LoginEventStream

• SOAP Enterprise
• SOAP Partner
• REST API

• AppExchange
• Browser
• Salesforce for iOS
• Salesforce Developers API Explorer
• N/A

• Chrome
• Firefox
• Safari
• Unknown

Available in API version 61.0 and later.

Label is Login Subtype.

• Block—The user was blocked from performing the operation that triggered the policy.
• Error—The policy caused an undefined error when it executed.
• ExemptNoAction—The user is exempt from transaction security policies, so the policy didn’t trigger.
• FailedInvalidPassword—The user entered an invalid password.
• FailedPasswordLockout—The user entered an invalid password too many times.
• MeteringBlock—The policy took longer than 3 seconds to process, so the user was blocked from performing the operation.
• MeteringNoAction—The policy took longer than 3 seconds to process, but the user isn't blocked from performing the operation.
• NoAction—The policy didn't trigger.
• Notified—A notification was sent to the recipient.
• TwoFAAutomatedSuccess—Salesforce Authenticator approved the request for access because the request came from a trusted location. After users enable location services in Salesforce Authenticator, they can designate trusted locations. When a user trusts a location for a particular activity, that activity is approved from the trusted location for as long as the location is trusted. An example of a particular activity is logging in from a recognized device.
• TwoFADenied—The user denied the approval request in the authenticator app, such as Salesforce Authenticator.
• TwoFAFailedGeneralError—An error caused by something other than an invalid verification code, too many verification attempts, or authenticator app connectivity.
• TwoFAFailedInvalidCode—The user provided an invalid verification code.
• TwoFAFailedTooManyAttempts—The user attempted to verify identity too many times. For example, the user entered an invalid verification code repeatedly.
• TwoFAInitiated—Salesforce initiated identity verification but hasn’t yet challenged the user.
• TwoFAInProgress—Salesforce challenged the user to verify identity and is waiting for the user to respond or for Salesforce Authenticator to send an automated response.
• TwoFANoAction—The policy specifies multi-factor authentication (formerly called two-factor authentication) as an action, but the user is already in a high-assurance session.
• TwoFARecoverableError—Salesforce can’t reach the authenticator app to verify identity, but will retry.
• TwoFAReportedDenied—The user denied the approval request in the authenticator app, such as Salesforce Authenticator, and also flagged the approval request to report to an administrator.
• TwoFASucceeded—The user’s identity was verified.

This field is populated only when the activity that this event monitors requires extra authentication, such as multi-factor authentication. In this case, Salesforce generates more events and sets the RelatedEventIdentifier field of the new events to the value of the EventIdentifier field of the original event. Use this field with the EventIdentifier field to correlate all the related events. If no extra authentication is required, this field is blank.

• HIGH_ASSURANCE—A high assurance session was used for resource access. For example, when the user tries to access a resource such as a connected app, report, or dashboard that requires a high-assurance session level.
• LOW—The user’s security level for the current session meets the lowest requirements.

  This low level isn’t available, nor used, in the Salesforce UI. User sessions through the UI are either standard or high assurance. You can set this level using the API, but users assigned this level experience unpredictable and reduced functionality in their Salesforce org.

  Note

• STANDARD—The user’s security level for the current session meets the Standard requirements set in the org’s Session Security Levels.

• TLS 1.0
• TLS 1.1
• TLS 1.2
• TLS 1.3
• Unknown

• CsnOnly—Users whose access to the application is limited to Chatter. This user type includes Chatter Free and Chatter moderator users.
• CspLitePortal—CSP Lite Portal license. Users whose access is limited because they’re organization customers and access the application through a customer portal or an Experience Cloud site.
• CustomerSuccess—Customer Success license. Users whose access is limited because they’re organization customers and access the application through a customer portal.
• Guest
• PowerCustomerSuccess—Power Customer Success license. Users whose access is limited because they’re organization customers and access the application through a customer portal. Users with this license type can view and edit data they directly own or data owned by or shared with users below them in the customer portal role hierarchy.
• PowerPartner—Power Partner license. Users whose access is limited because they’re partners and typically access the application through a partner portal or site.
• SelfService
• Standard—Standard user license. This user type also includes Salesforce Platform and Salesforce Platform One user licenses.