LoginAsEventStream
LoginAsEvent tracks when an admin logs in as another user in your org. In Real-Time Event Monitoring, it captures events for org admins and Experience Cloud site only. This object is available in API version 46.0 and later.
describeSObjects()
| Subscriber | Supported? |
|---|---|
| Apex Triggers | |
| Flows | |
| Processes | |
| Pub/Sub API |  |
| Streaming API (CometD) | |
/event/LoginAsEventStream
Accessing this object requires either the Salesforce Shield or Salesforce Event Monitoring add-on subscription and the View Real-Time Event Monitoring Data user permission.
No
A Transaction Security policy for the LoginAs event type only monitors and responds to actions where a Salesforce administrator logs in as an internal, standard user. It does not support monitoring LoginAs actions that originate from an Experience Cloud site.
Type: string
Properties: Nillable
Description: The application name in English. For example, Salesforce Internal Application, or Microsoft SOAP Toolkit.
Type: string
Properties: Nillable
Description: The browser name and version if known. Possible values for the browser name are:Values are Chrome, Firefox, Safari, or Unknown. For example, “Chrome 77”.
Type: string
Properties: Nillable
Description: Organization Id of the user who is logging in as another user. For example, 00Dxx0000001gEH
Type: string
Properties: Nillable
Description: Username of the admin who is logging in as another user. For example, admin@company.com
Type: double
Properties: Nillable
Description: The amount of time it took to evaluate the transaction security policy, in milliseconds. This field isn’t populated until all transaction security policies are processed for the real-time event.
Type: dateTime
Properties: Filter, Sort
Description: The time and date of the event. For example, 2020-01-20T19:12:26.965Z. Milliseconds are the most granular setting.
Type: string
Properties: Filter, Sort
Description: The unique ID of the event, which is shared with the corresponding storage object. For example, 0a4779b0-0da1-4619-a373-0a36991dff90. Use this field to correlate the event with its storage object. Also, use this field as the primary key in your queries.
Type: string
Properties: Nillable
Description: A universally unique identifier (UUID) that identifies a platform event message. This field is available in API version 52.0 and later.
Type: dateTime
Properties: Nillable
Description: Expiration date for the change in login access.
Type: string
Properties: Nillable
Description: Name of the entity affected by the access changes.
Type: string
Properties: Nillable
Description: The type of entity affected by the access changes.
Type: picklist
Properties: Nillable, Restricted picklist
Description: Represents how the user logs in as another user. Possible values are:
- OrgAdmin—An administrator logs in to Salesforce as an individual user. Depending on your org settings, the individual user grants login access to the administrator.
- Community—A user who has been granted access to a Salesforce Experience Cloud site logs in.
Type: reference
Properties: Nillable
Description: Tracks a user session so you can correlate user activity with a particular login instance. The ID from the LoginHistory entity associated with this login event. For example, 0Yaxx0000000019.
Type: string
Properties: Nillable
Description: The string that ties together all events in a given user’s login session. The session starts with a login event and ends with either a logout event or the user session expiring. For example, 8gHOMQu+xvjCmRUt.
Type: picklist
Properties: Nillable, Restricted picklist
Description: The type of login used to access the session. See the LoginType field of LoginHistory in the Object Reference guide for the list of possible values.
Type: string
Properties: Nillable
Description: The platform name and version that are used during the login event. If no platform name is available, “Unknown” is returned. Platform names are in English. For example, “Mac OSX”.
Type: reference
Properties: Nillable
Description: The ID of the transaction security policy associated with this event. For example, 0NIB000000000KOOAY. This field isn’t populated until all transaction security policies are processed for the real-time event.
Type: picklist
Properties: Nillable, Restricted picklist
Description: The result of the transaction policy. Possible values are:
Block—The user was blocked from performing the operation that triggered the policy.Error—The policy caused an undefined error when it executed.ExemptNoAction—The user is exempt from transaction security policies, so the policy didn’t trigger.FailedInvalidPassword—The user entered an invalid password.FailedPasswordLockout—The user entered an invalid password too many times.MeteringBlock—The policy took longer than 3 seconds to process, so the user was blocked from performing the operation.MeteringNoAction—The policy took longer than 3 seconds to process, but the user isn’t blocked from performing the operation.NoAction—The policy didn’t trigger.Notified—A notification was sent to the recipient.TwoFAAutomatedSuccess—Salesforce Authenticator approved the request for access because the request came from a trusted location. After users enable location services in Salesforce Authenticator, they can designate trusted locations. When a user trusts a location for a particular activity, such as logging in from a recognized device, that activity is approved from the trusted location for as long as the location is trusted.TwoFADenied—The user denied the approval request in the authenticator app, such as Salesforce Authenticator.TwoFAFailedGeneralError—An error caused by something other than an invalid verification code, too many verification attempts, or authenticator app connectivity.TwoFAFailedInvalidCode—The user provided an invalid verification code.TwoFAFailedTooManyAttempts—The user attempted to verify identity too many times. For example, the user entered an invalid verification code repeatedly.TwoFAInitiated—Salesforce initiated identity verification but hasn’t yet challenged the user.TwoFAInProgress—Salesforce challenged the user to verify identity and is waiting for the user to respond or for Salesforce Authenticator to send an automated response.TwoFANoAction—The policy specifies multi-factor authentication (formerly called two-factor authentication) as an action, but the user is already in a high-assurance session.TwoFARecoverableError—Salesforce can’t reach the authenticator app to verify identity, but will retry.TwoFAReportedDenied—The user denied the approval request in the authenticator app, such as Salesforce Authenticator, and also flagged the approval request to report to an administrator.TwoFASucceeded—The user’s identity was verified.
This field isn’t populated until all transaction security policies are processed for the real-time event.
Type: reference
Properties: Nillable
Description: This is a relationship field.
Relationship Name: Profile
Refers To: Profile
Type: string
Properties: Nillable
Description: Represents an ID value that is populated by the system and refers to the position of the event in the event stream. Replay ID values aren’t guaranteed to be contiguous for consecutive events. A subscriber can store a replay ID value and use it on resubscription to retrieve missed events that are within the retention window.
Type: reference
Properties: Nillable
Description: This is a relationship field.
Relationship Name: Role
Refers To: UserRole
Type: string
Properties: Nillable
Description: The user’s unique session ID. Use this value to identify all user events within a session. When a user logs out and logs in again, a new session is started. For LoginAsEvent, this field is usually null because the event is captured before a session is created.
Type: picklist
Properties: Nillable, Restricted picklist
Description: Session-level security controls user access to features that support it, such as connected apps and reporting. Possible values are:
- HIGH_ASSURANCE - A high assurance session was used for resource access. For example, when the user tries to access a resource such as a connected app, report, or dashboard that requires a high-assurance session level.
- LOW - The user’s security level for the current session meets the lowest requirements.
- STANDARD - The user’s security level for the current session meets the Standard requirements set in the current organization Session Security Levels.
This low level is not available, nor used, in the Salesforce UI. User sessions through the UI are either standard or high assurance. You can set this level using the API, but users assigned this level experience unpredictable and reduced functionality in their Salesforce org.
Type: string
Properties: Nillable
Description: The source IP address of the client logging in. For example, 126.7.4.2.
Type: string
Properties: Nillable
Description: The URL redirected to after logging in as another user succeeds.
Type: reference
Properties: Nillable
Description: Unique ID that identifies the user who is being logged in as by the admin. For example, 005000000000123.
Type: picklist
Properties: Nillable, Restricted picklist
Description: The category of user license of the user who is being logged in as by the admin. Each UserType is associated with one or more UserLicense records. Each UserLicense is associated with one or more profiles. Valid values:
Possible values:
- CsnOnly—Users whose access to the application is limited to Chatter. This user type includes Chatter Free and Chatter moderator users.
- CspLitePortal—CSP Lite Portal license. Users whose access is limited because they’re organization customers and access the application through a customer portal or an Experience Cloud site.
- CustomerSuccess—Customer Success license. Users whose access is limited because they’re organization customers and access the application through a customer portal.
- Guest
- PowerCustomerSuccess—Power Customer Success license. Users whose access is limited because they’reare organization customers and access the application through a customer portal. Users with this license type can view and edit data they directly own or data owned by or shared with users below them in the customer portal role hierarchy.
- PowerPartner—Power Partner license. Users whose access is limited because they’re partners and typically access the application through a partner portal or site.
- SelfService
- Standard—Standard user license. This user type also includes Salesforce Platform and Salesforce Platform One user licenses, and admins for this org.
Type: string
Properties: Nillable
Description: Username of the user who is being logged in as by the admin, in the format of admin@company.com.