TransactionSecurityPolicy | Metadata API Developer Guide

This type extends the Metadata metadata type and inherits its fullName field.

File Suffix and Directory Location

TransactionSecurityPolicy components have the suffix .transactionSecurityPolicy and are stored in the transactionSecurityPolicies folder.

Version

TransactionSecurityPolicy components are available in API version 35.0 and later.

Fields

Field Name	Field Type	Description
action	TransactionSecurityAction	Required. Describes the action to take when the matching Transaction Security policy is triggered.
active	boolean	Required. If `true`, the policy is enabled and is actively monitoring its event.
apexClass	string	Required for Apex-based policies, and optional for all other policies. The name of the class that implements the `TxnSecurity.PolicyCondition` or `TxnSecurity.EventCondition` interface for this policy. Available in API version 46.0 and later.
description	string	A description of the policy.
developerName	string	This unique name prevents conflicts with other policies that have the same masterLabel. This name can contain only underscores and alphanumeric characters, and must be unique in your org. It must begin with a letter, not include spaces, not end with an underscore, and not contain two consecutive underscores.
eventName	TransactionSecurityEventName (enumeration of type string)	Used in Real-Time Event Monitoring only. Indicates the name of the event the policy monitors. This field is available in API 45.0 and later. Valid values are: `ApiEvent`—Tracks these user-initiated read-only API calls: `query()`, `queryMore()`, and `count()`. Captures API requests through SOAP API, REST API, and Bulk API for the Enterprise and Partner WSDLs. Tooling API calls and API calls originating from a Salesforce mobile app aren’t captured. `ListViewEvent`—Tracks when users access data with list views using Lightning Experience, Salesforce Classic, or the API. It doesn’t track list views of Setup entities. `LoginEvent`—LoginEvent tracks login activity of users who log in to Salesforce. `ReportEvent`—Tracks when reports are run in your org.
eventType	MonitoredEvents (enumeration of type string)	Required for Apex-based policies, and optional for all other policies. Indicates which type of event is being monitored. Valid values are: `AccessResource`—Notifies you when the selected resource has been accessed. `AuditTrail`—Reserved for future use. `DataExport`—Notifies you when the selected object type has been exported using the Data Loader API client. `Entity`—Notifies you on use of an object type such as an authentication provider or Chatter comment. `Login`—Notifies you when a user logs in.
executionUser	string	Required only for legacy policies (policies that implement the `TxnSecurity.PolicyCondition` interface). The name or ID of an active user who is assigned the Modify All Data and View Setup user permissions. This field is not required or used in enhanced policies (policies that implement the `TxnSecurity.EventCondition` interface).
flow	string	Required only for policies of type `CustomConditionBuilderPolicy`. The ID of the Flow object that contains the logic the Condition Builder transaction security policy. Available in API version 46.0 and later.
masterLabel	string	The master label for this object. This display value is the internal label that is not translated.
resourceName	string	Required for Apex-based policies, and optional for all other policies. A resource used to narrow down the conditions under which the policy triggers. For example, with a `DataExport` event, you can select a resource Lead to specifically monitor export activity occurring on your Lead entities. The resources available depend on the Event Type field. Valid resources are grouped below by event type. AccessResource—ConnectedApplication, Reports DataExport—Account, Case, Contact, Lead, Opportunity Entity—AuthProvider, ChatterMessage, FeedComment, FeedItem, Idea, Question Login—LoginHistory
type	TxnSecurityPolicyType (enumeration of type string)	The type of validation that the policy uses. The valid values are: `CustomApexPolicy`— Created with Apex editor. `CustomConditionBuilderPolicy`— Created with Condition Builder. The default value is `CustomApexPolicy`.

TransactionSecurityAction

Describes the action to take when the matching Transaction Security policy is triggered.

Field Name	Field Type	Description
block	boolean	Required. If `true`, the requested operation is blocked. This action only applies to Login and AccessResource events.
endSession	boolean	Required. If `true`, a current session must be closed before a new session can be started. This action only applies to Login events.
freezeUser	boolean	Required. If `true`, the user that triggered the policy is frozen. This action only applies to Chatter resources for Entity events.
notifications	TransactionSecurityNotification[]	Specifies how to notify the system administrator when the action is triggered. There can be none, one, or multiple notifications.
twoFactorAuthentication	boolean	Required. If `true`, two-factor authentication is required for a higher level of access before the requested operation can continue. This action only applies to Login and AccessResource events.

TransactionSecurityNotification

Describes who to notify and how to notify them when the matching Transaction Security policy is triggered.

Field Name	Field Type	Description
inApp	boolean	True if an in-app notification is selected.
sendEmail	boolean	True if an email notification is selected.
user	string	The administrator to receive the notification. This user must have the Modify All Data and View Setup permissions.

Declarative Metadata Sample Definition

The following is an example of a TransactionSecurityPolicy component.

1<?xml version="1.0" encoding="UTF-8"?>
2<TransactionSecurityPolicy xmlns="http://soap.sforce.com/2006/04/metadata">
3    <action>
4        <block>true</block>
5        <endSession>false</endSession>
6        <notifications>
7            <inApp>false</inApp>
8            <sendEmail>true</sendEmail>
9            <user>admin@your.org</user>
10        </notifications>
11        <twoFactorAuthentication>false</twoFactorAuthentication>
12    </action>
13    <active>true</active>
14    <apexClass>TxnSecurityMdApiPolicy</apexClass>
15    <eventType>Login</eventType>
16    <executionUser>admin@your.org</executionUser>
17    <resourceName>LoginHistory</resourceName>
18</TransactionSecurityPolicy>

The following is an example package manifest used to deploy or retrieve the transaction security metadata for an organization.

1<?xml version="1.0" encoding="UTF-8"?>
2<Package xmlns="http://soap.sforce.com/2006/04/metadata">
3    <types>
4        <members>MySecurityPolicy</members>
5        <name>TransactionSecurityPolicy</name>
6    </types>
7    <version>35.0</version>
8</Package>

Wildcard Support in the Manifest File

This metadata type supports the wildcard character * (asterisk) in the package.xml manifest file. For information about using the manifest file, see Deploying and Retrieving Metadata with the Zip File.