LoginEventStream

Tracks login activity of users who log in to the org. This object is available in API version 46.0 and later.

Supported Calls

describeSObjects()

Supported Subscribers

Subscriber	Supported?
Apex Triggers
Flows
Processes
Streaming API (CometD)

Streaming API Subscription Channel

/event/LoginEventStream

Special Access Rules

Accessing this object requires either the Salesforce Shield or Salesforce Event Monitoring add-on subscription and the View Data Leakage Detection Events user permission.

Fields

Field	Details
AdditionalInfo	Type string Properties Nillable Description JSON serialization of additional information that’s captured from the `HTTP` headers during a login request. For example, `{"field1": "value1","field2": "value2"}`.
ApiType	Type string Properties Nillable Description English-only. The type of API that’s used to log in. Values include: `XML-RPC` `OSOAP` `SOAP Enterprise` `SOAP Partner` `SOAP Internal/CrossInstance` `REST API` `Metadata API` `N/A`
ApiVersion	Type string Properties Nillable Description English-only. The version number of the API. If no version number is available, “Unknown” is returned.
Application	Type string Properties Nillable Description The application name in English. For example, `Salesforce Internal Application` or `Microsoft SOAP Toolkit`.
AuthServiceId	Type string Properties Nillable Description Refers to the AuthenticationServiceId field in the LoginHistory object. For example, you can use this field to identify the SAML or authentication provider configuration with which the user logged in.
Browser	Type string Properties Nillable Description The browser name and version if known. If no browser or version number is available, “Unknown” is returned. Product names are in English.
CipherSuite	Type picklist Properties Nillable, Restricted picklist Description The TLS cipher suite used for the login. Values are OpenSSL-style cipher suite names, with hyphen delimiters, for example, AES128-GCM-SHA256. Valid values are: `AES128-GCM-SHA256` `AES128-SHA` `AES128-SHA256` `AES256-GCM-SHA384` `AES256-SHA` `AES256-SHA256` `DES-CBC3-SHA` `DHE-RSA-AES128-GCM-SHA256` `DHE-RSA-AES128-SHA` `DHE-RSA-AES256-GCM-SHA384` `DHE-RSA-AES256-SHA` `DHE-RSA-DES-CBC3-SHA` `ECDH-ECDSA-AES128-GCM-SHA256` `ECDH-ECDSA-AES128-SHA256` `ECDH-ECDSA-AES256-GCM-SHA384` `ECDH-ECDSA-AES256-SHA384` `ECDH-RSA-AES128-GCM-SHA256` `ECDH-RSA-AES128-SHA256` `ECDH-RSA-AES256-GCM-SHA384` `ECDH-RSA-AES256-SHA384` `ECDHE-ECDSA-AES128-GCM-SHA256` `ECDHE-ECDSA-AES128-SHA256` `ECDHE-ECDSA-AES256-GCM-SHA384` `ECDHE-ECDSA-AES256-SHA384` `ECDHE-RSA-AES128-CBC-SHA` `ECDHE-RSA-AES128-GCM-SHA256` `ECDHE-RSA-AES128-SHA` `ECDHE-RSA-AES128-SHA256` `ECDHE-RSA-AES256-CBC-SHA` `ECDHE-RSA-AES256-GCM-SHA384` `ECDHE-RSA-AES256-SHA` `ECDHE-RSA-AES256-SHA384` `ECDHE-RSA-DES-CBC3-SHA` `Unknown`
City	Type string Properties Nillable Description The city where the user’s IP address is physically located. This value is not localized. This field is available in API version 47.0 and later. Due to the nature of geolocation technology, the accuracy of this field can vary. Note
ClientVersion	Type string Properties Nillable Description English-only. The version number of the login client. If no version number is available, “Unknown” is returned.
Country	Type string Properties Nillable Description The country where the user’s IP address is physically located. This value is not localized.This field is available in API version 47.0 and later. Due to the nature of geolocation technology, the accuracy of this field can vary. Note
CountryIso	Type string Properties Nillable Description The ISO 3166 code for the country where the user’s IP address is physically located. For more information, see Country Codes - ISO 3166. This field is available in API version 37.0 and later.
EvaluationTime	Type double Properties Nillable Description The amount of time it took to evaluate the transaction security policy, in milliseconds.
EventDate	Type dateTime Properties Nillable Description The login time of the specified event. For example, `2013-01-01T03:01:01Z`. Seconds are the most granular setting.
EventIdentifier	Type string Properties (none) Description The unique identifier for each record in LoginEvent. Use this field as the primary key in your queries.
HttpMethod	Type picklist Properties Nillable, Restricted picklist Description The HTTP method of the login request; possible values are `GET`, `POST`, and `Unknown`.
LoginGeoId	Type string Properties Nillable Description The Salesforce ID of the LoginGeo object associated with the login user’s IP address.
LoginHistoryId	Type reference Properties Nillable Description Tracks a user session so you can correlate user activity with a particular login instance.
LoginKey	Type string Properties Nillable Description The string that ties together all events in a given user’s login session. The session starts with a login event and ends with either a logout event or the user session expiring.
LoginLatitude	Type double Properties Nillable Description The latitude where the user’s IP address is physically located.This field is available in API version 47.0 and later. Due to the nature of geolocation technology, the accuracy of this field can vary. Note
LoginLongitude	Type double Properties Nillable Description The longitude where the user’s IP address is physically located.This field is available in API version 47.0 and later. Due to the nature of geolocation technology, the accuracy of this field can vary. Note
LoginType	Type picklist Properties Nillable, Restricted picklist Description The event’s type of login. For example, `Application`.
LoginUrl	Type string Properties Nillable Description The URL of the login host. For example, `yourInstance.salesforce.com`.
NetworkId	Type string Properties Nillable Description The ID of the community that the user is logging in to. This field is available if Salesforce Communities is enabled for your organization.
Platform	Type string Properties Nillable Description The platform name and version that are used during the login event. If no platform name is available, “Unknown” is returned. Platform names are in English.
PolicyId	Type reference Properties Nillable Description The ID of the transaction security policy associated with this event.
PolicyOutcome	Type picklist Properties Nillable, Restricted picklist Description The result of the transaction policy. Possible values are: `Block`—The user was blocked from performing the operation that triggered the policy. `EndSession`—The Concurrent Sessions Limiting policy activated, limiting the number of concurrent sessions per user. `Error`—The policy caused an undefined error when it executed. `FailedInvalidPassword`—The user entered an invalid password. `FailedPasswordLockout`—The user entered an invalid password too many times. `NoAction`—The policy didn't trigger. `Notified`—A notification was sent to the recipient. `TwoFAAutomatedSuccess`—Salesforce Authenticator approved the request for access because the request came from a trusted location. After users enable location services in Salesforce Authenticator, they can designate trusted locations. When a user trusts a location for a particular activity, such as logging in from a recognized device, that activity is approved from the trusted location for as long as the location is trusted. `TwoFADenied`—The user denied the approval request in the authenticator app, such as Salesforce Authenticator. `TwoFAFailedGeneralError`—An error caused by something other than an invalid verification code, too many verification attempts, or authenticator app connectivity. `TwoFAFailedInvalidCode`—The user provided an invalid verification code. `TwoFAFailedTooManyAttempts`—The user attempted to verify identity too many times. For example, the user entered an invalid verification code repeatedly. `TwoFAInitiated`—Salesforce initiated identity verification but hasn’t yet challenged the user. `TwoFAInProgress`—Salesforce challenged the user to verify identity and is waiting for the user to respond or for Salesforce Authenticator to send an automated response. `TwoFANoAction`—The policy specifies two factor authentication as an action, but the user is already in a high-assurance session. `TwoFARecoverableError`—Salesforce can’t reach the authenticator app to verify identity, but will retry. `TwoFAReportedDenied`—The user denied the approval request in the authenticator app, such as Salesforce Authenticator, and also flagged the approval request to report to an administrator. `TwoFASucceeded`—The user’s identity was verified.
PostalCode	Type string Properties Nillable Description The postal code where the user’s IP address is physically located. This value is not localized.This field is available in API version 47.0 and later. Due to the nature of geolocation technology, the accuracy of this field can vary. Note
RelatedEventIdentifier	Type string Properties Nillable Description Represents the EventIdentifier of the related event.
RemoteIdentifier	Type string Properties Nillable Description Reserved for future use.
ReplayId	Type string Properties Nillable Description Represents an ID value that is populated by the system and refers to the position of the event in the event stream. Replay ID values aren’t guaranteed to be contiguous for consecutive events. A subscriber can store a replay ID value and use it on resubscription to retrieve missed events that are within the retention window.
SessionKey	Type string Properties Nillable Description The user’s unique session ID. Use this value to identify all user events within a session. When a user logs out and logs in again, a new session is started.
SessionLevel	Type picklist Properties Nillable, Restricted picklist Description Session-level security controls user access to features that support it, such as connected apps and reporting. Possible values are: `HIGH_ASSURANCE`—A high assurance session was used for resource access. For example, when the user tries to access a resource such as a connected app, report, or dashboard that requires a high-assurance session level. `LOW`—The user’s security level for the current session meets the lowest requirements. This low level is not available, nor used, in the Salesforce UI. User sessions through the UI are either standard or high assurance. You can set this level using the API, but users assigned this level experience unpredictable and reduced functionality in their Salesforce org. Note `STANDARD`—The user’s security level for the current session meets the Standard requirements set in the org’s Session Security Levels.
SourceIp	Type string Properties Nillable Description The source IP address of the client logging in. For example, `126.7.4.2`.
Status	Type string Properties Nillable Description The login status is in English. "Success" is returned when successful. Otherwise, an error message is returned.
Subdivision	Type string Properties Nillable Description The name of the subdivision where the user’s IP address is physically located. In the U.S., this value is usually the state name (for example, Pennsylvania). This value is not localized.This field is available in API version 47.0 and later. Due to the nature of geolocation technology, the accuracy of this field can vary. Note
TlsProtocol	Type picklist Properties Nillable, Restricted picklist Description The TLS protocol version used for the login. Valid values are: `TLS 1.0` `TLS 1.1` `TLS 1.2` `Unknown`
UserId	Type reference Properties Nillable Description The user’s unique ID. For example, `005000000000123`.
Username	Type string Properties Nillable Description The username in the format of `user@company.com`.
UserType	Type picklist Properties Nillable, Restricted picklist Description The category of user license. Each UserType is associated with one or more UserLicense records. Each UserLicense is associated with one or more profiles. Valid values are: `CsnOnly`—Users whose access to the application is limited to Chatter. This user type includes Chatter Free and Chatter moderator users. `CspLitePortal`—CSP Lite Portal license. Users whose access is limited because they are organization customers and access the application through a customer portal or community. `CustomerSuccess`—Customer Success license. Users whose access is limited because they are organization customers and access the application through a customer portal. `Guest` `PowerCustomerSuccess`—Power Customer Success license. Users whose access is limited because they are organization customers and access the application through a customer portal. Users with this license type can view and edit data they directly own or data owned by or shared with users below them in the customer portal role hierarchy. `PowerPartner`—Power Partner license. Users whose access is limited because they are partners and typically access the application through a partner portal or community. `SelfService` `Standard`—Standard user license. This user type also includes Salesforce Platform and Salesforce Platform One user licenses.

Platform Events Developer Guide