---
schema_version: "1"
id: 2a5aa0e04320ad05115466b36a94531891ad8468804cf65b64be77fb98fb2a05
title: Create a Transaction Security Policy That Uses Apex
collection: admin
version: current
locale: en-us
portal_url: https://docs.salesforce.com/admin/current/en-us/xcloud/264-0-0/enhanced_transaction_security_apex.md
canonical_url: https://help.salesforce.com/s/articleView?id=xcloud.enhanced_transaction_security_apex.htm&release=264.0.0&type=5
source_site: help.salesforce.com
content_type: documentation
content_hash: a4461955ee813d659510130ae17eb24e4bf67b4d442a33eb7e0cc82828698e14
description: Use Setup to create an transaction security policy that uses Apex. You can specify an existing Apex class or create an empty class that you then code. The Apex class must implement the TxnSecurity.EventCondition interface.
products:
  - Salesforce Platform
  - Cross Cloud
release: "264"
---
# Create a Transaction Security Policy That Uses Apex

Use Setup to create an transaction security policy that uses Apex. You can specify an existing Apex class or create an empty class that you then code. The Apex class must implement the `TxnSecurity.EventCondition` interface.

### Required Editions

<table class="slds-table slds-table_bordered slds-max-medium-table_stacked slds-m-bottom_small edition">
        <colgroup>
          <col>
        </colgroup>
        <tbody>
          <tr class="">
            <td class="slds-cell-wrap" style="vertical-align:top;">Available in both Salesforce Classic (not available in all orgs) and Lightning
              Experience.</td>

          </tr>
          <tr class="">
            <td class="slds-cell-wrap" style="vertical-align:top;">
              <p>Available in: <strong>Enterprise</strong>, <strong>Unlimited</strong>, and <strong>Developer</strong>
                Editions</p>
              <p style="margin-bottom:0;">Requires Salesforce Shield or Salesforce Event Monitoring add-on
                subscriptions.</p>
            </td>

          </tr>
        </tbody>
      </table> <table class="slds-table slds-table_bordered slds-max-medium-table_stacked slds-m-bottom_small permission">
        <colgroup>
          <col style="width:50%">
          <col style="width:50%">
        </colgroup>
        <thead class="slds-text-title_caps ">
          <tr class="">
            <th scope="colgroup" class="slds-cell-wrap" colspan="2" style="text-align:center;vertical-align:top;" id="d59367e74">
              User Permissions Needed</th>
          </tr>
        </thead>
        <tbody>
          <tr class="">
            <td data-label="User Permissions Needed" class="slds-cell-wrap" style="vertical-align:top;" headers="d59367e74 ">To view events:</td>

            <td class="slds-cell-wrap" style="vertical-align:top;" headers="d59367e74 ">View Real-Time Event Monitoring Data</td>

          </tr>
          <tr class="">
            <td data-label="User Permissions Needed" class="slds-cell-wrap" style="vertical-align:top;" headers="d59367e74 ">To view transaction security policies:</td>

            <td class="slds-cell-wrap" style="vertical-align:top;" headers="d59367e74 ">View All Data</td>

          </tr>
          <tr class="">
            <td data-label="User Permissions Needed" class="slds-cell-wrap" style="vertical-align:top;" headers="d59367e74 ">To create, edit, and manage transaction
              security policies:</td>

            <td class="slds-cell-wrap" style="vertical-align:top;" headers="d59367e74 ">Customize Application and Modify Transaction
              Security Policy</td>

          </tr>
        </tbody>
      </table>

You can create multiple policies for the same type of event, but we recommend that your policies and their actions don’t overlap. If multiple policies with the same action for a given event execute when the event occurs, their order of execution is indeterminate.

1. From Setup, in the Quick Find box, enter Transaction Security, and then select **Transaction Security Policies**.
2. Click **New**, and then select **Apex**.
3. Click **Next**.
4. Select an event that your policy is built on.
    
    For example, if you want to track API calls in your org, select **API Event**. If you want to monitor when users view or export reports, select **Report Event**. See [Transaction Security](https://help.salesforce.com/s/articleView?id=xcloud.enhanced_transaction_security_policy_types.htm&release=264.0.0&type=5 "Transaction Security is a framework that intercepts real-time events and applies appropriate actions to monitor and control user activity. Each transaction security policy has conditions that evaluate events and the real-time actions that are triggered after those conditions are met. The actions are Block, Multi-Factor Authentication, and Notifications. Before you build your policies, understand the available event types, policy conditions, and common use cases. Transaction Security is included in Real-Time Event Monitoring.") for the full list of available events.
5. Select the Apex class that implements your policy. If you haven’t already created the class, select **New Empty Apex Class**.
6. Click **Next**.
7. Select the action that the policy performs when triggered.
    
    The available actions vary depending on the event type. For more information, see [Transaction Security Actions and Notifications](https://help.salesforce.com/s/articleView?id=xcloud.enhanced_transaction_security_actions_notifs.htm&type=5&language=en_US).
    
    ![Note](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-xcloud-setup-264-0-0-production-enus/6f21df35-9ea0-4f53-ac94-45c3b5dfd5bc/images/icon_note.png)
    
    Note The two-factor authentication action isn’t available in the Salesforce mobile app, Lightning Experience, or via API for events. Instead, the block action is used. For example, if a two-factor authentication policy is triggered on a list view performed via the API, Salesforce blocks the API user.
8. If applicable, choose a block message or notification type and recipient.
9. Enter a name and description for your policy.
    
    Your policy name must begin with a letter, not end with an underscore, and not contain two consecutive underscores.
10. Optionally, enable the policy.
    
    If you chose to create an Apex class, don’t enable the policy yet because you must first add code to the class.
11. Click **Finish**.
    
    Your new policy appears in the Policies table. If you chose to create an Apex class, its name is the 25 characters of your policy name without spaces appended with the `EventCondition` string. If your policy is named “My Apex Class,” your Apex class is auto-generated as `MyApexClassEventCondition`. The class is listed in the Apex Condition column.
12. Click the name of your Apex class if you want to edit it.
    
    If you chose to create an Apex class, you must add the implementation code. Salesforce adds this basic code to get you started.
    
    ```java
    global class MyApexClassEventCondition implements TxnSecurity.EventCondition {
    
      public boolean evaluate(SObject event) {
        return false;
      }
    
    }
    ```

When you delete a transaction security policy that uses Apex, the implementation class isn't deleted. You can either delete this Apex class separately or reuse it in another policy.

Don’t include DML statements in your Apex-based policies because they can cause errors. When you send a custom email via Apex during transaction policy evaluation, you get an error, even if the record isn’t explicitly related to another record. For more information, see [Apex DML Operations](https://developer.salesforce.com/docs/atlas.en-us.apexcode.meta/apexcode/apex_dml_section.htm) in the Apex Reference Guide.

- **[Enhanced Apex Transaction Security Implementation Examples](https://help.salesforce.com/s/articleView?id=xcloud.enhanced_transaction_security_policy_apex_examples.htm&release=264.0.0&type=5)**  
    Here are examples of implementing enhanced Apex transaction security.
- **[Asynchronous Apex Example](https://help.salesforce.com/s/articleView?id=xcloud.et_security_policy_apex_dml_example.htm&release=264.0.0&type=5)**  
    When executing a transaction security policy, use an asynchronous Apex process to offload time-consuming operations, such as sending a notification email to an external recipient.
- **[Enhanced Transaction Security Apex Testing](https://help.salesforce.com/s/articleView?id=xcloud.enhanced_transaction_security_apex_test.htm&release=264.0.0&type=5)**  
    Writing robust tests is an engineering best practice to ensure that your code does what you expect and to find errors before your users and customers do. It’s even more important to write tests for your transaction security policy’s Apex code because it executes during critical user actions in your Salesforce org. For example, a bug in your LoginEvent policy that’s not caught during testing can result in locking your users out of your org, a situation best avoided.

#### See Also

- [_Apex Reference Guide_: TxnSecurity.EventCondition Interface](https://developer.salesforce.com/docs/atlas.en-us.apexcode.meta/apexcode/apex_interface_TxnSecurity_EventCondition.htm)