LogoutEvent (Beta)

This object is included in Real-Time Event Monitoring (Beta). As a beta feature, Real-Time Event Monitoring is a preview and isn’t part of the “Services” under your master subscription agreement with Salesforce. Use this feature at your sole discretion, and make your purchase decisions only on the basis of generally available products and features. Salesforce doesn’t guarantee general availability of this feature within any particular time frame or at all, and we can discontinue it at any time. This feature is for evaluation purposes only, not for production use. It’s offered as is and isn’t supported, and Salesforce has no liability for any harm or damage arising out of or in connection with it. All restrictions, Salesforce reservation of rights, obligations concerning the Services, and terms for related Non-Salesforce Applications and Content apply equally to your use of this feature. You can provide feedback and suggestions for this object in the Real-Time Event Monitoring Beta group in the Trailblazer Community.

Note

Use LogoutEvent data to implement custom logic during logout. For example, you can revoke all refresh tokens for a user at logout.

LogoutEvent records logouts, not timeouts. Timeouts don't cause a LogoutEventStream object to be published. An exception is when a user is automatically logged out of the org after their session times out because the org has the Force logout on session timeout setting enabled. In this case, a logout event is recorded. However, if users close their browser during a session, regardless of whether the Force logout on session timeout setting is enabled, a logout event isn't recorded.

Note

Supported Calls

describeSObjects(), query()

Special Access Rules

Accessing this object requires the Shield Event Monitoring add-on, and the View Data Leakage Detection Events and API Enabled user permissions.

Fields

Field Name	Details
EventDate	Type dateTime Properties Filter, Sort Description The time when the specified logout event was captured. For example, `2013-01-01T03:01:01Z`. Seconds are the most granular setting.
EventIdentifier	Type string Properties Filter, Sort Description The unique ID of the event. For example, `4DWDVuDbwCDZcEIdp7MQZ`.
LoginKey	Type string Properties Nillable Description The string that ties together all events in a given user’s login session. It starts with a login event and ends with either a logout event or the user session expiring.
SessionKey	Type string Properties Nillable Description The user’s unique session ID. You can use this value to identify all user events within a session. When a user logs out and logs in again, a new session is started.
SessionLevel	Type picklist Properties Nillable, Restricted picklist Description Indicates the session-level security of the session that the user is logging out of for this event. Session-level security controls user access to features that support it, such as connected apps and reporting. Possible values are: `HIGH_ASSURANCE`—A high assurance session was used for resource access. For example, when the user tries to access a resource such as a connected app, report, or dashboard that requires a high-assurance session level. `LOW`—The user’s security level for the current session meets the lowest requirements. This low level is not available, nor used, in the Salesforce UI. User sessions through the UI are either standard or high assurance. You can set this level using the API, but users assigned this level will experience unpredictable and reduced functionality in their Salesforce org. Note `STANDARD`—The user’s security level for the current session meets the Standard requirements set in the org’s Session Security Levels.
SourceIp	Type string Properties Nillable Description The source IP address of the client logging out. For example, `126.7.4.2`.
UserId	Type reference Properties Nillable Description Represents the ID of the user associated with the logout event.
Username	Type string Properties Nillable Description Represents the username of the user associated with the logout event.

Standard SOQL Usage

Currently, the only supported SOQL function on LogoutEvent is WHERE, and you can only use comparison operators (=, <, >, <=, and >=) on the final expression in a WHERE clause. The != operator isn’t supported.

Date functions such as convertTimezone() aren’t supported. For example, SELECT CALENDAR_YEAR(EventDate), Count(EventIdentifier) FROM LogoutEvent GROUP BY CALENDAR_YEAR(EventDate) returns an error. You can use date literals in your queries and some date and date/time functions like TODAY, YESTERDAY, and LAST_n_DAYS:1. However, these functions use comparison operators behind the scenes. This means you can only use them in the final expression of a WHERE clause.

Note

LogoutEvent allows filtering over two ordered fields: EventDate and EventIdentifier. There’s a catch here; your query won’t work unless you use the correct order and combination of these fields. The following list provides some examples of valid and invalid queries:

Unfiltered
- Valid—Contains no WHERE clause, so no special rules apply.
Filtered on EventDate
- Valid—You can filter solely on EventDate, but single filters on other fields fail. You can also use a comparison operator in this query type.
- Valid—You can filter on EventDate using date literals.
Filtered on EventDate and EventIdentifier
- Valid—Successful queries on LogoutEvent filter over both fields.
- Invalid—Queries on LogoutEvent with EventDate and standard date literals.
- Invalid—Filtering only on EventDate with <= or >= operator and EventIdentifier field isn’t supported.

Async SOQL Usage

With Async SOQL, you can filter on any field in LogoutEvent and use any comparison operator in your query.

Example: Get Yesterday’s Successful Logouts

SELECT EventDate, EventIdentifier, SourceIp, UserId FROM LogoutEvent WHERE EventDate<Yesterday

Platform Events Developer Guide

Supported Calls

Special Access Rules

Fields

Standard SOQL Usage

Async SOQL Usage

See Also