Login Event Type

Login events contain details about your org’s user login history.

The Login event type is used by EventLogFile (ELF). It isn’t a real-time event. For the LoginEvent real-time event, which is part of Real-Time Event Monitoring (RTEM), see LoginEvent in the Platform Events Developer Guide.

For details about event monitoring, see the Trailhead Event Monitoring module or the REST API Developer Guide.

  • Type: String

  • Description: The type of API request.

  • Possible values:

    • D - Apex Class
    • E - SOAP Enterprise
    • M - SOAP Metadata
    • P - SOAP Partner
    • S - SOAP Apex
    • T - SOAP Tooling
    • f - Feed
    • l - Live Agent
    • p - SOAP ClientSync
  • Type: String
  • Description: The version of the API that’s being used.
  • Example: 36.0

  • Type: String

  • Description: If provided by a third-party identity provider, the authentication method indicated in the Authentication Context Class Reference (ACR) claim.

    • SAML providers—Stores the value of the AuthnContextClassRef statement in the SAML response.
    • OpenID Connect providers—Stores the value of the ACR claim in the ID token

    This field is available in API version 66.0 and later.

  • Type: String

  • Description: If provided by a third-party identity provider, the authentication method indicated in the Authentication Method Reference (AMR) claim.

    • SAML providers—Stores the value of any attribute named AMR or authmethodsreferences in the SAML response.
    • OpenID Connect providers—Stores the value of the AMR claim in the ID token.

    This field is available in API version 51.0 and later.

  • Type: Id

  • Description: The 15-character ID for the authentication service used to log in. This field stores IDs for these authentication services.

    • SAML single sign-on providers
    • Token exchange handlers

    Available in API version 60.0 and later.

  • Type: String

  • Description: The identifier string returned by the browser used at login.

  • Examples:

    • Go-http-client/1.1
    • Mozilla/5.0 (Macintosh; Intel Mac OS X 10.12; rv%3A50.0) Gecko/20100101 Firefox/50.0
    • Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/51.0.2704.84 Safari/537.36
  • Type: String
  • Description: The TLS cipher suite used for the login. Values are OpenSSL-style cipher suite names, with hyphen delimiters. For more information, see OpenSSL Cryptography and SSL/TLS Toolkit.
  • Type: String
  • Description: The IP address of the client that’s using Salesforce services. A Salesforce internal IP (such as a login from AppExchange) is shown as “Salesforce.com IP”.
  • Example: 96.43.144.26
  • Type: String
  • Description: The country code associated with the IP address of the user logging in.
  • Type: Number
  • Description: The CPU time in milliseconds used to complete the request. This field indicates the amount of activity taking place in the app server layer.
  • Type: Number
  • Description: The time in nanoseconds for a database round trip. Includes time spent in the JDBC driver, network to the database, and DB_CPU_TIME. Compare this field to CPU_TIME to determine whether performance issues are occurring in the database layer or in your own code.
  • Type: String
  • Description: The type of event. The value is always Login.

  • Type: String

  • Description: The value in the X-Forwarded-For header of HTTP requests sent by the client. For logins that use one or more HTTP proxies, the X-Forwarded-For header is sometimes used to store the origin IP and all proxy IPs.

    The FORWARDED_FOR_IP field stores whatever value the client sends, which might not be an IP address. The maximum length is 256 characters. Longer values are truncated. The FORWARDED_FOR_IP field isn’t populated for logins completed via OAuth flows or single sign-on (SSO).

    Available in API version 61.0 and later.

  • Type: String
  • Description: The referring URI of the page that’s receiving the request.
  • Type: String
  • Description: The string that ties together all events in a given user’s login session. It starts with a login event and ends with either a logout event or the user session expiring.
  • Example: GeJCsym5eyvtEK2I
  • Type: String
  • Description: The status of the login attempt. For successful logins, the value is LOGIN_NO_ERROR. All other values indicate errors or authentication issues. For details, see LOGIN_STATUS Values.
  • Type: picklist
  • Properties: Nillable, Restricted picklist
  • Description: The type of login flow used. See the LoginSubType field of LoginHistory in the Object Reference guide for the list of possible values.
  • Label: Login Subtype

  • Type: String

  • Description: The type of login used to access the session.

  • Possible values:

    • 7 - AppExchange
    • A - Application
    • s - Certificate-based login
    • k - Chatter Communities External User
    • n - Chatter Communities External User Third Party SSO
    • x - Cross Tenant Login (for internal use only)
    • r - Employee Login to Community
    • z - Lightning Login
    • l - Networks Portal API Only
    • 6 - Remote Access Client
    • i - Remote Access 2.0
    • I - Other Apex API
    • R - Partner Product
    • w - Passwordless Login
    • 3 - Customer Service Portal
    • q - Partner Portal Third-Party SSO
    • 9 - Partner Portal
    • 5 - SAML Idp Initiated SSO
    • m - SAML Chatter Communities External User SSO
    • b - SAML Customer Service Portal SSO
    • c - SAML Partner Portal SSO
    • h - SAML Site SSO
    • 8 - SAML Sfdc Initiated SSO
    • E - SelfService
    • j - Third Party SSO
  • Type: String
  • Description: The URL of the login page.
  • Type: Id
  • Description: The 15-character ID of the organization.
  • Example: 00D000000000123
  • Type: String
  • Description: The unique ID of a single transaction. A transaction can contain one or more events. Each event in a given transaction has the same REQUEST_ID.
  • Example: 3nWgxWbDKWWDIk0FKfF5DV

  • Type: String

  • Description: The status of the request for a page view or user interface action.

  • Possible values:

    • S - Success. Salesforce handled the request successfully. If an Apex controller throws an exception, this status is also returned.
    • F - Failure. Typically 4xx or 5xx HTTP codes, such as no permission to view page, page took too long to render, page is read-only.
    • U - Undefined
    • A - Authorization Error
    • R - Redirect. Typically a 3xx HTTP code, possibly initiated by an Apex controller in a Visualforce page.
    • N - Not Found. 404 error.

    This field can have a blank value.

  • Type: Number
  • Description: The amount of time that the request took in milliseconds.
  • Type: String
  • Description: The user’s unique session ID. You can use this value to identify all user events within a session. When a user logs out and logs in again, a new session is started. For Login Event Type, this field is usually null because the event is captured before a session is created.
  • Example: d7DEq/ANa7nNZZVD
  • Type: IP
  • Description: The IP address of the incoming client request that first reaches Salesforce during a login. For example, 126.7.4.2. For clients that redirect through one or more HTTP proxies, this field stores the IP address of the first proxy to reach Salesforce. To better identify the origin IP for these cases, check the FORWARDED_FOR_IP field instead.
  • Type: String
  • Description: The access time of Salesforce services in GMT.
  • Example: 20130715233322.670
  • Type: DateTime
  • Description: The access time of Salesforce services in ISO8601-compatible format (YYYY-MM-DDTHH:MM:SS.sssZ).
  • Example: 2015-07-27T11:32:59.555Z. Time zone is GMT

  • Type: String

  • Description: The TLS protocol used for the login.

  • Example: There are 3 possible values.

    • 1.0
    • 1.1
    • 1.2
  • Type: String
  • Description: The URI of the page that’s receiving the request.
  • Example: /home/home.jsp
  • Type: ID
  • Description: The 18-character case-insensitive ID of the URI of the page that’s receiving the request.
  • Type: String
  • Description: Login with API Token - T token, or P password.
  • Type: Id
  • Description: The 15-character ID of the user who’s using Salesforce services through the UI or the API.
  • Example: 00530000009M943
  • Type: Id
  • Description: The 18-character case-insensitive ID of the user who’s using Salesforce services through the UI or the API.
  • Example: 00590000000I1SNIA0
  • Type: String
  • Description: The username that’s used for login.

  • Type: String

  • Description: The category of user license.

  • Possible values:

    • CsnOnly - Users whose access to the application is limited to Chatter. This user type includes Chatter Free and Chatter moderator users.
    • CspLitePortal - CSP Lite Portal license. Users whose access is limited because they’re organization customers and access the application through a customer portal or an Experience Cloud site.
    • CustomerSuccess - Customer Success license. Users whose access is limited because they’re organization customers and access the application through a customer portal.
    • Guest - Users whose access is limited so that your customers can view and interact with your site without logging in.
    • PowerCustomerSuccess - Power Customer Success license. Users whose access is limited because they’re organization customers and access the application through a customer portal. Users with this license type can view and edit data they directly own or data owned by or shared with users below them in the customer portal role hierarchy.
    • PowerPartner - Power Partner license. Users whose access is limited because they’re partners and typically access the application through a partner portal or site.
    • SelfService - Users whose access is limited because they’re organization customers and access the application through a self-service portal.
    • Standard - Standard user license. This user type also includes Salesforce Platform and Salesforce Platform One user licenses, and admins for this org.