Logout Event Type

Contains details of user sessions ending or being revoked.

Logout Event Type is used by EventLogFile (ELF). It isn’t a real-time event. For the LogoutEvent real-time event, which is part of Real-Time Event Monitoring (RTEM), see LogoutEvent in the Platform Events Developer Guide.

These scenarios count as logout events.

  • Logging out via the UI
  • Session expiration
  • Revoking access for a connected app
  • Calling the Salesforce revocation endpoint
  • Salesforce disabling a connected app
  • For batch operations where multiple sessions are revoked at once, Salesforce records only one logout event. You can tell that it’s a batch operation because there’s no user ID.

For details about event monitoring, see the Trailhead Event Monitoring module or REST API Developer’s Guide.

  • Type: String

  • Description: The type of API request.

  • Possible values:

    • D - Apex Class
    • E - SOAP Enterprise
    • M - SOAP Metadata
    • P - SOAP Partner
    • S - SOAP Apex
    • T - SOAP Tooling
    • f - Feed
    • l - Live Agent
    • p - SOAP ClientSync
  • Type: String
  • Description: The version of the API that’s being used.
  • Example: 36.0

  • Type: Number

  • Description: The application type that was in use upon logging out.

  • Example Values:

    • 1000 : Application
    • 1007 : SFDC Application
    • 1014 : Chat
    • 2501 : CTI
    • 2514 : OAuth
    • 3475 : SFDC Partner Portal

  • Type: String

  • Description: The identifier string returned by the browser used at login.

  • Example Values:

    • Go-http-client/1.1
    • Mozilla/5.0 (Macintosh; Intel Mac OS X 10.12; rv%3A50.0) Gecko/20100101 Firefox/50.0
    • Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/51.0.2704.84 Safari/537.36
  • Type: String
  • Description: The IP address of the client that’s using Salesforce services. A Salesforce internal IP (such as a login from AppExchange) is shown as “Salesforce.com IP”.
  • Example: 96.43.144.26
  • Type: Number
  • Description: The version of the client that was in use upon logging out.
  • Type: String
  • Description: The type of event. The value is always Logout.
  • Type: String
  • Description: The string that ties together all events in a given user’s login session. It starts with a login event and ends with either a logout event or the user session expiring.
  • Example: GeJCsym5eyvtEK2I
  • Type: Id
  • Description: The 15-character ID of the organization.
  • Example: 00D000000000123

  • Type: Number

  • Description: The code for the client platform. If a timeout caused the logout, this field is null.

  • Example Values:

    • 1000 : Windows
    • 1008 : Windows 2003
    • 1013 : Windows 8.1
    • 1015 : Windows 10
    • 2003 : Macintosh/Apple OSX
    • 4000 : Linux
    • 5005 : Android
    • 5006 : iPhone
    • 5007 : iPad
    • 5200 : Android 10.0
  • Type: String
  • Description: The unique ID of a single transaction. A transaction can contain one or more events. Each event in a given transaction has the same REQUEST_ID.
  • Example: 3nWgxWbDKWWDIk0FKfF5DV
  • Type: Number
  • Description: The screen resolution of the client. If a timeout caused the logout, this field is null.
  • Type: String
  • Description: The user’s unique session ID. You can use this value to identify all user events within a session. When a user logs out and logs in again, a new session is started.
  • Example: d7DEq/ANa7nNZZVD

  • Type: String

  • Description: The security level of the session that was used when logging out.

  • Possible values:

    • 1- Standard Session
    • 10 - High-Assurance Session

  • Type: String

  • Description: The session type that was used when logging out.

  • Possible values:

    • A - API
    • I - APIOnlyUser
    • N - ChatterNetworks
    • Z - ChatterNetworksAPIOnly
    • C - Content
    • P - OauthApprovalUI
    • O - Oauth2
    • T - SiteStudio
    • R - SitePreview
    • S - SubstituteUser
    • B - TempContentExchange
    • G - TempOauthAccessTokenFrontdoor
    • Y - TempVisualforceExchange
    • F - TempUIFrontdoor
    • U - UI
    • E - UserSite
    • V - Visualforce
    • W - WDC_API
  • Type: String
  • Description: The access time of Salesforce services in GMT.
  • Example: 20130715233322.670 When a customer logs out by using the Logout button, the TIMESTAMP field records the actual logout time. However, when a customer is logged out automatically, Salesforce detects the event by using a process that runs every 15 minutes. TIMESTAMP values can reflect a logout time up to 15 minutes later than the actual automatic logout time.
  • Type: DateTime
  • Description: The access time of Salesforce services in ISO8601-compatible format (YYYY-MM-DDTHH:MM:SS.sssZ). The timezone is GMT.
  • Example: 2015-07-27T11:32:59.555Z
  • Type: Id
  • Description: The 15-character ID of the user who’s using Salesforce services through the UI or the API.
  • Example: 00530000009M943
  • Type: Id
  • Description: The 18-character case-insensitive ID of the user who’s using Salesforce services through the UI or the API.
  • Example: 00590000000I1SNIA0
  • Type: Boolean
  • Description: The value is 1 if the user intentionally logged out of the organization by clicking the Logout button. If the user’s session timed out due to inactivity or another implicit logout action, the value is 0.

  • Type: String

  • Description: The category of user license of the user that logged out.

  • Possible values:

    • A - Automated Process
    • b - High Volume Portal
    • C - Customer Portal User
    • D - External Who
    • F - Self-Service
    • G - Guest
    • L - Package License Manager
    • N - Salesforce to Salesforce
    • n - CSN Only
    • O - Power Custom
    • o - Custom
    • P - Partner
    • p - Customer Portal Manager
    • S - Standard
    • X - Salesforce Administrator