Insufficient Access Event Type

Insufficient Access events contain details about errors relating to insufficient account, case, contact, and opportunity record access, so that you can troubleshoot and resolve access issues for your users.

The Insufficient Access event type is disabled by default. You can enable this event type for a period of 24 hours by contacting Salesforce Customer Support.

Note

These insufficient access error scenarios are logged:

The user can’t share a case, contact, or opportunity because the user doesn’t have permission to share the parent account or the recipient of the share doesn’t currently have read access to the parent account.
The user can’t change ownership of a case, contact, or opportunity because the user doesn’t have permission to share the parent account or the new owner doesn’t currently have read access to the parent account.
The user can’t change the parent account of a case, contact, or opportunity because the user doesn’t have permission to share the new parent account or the owner of the case, contact, or opportunity doesn’t have read access to the new parent account.

Insufficient access errors resulting from bulk operations involving two or more records aren’t logged.

For details about event monitoring, see the Trailhead Event Monitoring module or REST API Developer’s Guide.

For more information on interpreting Insufficient Access events, see this knowledge article.

Fields

Field	Details
ACCESS_ERROR	Type String Description The type of insufficient access error that the user received. Valid values are: `DATA_NOT_AVAILABLE`—The record is no longer accessible. For example, a record was deleted and moved to the Recycle Bin. `INVALID_TYPE`—The record type doesn’t exist. `NO_ACCESS`—The user doesn’t have the required access level to complete the attempted action on the record. Example `NO_ACCESS`
ACTUAL_LOGGED_IN_USER_ID	Type Id Description The 15-character ID of the user who initiated the action that caused the insufficient access error. For example, a user attempts to transfer ownership of a record to a teammate, but the operation fails because the teammate doesn’t have the required access. In this scenario, the ACTUAL_LOGGED_IN_USER_ID is the user who attempted to transfer access, and the USER_ID is their teammate. Example `005XXXXXXXXXXXX`
ENTITY_TYPE	Type String Description The object for which the user received the insufficient access error. Access errors for the account, case, contact, and opportunity objects are supported. Example Account
ERROR_DESCRIPTION	Type String Description Description of the insufficient access error that the user received. Example User 005XXXXXXXXXXXX doesn't have full access for the record 001XXXXXXXXXXXX.
ERROR_TIMESTAMP	Type String Description The time in GMT that the insufficient access error occurred. Example `20130715233322.670`
EVENT_TYPE	Type String Description The type of event. The value is always `InsufficientAccess`.
ORGANIZATION_ID	Type Id Description The 15-character ID of the organization. Example `00DXXXXXXXXXXXX`
RECORD_ID	Type String Description The ID of the record that the user doesn’t have access to. Example `001XXXXXXXXXXXX`
REQUEST_ID	Type String Description The unique ID of a single transaction. A transaction can contain one or more events. Each event in a given transaction has the same REQUEST_ID. Example `3nWgxWbDKWWDIk0FKfF5DV`
REQUESTED_ACCESS_LEVEL	Type String Description The access level required by the user’s attempted action on the record. Valid values are: `DELETE` `FULL` `READ` `TRANSFER` `WRITE` Example `FULL`
TIMESTAMP	Type String Description The access time of Salesforce services in GMT. Example `20130715233322.670`
TIMESTAMP_DERIVED	Type DateTime Description The access time of Salesforce services in ISO8601-compatible format (`YYYY-MM-DDTHH:MM:SS.sssZ`). Example `2015-07-27T11:32:59.555Z`
USER_ID	Type Id Description The 15-character ID of the user for whom the insufficient access error occurred, either when the user couldn’t access a record, the user couldn’t complete an operation, or the user was the intended recipient of a record transfer that failed because the user didn’t have the required access. Example `005XXXXXXXXXXXX`
USER_ID_DERIVED	Type Id Description The 18-character case-insensitive ID of the user for whom the insufficient access error occurred, either when the user couldn’t access a record or the user was the intended recipient of a record transfer that wasn’t completed. Example `005XXXXXXXXXXXXIA0`

Object Reference for the Salesforce Platform

Insufficient Access Event Type

Fields

See Also