/{id}/deliveries` yet.
// In the meantime, you can use fetch like this:

const response = await fetch(
  '/api/core/webhooks/{id}/deliveries',
  {
    method: 'GET',
    headers: {
      'Content-Type': 'application/json',
    },
  },
)

# qlik-cli has not implemented support for GET /api/core/webhooks/{id}/deliveries yet.

curl "https://{tenant}.{region}.qlikcloud.com/api/core/webhooks/{id}/deliveries" \
-H "Authorization: Bearer <access_token>"

Example Response

{
  "data": [
    {
      "id": "string",
      "status": "success",
      "request": {
        "url": "string",
        "body": {},
        "headers": {
          "headerName": "headerValue",
          "encryptedHeadersName": "**OMITTED**"
        }
      },
      "response": {
        "body": "string",
        "headers": {
          "headerName": "headerValue",
          "encryptedHeadersName": "**OMITTED**"
        },
        "statusCode": 42
      },
      "eventType": "string",
      "webhookId": "string",
      "triggeredAt": "2025-07-02T08:20:35.49Z",
      "statusMessage": "string"
    }
  ],
  "links": {
    "next": {
      "href": "string"
    },
    "prev": {
      "href": "string"
    },
    "self": {
      "href": "string"
    }
  }
}

Returns details for a specific delivery.

Facts

	Rate limit	Tier 1 (1000 requests per minute)
	Replaces	GET v1/webhooks/{id}/deliveries/{deliveryId}

Path Parameters

deliveryId string

Required

The delivery's unique identifier.
id string

Required

The webhook's unique identifier.

Responses

200

OK Response

application/json object
Show application/json properties
- id string
  
  Required
  
  The delivery's unique identifier
- status string
  
  Required
  
  The status of delivery
  
  Can be one of: "success""fail"
- request object
  
  The request that was sent to the webhook URL for this delivery.
  
  Show request properties
  
  url string
  
  URL used for this delivery
  
  body object
  
  The sent body/payload of the delivery
  
  headers object
  
  Headers sent for this delivery, values of encryptedHeaders are omitted as such "OMITTED". Maximum combined size: 2048 bytes for non-encrypted headers + 2048 bytes for encrypted headers.
  
  Show additional optional properties
  
  string string
- response object
  
  The response that was received from the webhook URL for this delivery. Absent if no response was received.
  
  Show response properties
  
  body string
  
  The received body of the delivery
  
  headers object
  
  Headers received for this delivery, values of encryptedHeaders are omitted as such "OMITTED". Maximum combined size: 2048 bytes for non-encrypted headers + 2048 bytes for encrypted headers.
  
  Show additional optional properties
  
  string string
  
  statusCode number
  
  The HTTP status code of the response
- eventType string
  
  Required
  
  The name of the triggering event-type
- webhookId string
  
  Required
  
  The unique webhook identifier that the delivery is for
- triggeredAt string
  
  Required
  
  The UTC timestamp when the delivery was triggered
  
  format = "date-time"
- statusMessage string
  
  The status message of the delivery

400

Bad Request

application/json object
Show application/json properties
- errors array of objects
  
  Show errors properties
  
  code string
  
  Required
  
  The unique code for the error
  
  title string
  
  Required
  
  A summary of what went wrong
  
  detail string
  
  May be used to provide additional details
- traceId string
  
  A way to trace the source of the error.

401

Unauthorized

application/json object
Show application/json properties
- errors array of objects
  
  Show errors properties
  
  code string
  
  Required
  
  The unique code for the error
  
  title string
  
  Required
  
  A summary of what went wrong
  
  detail string
  
  May be used to provide additional details
- traceId string
  
  A way to trace the source of the error.

403

Forbidden

application/json object
Show application/json properties
- errors array of objects
  
  Show errors properties
  
  code string
  
  Required
  
  The unique code for the error
  
  title string
  
  Required
  
  A summary of what went wrong
  
  detail string
  
  May be used to provide additional details
- traceId string
  
  A way to trace the source of the error.

404

Not found

application/json object
Show application/json properties
- errors array of objects
  
  Show errors properties
  
  code string
  
  Required
  
  The unique code for the error
  
  title string
  
  Required
  
  A summary of what went wrong
  
  detail string
  
  May be used to provide additional details
- traceId string
  
  A way to trace the source of the error.

500

Internal Server Error

application/json object
Show application/json properties
- errors array of objects
  
  Show errors properties
  
  code string
  
  Required
  
  The unique code for the error
  
  title string
  
  Required
  
  A summary of what went wrong
  
  detail string
  
  May be used to provide additional details
- traceId string
  
  A way to trace the source of the error.

503

Service Unavailable

application/json object
Show application/json properties
- errors array of objects
  
  Show errors properties
  
  code string
  
  Required
  
  The unique code for the error
  
  title string
  
  Required
  
  A summary of what went wrong
  
  detail string
  
  May be used to provide additional details
- traceId string
  
  A way to trace the source of the error.

GET /api/core/webhooks/{id}/deliveries/{deliveryId}

// qlik-api has not implemented support for `GET /api/core/webhooks/{id}/deliveries/{deliveryId}` yet.
// In the meantime, you can use fetch like this:

const response = await fetch(
  '/api/core/webhooks/{id}/deliveries/{deliveryId}',
  {
    method: 'GET',
    headers: {
      'Content-Type': 'application/json',
    },
  },
)

# qlik-cli has not implemented support for GET /api/core/webhooks/{id}/deliveries/{deliveryId} yet.

curl "https://{tenant}.{region}.qlikcloud.com/api/core/webhooks/{id}/deliveries/{deliveryId}" \
-H "Authorization: Bearer <access_token>"

Example Response

{
  "id": "string",
  "status": "success",
  "request": {
    "url": "string",
    "body": {},
    "headers": {
      "headerName": "headerValue",
      "encryptedHeadersName": "**OMITTED**"
    }
  },
  "response": {
    "body": "string",
    "headers": {
      "headerName": "headerValue",
      "encryptedHeadersName": "**OMITTED**"
    },
    "statusCode": 42
  },
  "eventType": "string",
  "webhookId": "string",
  "triggeredAt": "2025-07-02T08:20:35.49Z",
  "statusMessage": "string"
}

Resends the event payload of an existing delivery and returns the new delivery. The event payload is taken from the original delivery, but the webhook's current configuration (URL, headers, secret and certificate settings) is used to send it. The resend is attempted synchronously and a new delivery record is always created, so a 201 response can contain a delivery with status fail. A resend is subject to the same validation and failure handling as an automatic delivery, so a webhook that is no longer valid or that exceeds the delivery failure threshold can be disabled as a result.

Facts

	Rate limit	Tier 2 (100 requests per minute)
	Replaces	POST v1/webhooks/{id}/deliveries/{deliveryId}/actions/resend

Path Parameters

deliveryId string

Required

The delivery's unique identifier.
id string

Required

The webhook's unique identifier.

Responses

201

A new delivery was created for the resend attempt. Check status to see whether the delivery itself succeeded or failed.

application/json object
Show application/json properties
- id string
  
  Required
  
  The delivery's unique identifier
- status string
  
  Required
  
  The status of delivery
  
  Can be one of: "success""fail"
- request object
  
  The request that was sent to the webhook URL for this delivery.
  
  Show request properties
  
  url string
  
  URL used for this delivery
  
  body object
  
  The sent body/payload of the delivery
  
  headers object
  
  Headers sent for this delivery, values of encryptedHeaders are omitted as such "OMITTED". Maximum combined size: 2048 bytes for non-encrypted headers + 2048 bytes for encrypted headers.
  
  Show additional optional properties
  
  string string
- response object
  
  The response that was received from the webhook URL for this delivery. Absent if no response was received.
  
  Show response properties
  
  body string
  
  The received body of the delivery
  
  headers object
  
  Headers received for this delivery, values of encryptedHeaders are omitted as such "OMITTED". Maximum combined size: 2048 bytes for non-encrypted headers + 2048 bytes for encrypted headers.
  
  Show additional optional properties
  
  string string
  
  statusCode number
  
  The HTTP status code of the response
- eventType string
  
  Required
  
  The name of the triggering event-type
- webhookId string
  
  Required
  
  The unique webhook identifier that the delivery is for
- triggeredAt string
  
  Required
  
  The UTC timestamp when the delivery was triggered
  
  format = "date-time"
- statusMessage string
  
  The status message of the delivery

400

Bad Request

application/json object
Show application/json properties
- errors array of objects
  
  Show errors properties
  
  code string
  
  Required
  
  The unique code for the error
  
  title string
  
  Required
  
  A summary of what went wrong
  
  detail string
  
  May be used to provide additional details
- traceId string
  
  A way to trace the source of the error.

401

Unauthorized

application/json object
Show application/json properties
- errors array of objects
  
  Show errors properties
  
  code string
  
  Required
  
  The unique code for the error
  
  title string
  
  Required
  
  A summary of what went wrong
  
  detail string
  
  May be used to provide additional details
- traceId string
  
  A way to trace the source of the error.

403

The request is not allowed, for example because the user lacks the required permissions or the event-type of the delivery is not enabled for the tenant.

application/json object
Show application/json properties
- errors array of objects
  
  Show errors properties
  
  code string
  
  Required
  
  The unique code for the error
  
  title string
  
  Required
  
  A summary of what went wrong
  
  detail string
  
  May be used to provide additional details
- traceId string
  
  A way to trace the source of the error.

404

Not found

application/json object
Show application/json properties
- errors array of objects
  
  Show errors properties
  
  code string
  
  Required
  
  The unique code for the error
  
  title string
  
  Required
  
  A summary of what went wrong
  
  detail string
  
  May be used to provide additional details
- traceId string
  
  A way to trace the source of the error.

500

Internal Server Error

application/json object
Show application/json properties
- errors array of objects
  
  Show errors properties
  
  code string
  
  Required
  
  The unique code for the error
  
  title string
  
  Required
  
  A summary of what went wrong
  
  detail string
  
  May be used to provide additional details
- traceId string
  
  A way to trace the source of the error.

503

Service Unavailable

application/json object
Show application/json properties
- errors array of objects
  
  Show errors properties
  
  code string
  
  Required
  
  The unique code for the error
  
  title string
  
  Required
  
  A summary of what went wrong
  
  detail string
  
  May be used to provide additional details
- traceId string
  
  A way to trace the source of the error.

POST /api/core/webhooks/{id}/deliveries/{deliveryId}/actions/resend

// qlik-api has not implemented support for `POST /api/core/webhooks/{id}/deliveries/{deliveryId}/actions/resend` yet.
// In the meantime, you can use fetch like this:

const response = await fetch(
  '/api/core/webhooks/{id}/deliveries/{deliveryId}/actions/resend',
  {
    method: 'POST',
    headers: {
      'Content-Type': 'application/json',
    },
  },
)

# qlik-cli has not implemented support for POST /api/core/webhooks/{id}/deliveries/{deliveryId}/actions/resend yet.

curl "https://{tenant}.{region}.qlikcloud.com/api/core/webhooks/{id}/deliveries/{deliveryId}/actions/resend" \
-X POST \
-H "Authorization: Bearer <access_token>"

Example Response

{
  "id": "string",
  "status": "success",
  "request": {
    "url": "string",
    "body": {},
    "headers": {
      "headerName": "headerValue",
      "encryptedHeadersName": "**OMITTED**"
    }
  },
  "response": {
    "body": "string",
    "headers": {
      "headerName": "headerValue",
      "encryptedHeadersName": "**OMITTED**"
    },
    "statusCode": 42
  },
  "eventType": "string",
  "webhookId": "string",
  "triggeredAt": "2025-07-02T08:20:35.49Z",
  "statusMessage": "string"
}

Lists event-types that are possible to subscribe to.

Facts

	Rate limit	Tier 1 (1000 requests per minute)
	Replaces	GET v1/webhooks/event-types

Responses

200

OK Response

application/json object
Show application/json properties
- data array of objects
  
  Show data properties
  
  name string
  
  Name of the event type
  
  title string
  
  Title of the event type
  
  levels array of strings
  
  Specifies which levels that are supported for this event type
  
  category string
  
  Category of the event type
  
  description string
  
  Description of the event type
  
  allowedFilters array of objects
  
  The set of fields that can be used to filter this specific event type for webhook delivery. Different event types may support different filter paths.
  
  Show allowedFilters properties
  
  path string
  
  Required
  
  The field name or path that can be used as a filter
  
  allowedValues array of strings
  
  Optional allowed values for this filter path. If omitted, the path is treated as free-form and clients are responsible for valid usage.

401

Unauthorized

application/json object
Show application/json properties
- errors array of objects
  
  Show errors properties
  
  code string
  
  Required
  
  The unique code for the error
  
  title string
  
  Required
  
  A summary of what went wrong
  
  detail string
  
  May be used to provide additional details
- traceId string
  
  A way to trace the source of the error.

500

Internal Server Error

application/json object
Show application/json properties
- errors array of objects
  
  Show errors properties
  
  code string
  
  Required
  
  The unique code for the error
  
  title string
  
  Required
  
  A summary of what went wrong
  
  detail string
  
  May be used to provide additional details
- traceId string
  
  A way to trace the source of the error.

503

Service Unavailable

application/json object
Show application/json properties
- errors array of objects
  
  Show errors properties
  
  code string
  
  Required
  
  The unique code for the error
  
  title string
  
  Required
  
  A summary of what went wrong
  
  detail string
  
  May be used to provide additional details
- traceId string
  
  A way to trace the source of the error.

GET /api/core/webhooks/event-types

// qlik-api has not implemented support for `GET /api/core/webhooks/event-types` yet.
// In the meantime, you can use fetch like this:

const response = await fetch(
  '/api/core/webhooks/event-types',
  {
    method: 'GET',
    headers: {
      'Content-Type': 'application/json',
    },
  },
)

# qlik-cli has not implemented support for GET /api/core/webhooks/event-types yet.

curl "https://{tenant}.{region}.qlikcloud.com/api/core/webhooks/event-types" \
-H "Authorization: Bearer <access_token>"

Example Response

{
  "data": [
    {
      "name": "string",
      "title": "string",
      "levels": [
        "string"
      ],
      "category": "string",
      "description": "string",
      "allowedFilters": [
        {
          "path": "data.status",
          "allowedValues": [
            "SUCCEEDED",
            "FAILED",
            "CANCELED",
            "EXCEEDED_LIMIT"
          ]
        }
      ]
    }
  ]
}

Webhooks

Endpoints

List webhooks

Facts

Query Parameters

Responses

200

400

401

403

500

503

Example Response

Create a new webhook

Facts

Request Body

Responses

201

400

401

403

500

503

Example Response

Get a webhook

Facts

Path Parameters

Responses

200

400

401

403

404

500

503

Example Response

Update selected webhook properties

Facts

Path Parameters

Request Body

Responses

204

400

401

403

404

409

500

503

Replace a webhook

Facts

Path Parameters

Request Body

Responses

200

400

401

403

404

409

500

503

Example Response

Delete a webhook

Facts

Path Parameters

Responses

204

400

401

403

404

500

503

Return deliveries for a webhook

Facts

Query Parameters

Path Parameters

Responses

200