ApiEventStream

Tracks these user-initiated read-only API calls: query(), queryMore(), and count(). Captures API requests through SOAP API, REST API, and Bulk API for the Enterprise and Partner WSDLs. Tooling API calls and API calls originating from a Salesforce mobile app aren’t captured. This object is available in API version 46.0 and later.

Supported Calls

describeSObjects()

Supported Subscribers

Subscriber	Supported?
Apex Triggers
Flows
Processes
Streaming API (CometD)

Streaming API Subscription Channel

/event/ApiEventStream

Special Access Rules

Accessing this object requires either the Salesforce Shield or Salesforce Event Monitoring add-on subscription and the View Data Leakage Detection Events user permission.

Fields

Field	Details
AdditionalInfo	Type string Properties Nillable Description JSON serialization of additional information that’s captured from the `HTTP` headers during an API request. For example, `{"field1": "value1", "field2": "value2"}`.
ApiType	Type string Properties Nillable Description The API that was used. Values include: `SOAP Enterprise` `SOAP Partner` `REST API` `N/A`
ApiVersion	Type double Properties Nillable Description The version number of the API.
Application	Type string Properties Nillable Description The application used to access the org. For example, Einstein Analytics or Salesforce Developers Connector.
Client	Type string Properties Nillable Description The service that executed the API event. If you’re using an unrecognized client, this field returns “Unknown” or a blank value.
ConnectedAppId	Type reference Properties Nillable Description The 15 character ID of the connected app associated with the API call.
ElapsedTime	Type int Properties Nillable Description The amount of time it took for the request to complete in milliseconds. The measurement of this value begins before the query executes and ends when the query completes. It doesn’t include the amount of time it takes to return the result over the network.
EvaluationTime	Type double Properties Nillable Description The amount of time it took to evaluate the policy in milliseconds.
EventDate	Type dateTime Properties Nillable Description The time when the specified API event was captured (after query execution takes place). For example, 2013-01-01T03:01:01Z. Seconds are the most granular setting.
EventIdentifier	Type string Properties Nillable Description The unique ID of the event. For example, 0a4779b0-0da1-4619-a373-0a36991dff90.
LoginHistoryId	Type reference Properties Nillable Description Tracks a user session so you can correlate user activity with a particular series of API events. This field is also available on the LoginEvent, AuthSession, and LoginHistory objects, making it easier to trace events back to a user’s original authentication.
LoginKey	Type string Properties Nillable Description The string that ties together all events in a given user’s login session. The session starts with a login event and ends with either a logout event or the user session expiring.
Operation	Type string Properties Nillable, Restricted Picklist Description The API call that generated the event (`Query`, `QueryAll`, or `QuerMore`).
Platform	Type string Properties Nillable Description The operating system on the login machine. For example, iPhone, Mac OS, Linux, or Unknown.
PolicyOutcome	Type picklist Properties Nillable, Restricted picklist Description The result of the transaction policy. Possible values are: `Block` - The user was blocked from performing the operation that triggered the policy. `Error` - The policy caused an undefined error when it executed. `FailedInvalidPassword` - The user entered an invalid password. `FailedPasswordLockout` - The user entered an invalid password too many times. `NoAction` - The policy didn't trigger.
QueriedEntities	Type string Properties Nillable Description The entities in the SOQL query. For example, Opportunity, Lead, Account, or Case. Can also include custom objects. For relationship queries, the value of this field contains all entities involved in the query. If the query returns 0 records, then the value of this field is null. Examples For `SELECT Contact.FirstName, Contact.Account.Name from Contact`, the value of QueriedEntities is `Account, Contact`. For `SELECT Account.Name, (SELECT Contact.FirstName, Contact.LastName FROM Account.Contacts) FROM Account`, the value of QueriedEntities is `Account, Contact`. For `SELECT Id, Name, Account.Name FROM Contact WHERE Account.Industry = 'media'`, the value of QueriedEntities is `Account, Contact`.
Query	Type textarea Properties Nillable Description The SOQL query. For example, `SELECT id FROM Lead`.
Records	Type json Properties Nillable Description A JSON string that represents the queried objects’ metadata. This metadata includes the number of results of a query per entity type and the entity IDs. Example `1{ "totalSize" : 1, 2 "done" : true, 3 "records" : [ { 4 "attributes" : { 5 "type" : "Account" 6 }, 7 "Id" : "001xx000003DMvCAAW", 8 "Contacts" : { 9 "totalSize" : 3, 10 "done" : true, 11 "records" : [ { 12 "attributes" : { 13 "type" : "Contact" 14 }, 15 "Id" : "003xx000004U7xKAAS" 16 }, { 17 "attributes" : { 18 "type" : "Contact" 19 }, 20 "Id" : "003xx000004U7xLAAS" 21 }, { 22 "attributes" : { 23 "type" : "Contact" 24 }, 25 "Id" : "003xx000004U7xMAAS" 26 } ] 27 } 28 } ] 29}`
RelatedEventIdentifier	Type string Properties Nillable Description Represents the EventIdentifier of the related event.
ReplayId	Type string Properties Nillable Description Represents an ID value that is populated by the system and refers to the position of the event in the event stream. Replay ID values aren’t guaranteed to be contiguous for consecutive events. A subscriber can store a replay ID value and use it on resubscription to retrieve missed events that are within the retention window.
RowsProcessed	Type double Properties Nillable Description The number of rows of data returned from the query.
SessionKey	Type string Properties Nillable Description The user’s unique session ID. Use this value to identify all user events within a session. When a user logs out and logs in again, a new session is started.
SessionLevel	Type picklist Properties Nillable, Restricted picklist Description Session-level security controls user access to features that support it, such as connected apps and reporting. Possible values are: HIGH_ASSURANCE - A high assurance session was used for resource access. For example, when the user tries to access a resource such as a connected app, report, or dashboard that requires a high-assurance session level. LOW - The user’s security level for the current session meets the lowest requirements. This low level is not available, nor used, in the Salesforce UI. User sessions through the UI are either standard or high assurance. You can set this level using the API, but users assigned this level will experience unpredictable and reduced functionality in their Salesforce org. Note STANDARD - The user’s security level for the current session meets the Standard requirements set in the current organization Session Security Levels.
SourceIp	Type string Properties Nillable Description The IP from which the API events originated. A Salesforce internal IP (such as from an API event originating from Salesforce AppExchange) is shown as “Salesforce.com IP”.
UserAgent	Type string Properties Nillable Description The platform or environment in which the API call originated. This field could include information about the operating system, application, or web protocol.
UserId	Type reference Properties Nillable Description The origin user’s unique ID. For example, 005000000000123.
Username	Type string Properties Nillable Description The origin username in the format of user@company.com at the time the event was created.

Platform Events Developer Guide