| Field |
Details |
| API_TYPE |
- Type
- String
- Description
- The type of API request.
- Possible values are:
-
D—Apex
Class
-
E—SOAP
Enterprise
-
M—SOAP
Metadata
-
P—SOAP
Partner
-
S—SOAP
Apex
-
T—SOAP
Tooling
-
f—Feed
-
l—Live
Agent
-
p—SOAP
ClientSync
|
| API_VERSION |
- Type
- String
- Description
- The version of the API that’s being used.
- For example: 36.0.
|
| AUTHENTICATION_METHOD_REFERENCE |
- Type
- String
- Description
- The authentication method used by a third-party
identification provider for an OpenID Connect single
sign-on protocol. This field is available in API version
51.0 and later.
|
| AUTHENTICATION_SERVICE_ID |
- Type
- Id
- Description
- The 15-character ID for the authentication service used
to log in. This field stores IDs for these
authentication services.
- SAML single sign-on providers
- Token exchange handlers
Available in API version 60.0 and later.
|
| BROWSER_TYPE |
- Type
- String
- Description
- The identifier string returned by the browser used at
login.
- Example values are:
- Go-http-client/1.1
- Mozilla/5.0
(Macintosh; Intel Mac OS X 10.12; rv%3A50.0)
Gecko/20100101 Firefox/50.0
- Mozilla/5.0
(Macintosh; Intel Mac OS X 10_11_6)
AppleWebKit/537.36 (KHTML, like Gecko)
Chrome/51.0.2704.84 Safari/537.36
|
| CIPHER_SUITE |
- Type
- String
- Description
- The TLS cipher suite used for the login. Values are
OpenSSL-style cipher suite names, with hyphen
delimiters. For more information, see OpenSSL
Cryptography and SSL/TLS Toolkit.
|
| CLIENT_IP |
- Type
- String
- Description
- The IP address of the client
that’s using Salesforce services. A Salesforce
internal IP (such as a login from AppExchange) is
shown as “Salesforce.com IP”.
-
For example: 96.43.144.26.
|
| CPU_TIME |
- Type
- Number
- Description
- The CPU time in milliseconds used to complete the
request. This field indicates the amount of activity
taking place in the app server layer.
|
| DB_TOTAL_TIME |
- Type
- Number
- Description
- The time in nanoseconds for a database round trip.
Includes time spent in the JDBC driver, network to the
database, and DB_CPU_TIME. Compare
this field to CPU_TIME to determine
whether performance issues are occurring in the database
layer or in your own code.
|
| EVENT_TYPE |
- Type
- String
- Description
-
The type of event. The
value is always Login.
|
| FORWARDED_FOR_IP |
- Type
- String
- Description
- The value in the X-Forwarded-For header of HTTP requests
sent by the client. For logins that use one or more HTTP
proxies, the X-Forwarded-For header is sometimes used
to store the origin IP and all proxy IPs.
- The FORWARDED_FOR_IP field stores whatever value the client
sends, which might not be an IP address. The maximum
length is 256 characters. Longer values are truncated.
The FORWARDED_FOR_IP field isn’t
populated for logins completed via OAuth flows or single
sign-on (SSO).
-
Available in API version 61.0 and later.
|
| LOGIN_KEY |
- Type
- String
- Description
- The string that ties together all events in a given
user’s login session. It starts with a login event and
ends with either a logout event or the user session
expiring.
- For example: GeJCsym5eyvtEK2I.
|
| LOGIN_STATUS |
- Type
- String
- Description
- The status of the login attempt. For successful logins,
the value is LOGIN_NO_ERROR. All other values indicate
errors or authentication issues. For details, see Login Event Type
— LOGIN_STATUS Values.
|
| LOGIN_SUB_TYPE |
- Type
- String
- Description
- The type of login flow used.
- Possible values are:
-
oauthclientcredential—OAuth Client
Credential
-
oauthcode—OAuth Web Server
-
oauthhybridauthcode—OAuth Web Server for
Hybrid Apps
-
oauthhybridtoken—OAuth User-Agent for
Hybrid Apps
-
oauthpassword—OAuth
Username-Password
-
oauthtoken—OAuth User-Agent
-
oauthtokenidtoken—OAuth User-Agent with
ID Token
-
uipwdrst—UI
Password Reset
-
uiup—UI
Username-Password
|
| LOGIN_TYPE |
- Type
- String
- Description
- The type of login used to access the session.
- Possible values are:
-
7—AppExchange
-
A—Application
-
s—Certificate-based login
-
k—Chatter
Communities External User
-
n—Chatter
Communities External User Third Party SSO
-
r—Employee
Login to Community
-
z—Lightning
Login
-
l—Networks
Portal API Only
-
6—Remote
Access Client
-
i—Remote
Access 2.0
-
I—Other
Apex API
-
R—Partner
Product
-
w—Passwordless Login
-
3—Customer
Service Portal
-
q—Partner
Portal Third-Party SSO
-
9—Partner
Portal
-
5—SAML Idp
Initiated SSO
-
m—SAML
Chatter Communities External User SSO
-
b—SAML
Customer Service Portal SSO
-
c—SAML
Partner Portal SSO
-
h—SAML Site
SSO
-
8—SAML Sfdc
Initiated SSO
-
E—SelfService
-
j—Third
Party SSO
|
| LOGIN_URL |
- Type
- String
- Description
- The URL of the login page.
|
| ORGANIZATION_ID |
- Type
- Id
- Description
- The 15-character ID of the organization.
- For example: 00D000000000123.
|
| REQUEST_ID |
- Type
- String
- Description
- The unique ID of a single
transaction. A transaction can contain one or more
events. Each event in a given transaction has the
same REQUEST_ID.
- For example: 3nWgxWbDKWWDIk0FKfF5DV.
|
| REQUEST_STATUS |
- Type
- String
- Description
- The status of the request for a page view or user
interface action.
- For example:
-
S—Success.
Salesforce handled the request successfully. If an
Apex controller throws an exception, this status
is also returned.
-
F—Failure.
Typically 4xx or 5xx HTTP codes, such as no
permission to view page, page took too long to
render, page is read-only.
-
U—Undefined
-
A—Authorization Error
-
R—Redirect.
Typically a 3xx HTTP code, possibly initiated by
an Apex controller in a Visualforce page.
-
N—Not
Found. 404 error.
This field can have a blank value.
|
| RUN_TIME |
- Type
- Number
- Description
- The amount of time that the request took in
milliseconds.
|
| SESSION_KEY |
- Type
- String
- Description
- The user’s unique session ID. You can use this value to
identify all user events within a session. When a user
logs out and logs in again, a new session is started.
For Login Event Type, this field is usually null because
the event is captured before a session is created.
- Example
- d7DEq/ANa7nNZZVD
|
| SOURCE_IP |
- Type
- IP
- Description
- The IP address of the incoming client request that first reaches Salesforce during a
login. For example, 126.7.4.2. For clients that redirect
through one or more HTTP proxies, this field stores the
IP address of the first proxy to reach Salesforce. To
better identify the origin IP for these cases, check the
FORWARDED_FOR_IP field
instead.
|
| TIMESTAMP |
- Type
- String
- Description
- The access time of Salesforce services in GMT.
- For example: 20130715233322.670.
|
| TIMESTAMP_DERIVED |
- Type
- DateTime
- Description
- The access time of Salesforce services in
ISO8601-compatible format (YYYY-MM-DDTHH:MM:SS.sssZ).
- For example: 2015-07-27T11:32:59.555Z. Time zone is
GMT.
|
| TLS_PROTOCOL |
- Type
- String
- Description
- The TLS protocol used for the login.
- Example
- There are 3 possible values.
|
| URI |
- Type
- String
- Description
- The URI of the page that’s receiving the request.
- For example: /home/home.jsp.
|
| URI_ID_DERIVED |
- Type
- ID
- Description
- The 18-character case insensitive ID of the URI of the
page that’s receiving the request.
|
| USER_ID |
- Type
- Id
- Description
- The 15-character ID of the user who’s using Salesforce
services through the UI or the API.
- For example: 00530000009M943
|
| USER_ID_DERIVED |
- Type
- Id
- Description
- The 18-character case insensitive ID of the user who’s
using Salesforce services through the UI or the API.
-
For example: 00590000000I1SNIA0.
|
| USER_NAME |
- Type
- String
- Description
- The username that’s used for login.
|
| USER_TYPE |
- Type
- String
- Description
- The category of user license.
- Possible values are:
-
CsnOnly—Users whose access to the
application is limited to Chatter. This user type
includes Chatter Free and Chatter moderator
users.
-
CspLitePortal—CSP Lite Portal
license. Users whose access is limited because
they’re organization customers and access the
application through a customer portal or an
Experience Cloud site.
-
CustomerSuccess—Customer Success
license. Users whose access is limited because
they’re organization customers and access the
application through a customer portal.
-
Guest—Users whose access is
limited so that your customers can view and
interact with your site without logging in.
-
PowerCustomerSuccess—Power
Customer Success license. Users whose access is
limited because they’re organization customers and
access the application through a customer portal.
Users with this license type can view and edit
data they directly own or data owned by or shared
with users below them in the customer portal role
hierarchy.
-
PowerPartner—Power Partner
license. Users whose access is limited because
they’re partners and typically access the
application through a partner portal or site.
-
SelfService—Users whose access is
limited because they’re organization customers and
access the application through a self-service
portal.
-
Standard—Standard user license.
This user type also includes Salesforce Platform
and Salesforce Platform One user licenses, and
admins for this org.
|
j