| AdditionalInfo |
- Type
- string
- Properties
- Nillable
- Description
- JSON serialization of additional information that’s
captured from the HTTP headers during an API request. For
example, {"field1":
"value1", "field2": "value2"}.
|
| ApiType |
- Type
- string
- Properties
- Nillable
- Description
- The API that was used. Values include:
- Bulk
- REST
- SOAP
Enterprise
- SOAP
Partner
- N/A
|
| ApiVersion |
- Type
- double
- Properties
- Nillable
- Description
- The version number of the API.
|
| Application |
- Type
- string
- Properties
- Nillable
- Description
- The application used to access the org. For example, CRM Analytics or Salesforce
Developers Connector.
|
| Client |
- Type
- string
- Properties
- Nillable
- Description
- The service that executed the API event. If you’re using
an unrecognized client, this field returns “Unknown” or
a blank value.
|
| ConnectedAppId |
- Type
- string
- Properties
- Nillable
- Description
- The 15-character ID of the connected app associated with the API call. For example,
0H4RM00000000Kr0AI. The
ConnectedAppID field populates
when a call triggers an OAuth 2.0 authentication
process, which identifies the connected app that’s
authorized to access Salesforce data on behalf of a
user. When a user associated with the call already has
an active authentication token, the
ConnectedAppID is set to a null
value.
|
| ElapsedTime |
- Type
- int
- Properties
- Nillable
- Description
- The amount of time it took for the request to complete
in milliseconds. The measurement of this value begins
before the query executes and ends when the query
completes. It doesn’t include the amount of time it
takes to return the result over the network.
|
| EvaluationTime |
- Type
- double
- Properties
- Nillable
- Description
- The amount of time it took to evaluate the policy in
milliseconds.
|
| EventDate |
- Type
- dateTime
- Properties
- Nillable
- Description
- The time when the specified API event was captured
(after query execution takes place). For example,
2020-01-20T19:12:26.965Z. Milliseconds are
the most granular setting.
|
| EventIdentifier |
- Type
- string
- Properties
- Nillable
- Description
- The unique ID of the event, which is shared with the
corresponding storage object. For example, 0a4779b0-0da1-4619-a373-0a36991dff90. Use this field to correlate
the event with its storage object.
|
| EventUuid |
- Type
- string
- Properties
- Nillable
- Description
- A universally unique identifier (UUID) that identifies
a platform event message. This field is available in API version 52.0 and
later.
|
| LoginHistoryId |
- Type
- reference
- Properties
- Nillable
- Description
- Tracks a user session so you can correlate user activity
with a particular series of API events. This field is
also available on the LoginEvent, AuthSession, and
LoginHistory objects, making it easier to trace events
back to a user’s original authentication. For example,
0YaB000002knVQLKA2.
|
| LoginKey |
- Type
- string
- Properties
- Nillable
- Description
- The string that ties together all events in a given user’s
login session. The session starts with a login event and ends with either a
logout event or the user session expiring. For example, lUqjLPQTWRdvRG4.
|
| Operation |
- Type
- picklist
- Properties
- Nillable, Restricted Picklist
- Description
- The API call that generated the event. Possible values
are Query, QueryAll, or QueryMore.
|
| Platform |
- Type
- string
- Properties
- Nillable
- Description
- The operating system on the login machine. For example,
iPhone, Mac OS, Linux, or Unknown.
|
| PolicyId |
- Type
- reference
- Properties
- Nillable
- Description
- The ID of the transaction policy associated with this
event. For example, 0NIB000000000KOOAY.
|
| PolicyOutcome |
- Type
- picklist
- Properties
- Nillable, Restricted picklist
- Description
- The result of the transaction policy. For this event,
possible values are:
-
Block - The
user was blocked from performing the operation
that triggered the policy.
-
Error - The
policy caused an undefined error when it
executed.
-
ExemptNoAction—The user is exempt
from transaction security policies, so the policy
didn’t trigger.
-
MeteringBlock—The policy took
longer than 3 seconds to process, so the user was
blocked from performing the operation.
-
MeteringNoAction—The policy took
longer than 3 seconds to process, but the user
isn't blocked from performing the operation.
-
NoAction -
The policy didn't trigger.
-
Notified -
A notification was sent to the recipient.
|
| QueriedEntities |
- Type
- string
- Properties
- Nillable
- Description
- The entities in the SOQL query. For example,
Opportunity, Lead, Account, or Case. Can also include
custom objects. For relationship queries, the value of
this field contains all entities involved in the
query.
- Examples
-
- For SELECT
Contact.FirstName, Contact.Account.Name from
Contact, the value of
QueriedEntities is
Account,
Contact.
- For SELECT
Account.Name, (SELECT Contact.FirstName,
Contact.LastName FROM Account.Contacts) FROM
Account, the value of
QueriedEntities is
Account,
Contact.
- For SELECT Id, Name,
Account.Name FROM Contact WHERE Account.Industry =
'media', the value of
QueriedEntities is
Account,
Contact.
|
| Query |
- Type
- textarea
- Properties
- Nillable
- Description
- The SOQL query. For example, SELECT id FROM Lead.
|
| Records |
- Type
- json
- Properties
- Nillable
- Description
- A JSON string that represents the queried objects’ metadata. This metadata includes
the number of results of a query per entity type and the
entity IDs. The Records field is set to a null value for
BULK API queries. Bulk API queries from ApiEventStream can
exceed bandwidth limitations due to the size of the
Records field.
To reduce the payload size, the Records field is set to
a null value.
- Example
-
1{ "totalSize" : 1,
2 "done" : true,
3 "records" : [ {
4 "attributes" : {
5 "type" : "Account"
6 },
7 "Id" : "001xx000003DMvCAAW",
8 "Contacts" : {
9 "totalSize" : 3,
10 "done" : true,
11 "records" : [ {
12 "attributes" : {
13 "type" : "Contact"
14 },
15 "Id" : "003xx000004U7xKAAS"
16 }, {
17 "attributes" : {
18 "type" : "Contact"
19 },
20 "Id" : "003xx000004U7xLAAS"
21 }, {
22 "attributes" : {
23 "type" : "Contact"
24 },
25 "Id" : "003xx000004U7xMAAS"
26 } ]
27 }
28 } ]
29}
|
| RelatedEventIdentifier |
- Type
- string
- Properties
- Nillable
- Description
- Represents the EventIdentifier of
the related event. For example,
bd76f3e7-9ee5-4400-9e7f-54de57ecd79c.
This field
is populated only when the activity that this event
monitors requires extra authentication, such as
multi-factor authentication. In this case,
Salesforce generates more events and sets the
RelatedEventIdentifier field
of the new events to the value of the
EventIdentifier field of the
original event. Use this field with the
EventIdentifier field to
correlate all the related events. If no extra
authentication is required, this field is blank.
|
| ReplayId |
- Type
- string
- Properties
- Nillable
- Description
- Represents an ID value that is populated by the system
and refers to the position of the event in the event stream. Replay ID values
aren’t guaranteed to be contiguous for consecutive events. A subscriber can
store a replay ID value and use it on resubscription to retrieve missed events
that are within the retention window.
|
| RowsProcessed |
- Type
- double
- Properties
- Nillable
- Description
- The total number of rows of data returned from the API
query when the user executed the query.
For big
objects, if the total number of returned rows is
greater than the API batch
size, RowsProcessed is
-1.
|
| RowsReturned |
- Type
- double
- Properties
- Nillable
- Description
- The number of rows of data returned in the current API
batch.
If RowsProcessed is less
than the API batch size,
RowsReturned is equal to
RowsProcessed. If
RowsProcessed is greater than
the API batch size,
RowsReturned equals either
the API batch size or the number of rows in the last
batch.
|
| SessionKey |
- Type
- string
- Properties
- Nillable
- Description
- The user’s unique session ID. Use this value to identify
all user events within a session. When a user logs out and logs in again, a new
session is started. For example, vMASKIU6AxEr+Op5.
|
| SessionLevel |
- Type
- picklist
- Properties
- Nillable, Restricted picklist
- Description
- Session-level security controls user access to features
that support it, such as connected apps and reporting.
Possible values are:
- HIGH_ASSURANCE - A high assurance session was
used for resource access. For example, when the
user tries to access a resource such as a
connected app, report, or dashboard that requires
a high-assurance session level.
- LOW - The user’s security level for the current session meets the lowest
requirements.
This low level is not available,
nor used, in the Salesforce UI. User sessions
through the UI are either standard or high
assurance. You can set this level using the API,
but users assigned this level experience
unpredictable and reduced functionality.
- STANDARD - The user’s security level for the
current session meets the Standard requirements
set in the current organization Session Security
Levels.
|
| SourceIp |
- Type
- string
- Properties
- Nillable
- Description
- The IP from which the API events originated. A Salesforce internal IP (such as from an
API event originating from AppExchange) is shown as
“Salesforce.com IP”.
|
| UserAgent |
- Type
- string
- Properties
- Nillable
- Description
- The platform or environment in which the API call
originated. This field could include information about
the operating system, application, or web protocol. For
example, Mozilla/5.0
(iPhone; CPU iPhone OS 13_0 like Mac OS X)
AppleWebKit/605.1.15 (KHTML, like
Gecko)
|
| UserId |
- Type
- reference
- Properties
- Nillable
- Description
- The origin user’s unique ID. For example,
005000000000123.
|
| Username |
- Type
- string
- Properties
- Nillable
- Description
- The origin username in the format of
user@company.com at the time
the event was created.
|
j