| EvaluationTime |
- Type
- double
- Properties
- Nillable
- Description
- The amount of time it took to evaluate the policy in
milliseconds.
|
| EventDate |
- Type
- dateTime
- Properties
- Nillable
- Description
- The time when the specified API event was captured
(after query execution takes place). For example,
2013-01-01T03:01:01Z. Seconds are the most granular
setting.
|
| EventIdentifier |
- Type
- string
- Properties
- Nillable
- Description
- The unique ID of the event. For example,
4DWDVuDbwCDZcEIdp7MQZ.
|
| LoginKey |
- Type
- string
- Properties
- Nillable
- Description
- The string that ties together all events in a given user’s
login session. The session starts with a login event and ends with either a
logout event or the user session expiring.
|
| Operation |
- Type
- string
- Properties
- Nillable
- Description
- The API call that generated the event (query(),
queryAll(),
queryMore(),
delete(),
update(),
upsert()). If
it’s a UI operation, the value corresponds to the client
method that occurred on the URI.
|
| PolicyId |
- Type
- reference
- Properties
- Nillable
- Description
- The ID of the transaction policy associated with this
event.
|
| PolicyOutcome |
- Type
- picklist
- Properties
- Nillable, Restricted picklist
- Description
- The result of the transaction policy. Possible values are:
-
Block - The
user was blocked from performing the operation
that triggered the policy.
-
EndSession
- The Concurrent Sessions Limiting policy
activated, limiting the number of concurrent
sessions per user.
-
Error - The
policy caused an undefined error when it
executed.
-
FailedInvalidPassword - The user entered
an invalid password.
-
FailedPasswordLockout - The user entered
an invalid password too many times.
-
FreezeUser
- The user was prevented from taking any further
action.
-
NoAction -
The policy didn't trigger.
-
Notified -
A notification was sent to the recipient.
-
TwoFAAutomatedSuccess - Salesforce
Authenticator approved the request for access
because the request came from a trusted location.
After users enable location services in Salesforce
Authenticator, they can designate trusted
locations. When a user trusts a location for a
particular activity, such as logging in from a
recognized device, that activity is approved from
the trusted location for as long as the location
is trusted.
-
TwoFADenied
- The user denied the approval request in the
authenticator app, such as Salesforce
Authenticator.
-
TwoFAFailedGeneralError - An error
caused by something other than an invalid
verification code, too many verification attempts,
or authenticator app connectivity.
-
TwoFAFailedInvalidCode - The user
provided an invalid verification code.
-
TwoFAFailedTooManyAttempts - The user
attempted to verify identity too many times. For
example, the user entered an invalid verification
code repeatedly.
-
TwoFAInitiated - Salesforce initiated
identity verification but hasn’t yet challenged
the user.
-
TwoFAInProgress - Salesforce challenged
the user to verify identity and is waiting for the
user to respond or for Salesforce Authenticator to
send an automated response.
-
TwoFANoAction - The policy specifies two
factor authentication as an action, but the user
is already in a high-assurance session.
-
TwoFARecoverableError - Salesforce can’t
reach the authenticator app to verify identity,
but will retry.
-
TwoFAReportedDenied - The user denied
the approval request in the authenticator app,
such as Salesforce Authenticator, and also flagged
the approval request to report to an
administrator.
-
TwoFASucceeded - The user’s identity was
verified.
|
| RelatedEventIdentifier |
- Type
- string
- Properties
- Nillable
- Description
- Represents the EventIdentifier of the related
event.
|
| ReplayId |
- Type
- string
- Properties
- Nillable
- Description
- Represents an ID value that is populated by the system
and refers to the position of the event in the event stream. Replay ID values
aren’t guaranteed to be contiguous for consecutive events. A subscriber can
store a replay ID value and use it on resubscription to retrieve missed events
that are within the retention window.
|
| Resource |
- Type
- string
- Properties
- Nillable
- Description
- Indicates the logical resource that triggered the event.
It could be an entity name (if an API operation) or a
URI (if a UI operation).
|
| SessionKey |
- Type
- string
- Properties
- Nillable
- Description
- The user’s unique session ID. Use this value to identify
all user events within a session. When a user logs out and logs in again, a new
session is started.
|
| SessionLevel |
- Type
- picklist
- Properties
- Nillable
- Description
- Indicates the session-level security of the session that
the user is logging out of for this event. Session-level
security controls user access to features that support
it, such as connected apps and reporting. Possible
values are:
-
LOW - The
user’s security level for the current session
meets the lowest requirements.
This low
level is not available, nor used, in the
Salesforce UI. User sessions through the UI are
either standard or high assurance. You can set
this level using the API, but users assigned this
level will experience unpredictable and reduced
functionality in their Salesforce org.
-
STANDARD -
The user’s security level for the current session
meets the Standard requirements set in the current
organization Session Security Levels.
-
HIGH_ASSURANCE - A high assurance
session was used for the current session. For
example, when the user tries to access a resource
such as a connected app, report, or dashboard that
requires a high assurance session level.
|
| SourceIp |
- Type
- string
- Properties
- Nillable
- Description
- The source IP address of the client that logged in. For
example, 126.7.4.2.
This field is available in API version 43.0 and
later.
|
| UserId |
- Type
- reference
- Properties
- Nillable
- Description
- The origin user’s unique ID. For example, 005000000000123.
|
| Username |
- Type
- string
- Properties
- Nillable
- Description
- The origin username in the format of user@company.com at the
time the event was created.
|
j
