ReportEvent (Beta)

Tracks when reports are run in your org. ReportEvent is evaluated in a transaction security policy. ReportEvent is a big object that stores the event data of ReportEventStream. This object is available in API version 42.0 and later.

This object is included in Real-Time Event Monitoring (Beta). As a beta feature, Real-Time Event Monitoring is a preview and isn’t part of the “Services” under your master subscription agreement with Salesforce. Use this feature at your sole discretion, and make your purchase decisions only on the basis of generally available products and features. Salesforce doesn’t guarantee general availability of this feature within any particular time frame or at all, and we can discontinue it at any time. This feature is for evaluation purposes only, not for production use. It’s offered as is and isn’t supported, and Salesforce has no liability for any harm or damage arising out of or in connection with it. All restrictions, Salesforce reservation of rights, obligations concerning the Services, and terms for related Non-Salesforce Applications and Content apply equally to your use of this feature. You can provide feedback and suggestions for this object in the Real-Time Event Monitoring Beta group in the Trailblazer Community.

Note

Supported Calls

describeSObjects(), query()

Special Access Rules

Accessing this object requires the Shield Event Monitoring add-on, and the View Data Leakage Detection Events and API Enabled user permissions.

Fields

Field	Details
ColumnHeaders	Type string Properties Nillable Description Comma-separated values of column headers of the report. For example, [USERNAME, ACCOUNT.NAME, TYPE, DUE_DATE, LAST_UPDATE, ADDRESS1_STATE].
DashboardId	Type reference Properties Nillable Description The ID of the dashboard that the report was part of.
DashboardName	Type string Properties Nillable Description The title of the dashboard that the report was part of.
Description	Type string Properties Nillable Description The description of the report.
EvaluationTime	Type double Properties Nillable Description The amount of time it took to evaluate the policy in milliseconds.
EventDate	Type dateTime Properties Filter, Sort Description The time when the specified report event was captured (after query execution takes place). For example, 2013-01-01T03:01:01Z. Seconds are the most granular setting.
EventIdentifier	Type string Properties Filter, Sort Description The unique ID of the event. For example, 4DWDVuDbwCDZcEIdp7MQZ.
EventSource	Type picklist Properties Nillable, Restricted Picklist Description The source of the event. Possible values are: `API`—The user generated the report from an API call. `Classic`—The user generated the report from the Salesforce Classic UI. `Lightning`—The user generated the report from Lightning Experience.
ExecutionIdentifier	Type string Properties Nillable Description When report data is divided into multiple report events, you can use this unique identifier to correlate all of the multiple data chunks. For example, each chunk might have the same ExecutionIdentifier of a50a4025-84f2-425d-8af9-2c780869f3b5, enabling you to link them together to provide a complete data picture.
ExportFileFormat	Type string Properties Nillable Description If the user exported the report, this value indicates the format of the exported report. Possible values are: CSV Excel
Format	Type picklist Properties Defaulted on create, Nillable, Restricted picklist Description The format of the report. Possible values are: `Matrix` `MultiBlock` `Summary` `Tabular`
IsScheduled	Type boolean Properties Defaulted on create Description If TRUE, the report was scheduled. If FALSE, the report wasn’t scheduled.
LoginHistoryId	Type reference Properties Nillable Description Tracks a user session so you can correlate user activity with a particular series of report events. This field is also available on the LoginEvent, AuthSession, and LoginHistory objects, making it easier to trace events back to a user’s original authentication. This value is null if the event that was generated was from a dashboard refresh, a multi-block report, or a scheduled report.
LoginKey	Type string Properties Nillable Description The string that ties together all events in a given user’s login session. The session starts with a login event and ends with either a logout event or the user session expiring. This value is null if the event that was generated was from a dashboard refresh, a multi-block report, or a scheduled report.
Name	Type string Properties Nillable Description The display name of the report.
NumberOfColumns	Type int Properties Nillable Description The number of columns in the report.
Operation	Type picklist Properties Nillable, Restricted Picklist Description The operation performed on the report.
OwnerId	Type reference Properties Nillable Description The ID of the folder, organization, or user who owns the report. If the report wasn’t saved, this value is the same as UserId.
PolicyId	Type reference Properties Nillable Description The ID of the transaction policy associated with this event.
PolicyOutcome	Type picklist Properties Nillable, Restricted picklist Description The result of the transaction policy. Possible values are: `Block` - The user was blocked from performing the operation that triggered the policy. `EndSession` - The Concurrent Sessions Limiting policy activated, limiting the number of concurrent sessions per user. `Error` - The policy caused an undefined error when it executed. `FailedInvalidPassword` - The user entered an invalid password. `FailedPasswordLockout` - The user entered an invalid password too many times. `NoAction` - The policy didn't trigger. `Notified` - A notification was sent to the recipient. `TwoFAAutomatedSuccess` - Salesforce Authenticator approved the request for access because the request came from a trusted location. After users enable location services in Salesforce Authenticator, they can designate trusted locations. When a user trusts a location for a particular activity, such as logging in from a recognized device, that activity is approved from the trusted location for as long as the location is trusted. `TwoFADenied` - The user denied the approval request in the authenticator app, such as Salesforce Authenticator. `TwoFAFailedGeneralError` - An error caused by something other than an invalid verification code, too many verification attempts, or authenticator app connectivity. `TwoFAFailedInvalidCode` - The user provided an invalid verification code. `TwoFAFailedTooManyAttempts` - The user attempted to verify identity too many times. For example, the user entered an invalid verification code repeatedly. `TwoFAInitiated` - Salesforce initiated identity verification but hasn’t yet challenged the user. `TwoFAInProgress` - Salesforce challenged the user to verify identity and is waiting for the user to respond or for Salesforce Authenticator to send an automated response. `TwoFANoAction` - The policy specifies two factor authentication as an action, but the user is already in a high-assurance session. `TwoFARecoverableError` - Salesforce can’t reach the authenticator app to verify identity, but will retry. `TwoFAReportedDenied` - The user denied the approval request in the authenticator app, such as Salesforce Authenticator, and also flagged the approval request to report to an administrator. `TwoFASucceeded` - The user’s identity was verified.
QueriedEntities	Type string Properties Nillable Description The entities in the SOQL query. For example, Opportunity, Lead, Account, or Case. Can also include custom objects. For relationship queries, the value of this field contains all entities involved in the query. If the query returns 0 records, then the value of this field is null. Examples For `SELECT Contact.FirstName, Contact.Account.Name from Contact`, the value of QueriedEntities is `Account, Contact`. For `SELECT Account.Name, (SELECT Contact.FirstName, Contact.LastName FROM Account.Contacts) FROM Account`, the value of QueriedEntities is `Account, Contact`. For `SELECT Id, Name, Account.Name FROM Contact WHERE Account.Industry = 'media'`, the value of QueriedEntities is `Account, Contact`.
RelatedEventIdentifier	Type string Properties Nillable Description Represents the EventIdentifier of the related event. This field is available in API version 43.0 and later.
ReportData	Type json Properties Nillable Description A JSON string that represents the report’s data. For example, `{"totalSize":1,"rows":[{"datacells":["005B0000001vURv","001B000000fewai"]}]}`.
ReportId	Type reference Properties Nillable Description The ID of the report associated with this event.
RowsProcessed	Type double Properties Nillable Description The total number of rows returned in the report. When report data is divided into multiple report events, this value is the same for all data chunks. For more information, see ExecutionIdentifier.
Scope	Type string Properties Nillable Description Defines the scope of the data on which the user ran the report. For example, users can run the report against all opportunities, opportunities they own, or opportunities their team owns. Valid values depend on the report type.
Sequence	Type int Properties Nillable Description Incremental sequence number that indicates the order of events within a given report execution. For more information, see ExecutionIdentifier.
SessionKey	Type string Properties Nillable Description The user’s unique session ID. Use this value to identify all user events within a session. When a user logs out and logs in again, a new session is started. This value is null if the event that was generated was from a dashboard refresh, a multi-block report, or a scheduled report.
SessionLevel	Type picklist Properties Nillable, Restricted picklist Description Session-level security controls user access to features that support it, such as connected apps and reporting. Possible values are: `HIGH_ASSURANCE` - A high assurance session was used for resource access. For example, when the user tries to access a resource such as a connected app, report, or dashboard that requires a high-assurance session level. `LOW` - The user’s security level for the current session meets the lowest requirements. This low level is not available, nor used, in the Salesforce UI. User sessions through the UI are either standard or high assurance. You can set this level using the API, but users assigned this level will experience unpredictable and reduced functionality in their Salesforce org. Note `STANDARD` - The user’s security level for the current session meets the Standard requirements set in the org’s Session Security Levels. This value is null if the event that was generated was from a dashboard refresh, a multi-block report, or a scheduled report.
SourceIp	Type string Properties Nillable Description The source IP address of the client that logged in. For example, 126.7.4.2. This field is available in API version 43.0 and later.
UserId	Type reference Properties Nillable Description The origin user’s unique ID. For example, 005000000000123.
Username	Type string Properties Nillable Description The origin username in the format of user@company.com at the time the event was created.

Standard SOQL Usage

Example

SELECT Username, QueriedEntities, ReportData, PolicyOutcome, Operation, Name FROM ReportEvent

Async SOQL Usage

With Async SOQL, you can filter on any field in ReportEvent and use any comparison operator in your query.

Example: Find all reports that users ran against Patent__c

SELECT EventDate, EventIdentifier, PolicyOutcome, EvaluationTime, ReportId, Name FROM ReportEvent WHERE QueriedEntities='Patent_c'

Platform Events Developer Guide