Named Credential Event Type

The Named Credential event type captures information about Apex callouts that use named credentials as their endpoints. Use this event type to audit the installed managed packages that use named credentials. If you don’t recognize the package namespace in the named credential event log file, then you can investigate whether a security breach has occurred. This event type is available in the EventLogFile object in API version 53.0 and later.

For details about event monitoring, see the Trailhead Event Monitoring module or REST API Developer’s Guide.

Fields

Field Details
CALLER_PACKAGE_NAMESPACE
Type
String
Description
If an Apex callout using a Named Credential endpoint is initiated from a package, then this field contains the package’s namespace. If the callout isn’t initiated from a package, then this field is empty.
Example
Acme
CLIENT_IP
Type
String
Description
The IP address of the client that’s using Salesforce services. A Salesforce internal IP (such as a login from AppExchange) is shown as “Salesforce.com IP”.
For example: 96.43.144.26.
CPU_TIME
Type
Number
Description
The CPU time in milliseconds used to complete the request. This field indicates the amount of activity taking place in the app server layer.
EVENT_TYPE
Type
String
Description
The type of event. The value is always NamedCredential.
LOGIN_KEY
Type
String
Description
The string that ties together all events in a given user’s login session. It starts with a login event and ends with either a logout event or the user session expiring.
For example: GeJCsym5eyvtEK2I.
NAMED_CREDENTIAL_NAME
Type
String
Description
The name of the named credential that’s the endpoint of the Apex callout.
Example
My_Named_Credential
ORGANIZATION_ID
Type
Id
Description
The 15-character ID of the org.
Example
00D000000000123
REQUEST_ID
Type
String
Description
The unique ID of a single transaction. A transaction can contain one or more events. Each event in a given transaction has the same REQUEST_ID.
For example: 3nWgxWbDKWWDIk0FKfF5DV.
RUN_TIME
Type
Number
Description
The amount of time that the request took in milliseconds.
SESSION_KEY
Type
String
Description
The user’s unique session ID. You can use this value to identify all user events within a session. When a user logs out and logs in again, a new session is started.
For example: d7DEq/ANa7nNZZVD.
TIMESTAMP
Type
String
Description
The access time of Salesforce services in GMT.
For example: 20130715233322.670.
TIMESTAMP_DERIVED
Type
DateTime
Description
The access time of Salesforce services in ISO8601-compatible format (YYYY-MM-DDTHH:MM:SS.sssZ).
For example: 2015-07-27T11:32:59.555Z. Timezone is GMT.
URI
Type
String
Description
The URI of the page that’s receiving the request.
For example: /home/home.jsp.
URI_ID_DERIVED
Type
ID
Description
The 18-character case-safe ID of the URI of the page that’s receiving the request.
USER_ID
Type
Id
Description
The 15-character ID of the user who’s using Salesforce services through the UI or the API.
For example: 00530000009M943
USER_ID_DERIVED
Type
Id
Description
The 18-character case-safe ID of the user who’s using Salesforce services through the UI or the API.
For example: 00590000000I1SNIA0.