LoginHistory

Represents the login history for all successful and failed login attempts for organizations and enabled portals.

Introduced in API version 21.0.

describeSObjects(), query(), retrieve(), delete()

  • With one exception, only users with Manage Users or Monitor Login History permissions can access this object. The exception is that, in API version 37.0 and later, all users can retrieve their own login history records.
  • Type: string
  • Properties: Group, Nillable, Sort
  • Description: Indicates the API type, for example Soap Enterprise. Label is API Type.
  • Type: string
  • Properties: Group, Nillable, Sort
  • Description: Displays the API version used by the client. Label is API Version.
  • Type: string
  • Properties: Group, Nillable, Sort
  • Description: The application used to access the organization. Label is Application.

  • Type: string

  • Properties: Filter, Nillable, Sort

  • Introduced: API version 67.0

  • Description:

    If provided by a third-party identity provider, the authentication method indicated in the Authentication Context Class Reference (ACR) claim.

    • SAML providers—stores the value of the AuthnContextClassRef statement in the SAML response.
    • OpenID Connect providers—stores the value of the ACR claim in the ID token

    This field is available in API version 67.0 and later.

  • Type: string
  • Properties: Filter, Group, Nillable, Sort
  • Introduced: API version 51.0
  • Description: The authentication method used by a third-party identification provider for an OpenID Connect single sign-on protocol. Label is Authentication Method Reference.

  • Type: reference

  • Properties: Filter, Group, Nillable, Sort

  • Introduced: API version 34.0

  • Description:

    The 18-character ID for an authentication service for a login event. For example, you can use this field to identify the SAML or authentication provider configuration with which the user logged in. Label is Authentication Service Id.

    This field is a polymorphic relationship field.

  • Relationship name: AuthenticationService

  • Relationship type: polymorphic

  • Refers to: AuthProvider, SamlSsoConfig

  • Type: string
  • Properties: Group, Nillable, Sort
  • Description: The current browser version. Label is Browser.
  • Type: picklist
  • Properties: Filter, Group, Nillable, Restricted picklist, Sort
  • Introduced: API version 37.0
  • Description: The TLS cipher suite used for the login. Values are OpenSSL-style cipher suite names, with hyphen delimiters. For more information, see OpenSSL Cryptography and SSL/TLS Toolkit.
  • Type: string
  • Properties: Group, Nillable, Sort
  • Description: Version of the API client. Label is Client Version.
  • Type: string
  • Properties: Filter, Group, Nillable, Sort
  • Introduced: API version 37.0
  • Description: The ISO 3166 code for the country where the user’s IP address is physically located. For more information, see Country Codes - ISO 3166.

  • Type: string

  • Properties: Filter, Group, Nillable, Sort

  • Introduced: API version 60.0

  • Description:

    The value in the X-Forwarded-For header of HTTP requests sent by the client. For logins that use one or more HTTP proxies, the X-Forwarded-For header is sometimes used to store the origin IP and all proxy IPs.

    The ForwardedForIp field stores whatever value the client sends, which might not be an IP address. The maximum length is 256 characters. Longer values are truncated. The ForwardedForIp field isn’t populated for logins completed via OAuth flows or single sign-on (SSO).

  • Type: reference

  • Properties: Filter, Group, Nillable, Sort

  • Introduced: API version 34.0

  • Description:

    The 18-character ID for the record of the geographic location of the user for a successful or unsuccessful login event. The accuracy of geolocation fields like country, city, or postal code can vary because of the nature of the technology.

    The Manage Users permission is required for accessing this field.

    This field is a relationship field.

  • Relationship name: LoginGeo

  • Relationship type: relationship

  • Refers to: LoginGeo

  • Type: picklist

  • Properties: Filter, Group, Nillable, Restricted picklist, Sort

  • Introduced: API version 57.0

  • Description:

    The type of login flow used.

    Label is Login Subtype.

  • Possible values:

    • InternalSalesforceAuthentication — InternalSalesforceAuthentication — Internal Salesforce AuthenticationThis subtype is for internal use only.
    • OauthClientCredentials — OauthClientCredentials — OAuth Client Credentials
    • OAuthDevice — OAuthDevice — OAuth Device
    • OauthHybridRefreshToken — OauthHybridRefreshToken — OAuth Refresh Token for Hybrid Apps
    • OauthHybridTokenExchange — OauthHybridTokenExchange — OAuth Token Exchange for Hybrid Apps
    • OauthHybridUserAgent — OauthHybridUserAgent — OAuth User-Agent for Hybrid Apps
    • OauthHybridWebServer — OauthHybridWebServer — OAuth Web Server for Hybrid Apps
    • OauthOtpLogin — OauthOtpLogin — OAuth OTP Login
    • OauthRefreshToken — OauthRefreshToken — OAuth Refresh Token
    • OauthTokenExchange — OauthTokenExchange — OAuth Token Exchange
    • OauthUserAgent — OauthUserAgent — OAuth User-Agent
    • OauthUserAgentIdToken — OauthUserAgentIdToken — OAuth User-Agent with ID Token
    • OauthUsernamePassword — OauthUsernamePassword — OAuth Username-Password
    • OauthWebServer — OauthWebServer — OAuth Web Server
    • SoapApiLogin — SoapApiLogin — SOAP APIThis subtype is for internal use only.
    • SoapApiLoginMobile — SoapApiLoginMobile — SOAP API (Mobile)This subtype is for internal use only.
    • SoapApiLoginNetworksPortal — SoapApiLoginNetworksPortal — SOAP API (Networks Portal)This subtype is for internal use only.
    • SoapApiLoginPortal — SoapApiLoginPortal — SOAP API (Portal)This subtype is for internal use only.
    • SoapApiLoginSelfService — SoapApiLoginSelfService — SOAP API (Self-Service)This subtype is for internal use only.
    • UiPasswordReset — UiPasswordReset — UI Password Reset
    • UsernamePasswordUiLogin — UsernamePasswordUiLogin — UI Username-Password
  • Type: datetime
  • Properties: Filter, Sort
  • Description: Time zone is based on GMT. Label is Login Time.

  • Type: picklist

  • Properties: Filter, Group, Restricted picklist, Sort

  • Description:

    The type of login used to access the session.

    Label is Login Type.

  • Possible values:

    • AppExchange — AppExchange — AppExchange
    • Application — Application — Application
    • Certificate — Certificate — Certificate-based login
    • ChatterCommunityPortalUnPwd — ChatterCommunityPortalUnPwd — Chatter Communities External User
    • ChatterCommunityThirdPartySso — ChatterCommunityThirdPartySso — Chatter Communities External User Third Party SSO
    • CrossTenantLogin — CrossTenantLogin — For internal use only.
    • EmployeeLoginToCommunity — EmployeeLoginToCommunity — Employee Login to Community
    • HelpAndTraining — HelpAndTraining — Help And Training
    • IeOfflineClient — IeOfflineClient — Offline Client
    • LightningLogin — LightningLogin — Lightning Login
    • NetworksPortalApiOnly — NetworksPortalApiOnly — Networks Portal API Only
    • Oauth, Remote Access Client — Oauth, Remote Access Client — Remote Access Client
    • Oauth2, Remote Access 2.0 — Oauth2, Remote Access 2.0 — Remote Access 2.0
    • OtherApi — OtherApi — Other Apex API
    • Partner — Partner — Partner Product
    • PasswordlessLogin — PasswordlessLogin — Passwordless Login
    • PasswordlessPasskeyLogin — PasswordlessPasskeyLogin — Passwordless Login via Passkeys (beta)Passwordless login with passkeys is a pilot or beta service that is subject to the Beta Services Terms at Agreements - Salesforce.com or a written Unified Pilot Agreement if executed by Customer, and applicable terms in the Product Terms Directory. Use of this pilot or beta service is at the Customer’s sole discretion.
    • Portal — Portal — Customer Service Portal
    • PortalThirdPartySso — PortalThirdPartySso — Customer Service Portal Third-Party SSO
    • PrmPortalThirdPartySso — PrmPortalThirdPartySso — Partner Portal Third-Party SSO
    • PrmPortal — PrmPortal — Partner Portal
    • Saml — Saml — SAML Idp Initiated SSO
    • SamlChatterNetworks — SamlChatterNetworks — SAML Chatter Communities External User SSO
    • SamlCspPortal — SamlCspPortal — SAML Customer Service Portal SSO
    • SamlPrmPortal — SamlPrmPortal — SAML Partner Portal SSO
    • SamlSite — SamlSite — SAML Site SSO
    • Saml2 — Saml2 — SAML Sfdc Initiated SSO
    • SelfService — SelfService — SelfService
    • ThirdPartySso — ThirdPartySso — Third Party SSO
  • Type: string
  • Properties: Filter, Group, Nillable, Sort
  • Description: URL from which the login request is coming. Label is Login URL.
  • Type: reference
  • Properties: Filter, Group, Nillable, Sort
  • Introduced: API version 31.0
  • Description: The ID of the Experience Cloud site that the user is logging in to. This field is available in API version 31.0 and later, if Salesforce Experience Cloud sites are enabled for your org.
  • Relationship name: Network
  • Relationship type: relationship
  • Refers to: Network
  • Type: boolean
  • Properties: Filter
  • Description: The HTTP method used for the session login is a GET request.
  • Type: boolean
  • Properties: Filter
  • Description: The HTTP method used for the session login is a POST request.
  • Type: boolean
  • Type: string
  • Properties: Group, Nillable, Sort
  • Description: Operating system on the login machine. Label is Platform.
  • Type: string
  • Properties: Filter, Group, Nillable, Sort
  • Introduced: API version 43.0

  • Type: string

  • Properties: Filter, Group, Nillable, Sort

  • Description:

    The IP address of the incoming client request that first reaches Salesforce during a login. For example, 126.7.4.2.

    For clients that redirect through one or more HTTP proxies, this field stores the IP address of the first proxy to reach Salesforce. To better identify the origin IP for these cases, check the ForwardedForIp field instead.

    The SourceIp field doesn’t support the LIKE comparison operator.

  • Type: string
  • Properties: Group, Nillable, Sort
  • Description: Displays the status of the attempted login. Status is either success or a reason for failure. Label is Status.
  • Type: picklist
  • Properties: Filter, Group, Nillable, Restricted picklist, Sort
  • Introduced: API version 37.0
  • Description: The TLS protocol used for the login.This field is available in API version 37.0 and later.
  • Possible values:
    • TLS 1.0 — TLS 1.0
    • TLS 1.1 — TLS 1.1
    • TLS 1.2 — TLS 1.2
    • TLS 1.3 — TLS 1.3
    • Unknown — Unknown
  • Type: reference
  • Properties: Filter, Group, Nillable, Sort
  • Description: ID of the user logging in. Label is User ID.
  • Relationship name: User
  • Relationship type: polymorphic
  • Refers to: SelfServiceUser, User

Not all fields are filterable. You can only filter on the following fields:

  • AuthenticationServiceId
  • CipherSuite
  • CountryIso
  • Id
  • LoginTime
  • LoginType
  • LoginUrl
  • NetworkId
  • OptionsIsGet
  • OptionsIsPost
  • TlsProtocol
  • UserId

The API allows you to do many powerful queries. A few examples are:

Sample QueryQuery String
Simple query showing UserId & LoginTime for each userSELECT UserId, LoginTime from LoginHistory;
Query showing logins only after a specified date and timeSELECT UserId, LoginTime from LoginHistory WHERE LoginTime > 2010-09-20T22:16:30.000Z;
Query showing logins for a specific time intervalSELECT UserId, LoginTime from LoginHistory WHERE LoginTime > 2010-09-20T22:16:30.000Z AND LoginTime < 2010-09-21T22:16:30.000Z;
Query showing the authentication service for a SAML login event, where Id=AuthenticationServiceId from LoginHistorySELECT DeveloperName, Issuer, Version FROM SamlSsoConfig WHERE Id = '0LE###############'
Query showing the authentication service for an authentication provider login event, where Id=AuthenticationServiceId from LoginHistorySELECT Type, DeveloperName FROM AuthProvider WHERE Id = '0SO###############'