---
schema_version: "1"
id: a331a6dc9310f7e083980e0cc7ee3224e73724a91b8480095387e68b8f5b47bd
title: Login Event Type
collection: legacydeveloper
version: current
locale: en-us
portal_url: https://docs.salesforce.com/legacydeveloper/current/en-us/object_reference/sforce_api_objects_eventlogfile_login.md
canonical_url: https://developer.salesforce.com/docs/atlas.en-us.object_reference.meta/object_reference/sforce_api_objects_eventlogfile_login.htm
source_site: developer.salesforce.com
content_type: documentation
content_hash: bb950648c537cd9d138a16634fde1bc5256ef79689283a0de49b034b03703b6c
description: Login events contain details about your org’s user login history.
---
# Login Event Type

Login events contain details about your org’s user login history.

![Note](https://developer.salesforce.com/docs/atlas.en-us.object_reference.meta/object_reference/images/icon_note.png)

#### Note

The Login event type is used by EventLogFile (ELF). It isn’t a real-time event. For the LoginEvent real-time event, which is part of Real-Time Event Monitoring (RTEM), see [LoginEvent](https://developer.salesforce.com/docs/atlas.en-us.264.0.platform_events.meta/platform_events/sforce_api_objects_loginevent.htm "HTML (New Window)") in the Platform Events Developer Guide.

For details about event monitoring, see the [Trailhead Event Monitoring module](https://trailhead.salesforce.com/en/modules/event_monitoring/units/event_monitoring_intro "HTML (New Window)") or the [REST API Developer Guide](https://developer.salesforce.com/docs/atlas.en-us.264.0.api_rest.meta/api_rest/using_resources_event_log_files.htm "HTML (New Window)").

## Fields

<table class="featureTable sort_table" summary="">


          <tbody class="tbody">
            <tr>
              <td class="entry"><strong class="ph b">Field</strong></td>

              <td class="entry"><strong class="ph b">Details</strong></td>

            </tr>

            <tr>
              <td class="entry"><span class="keyword parmname">API_TYPE</span></td>

              <td class="entry">
                <dl class="dl detailList">

                  <dt class="dt dlterm">Type</dt>

                  <dd class="dd">String</dd>



                  <dt class="dt dlterm">Description</dt>

                  <dd class="dd">The type of API request.</dd>

                  <dd class="dd">Possible values are:<ul class="ul bulletList">
                      <li class="li">
                        <samp class="codeph nolang">D</samp>—Apex
                        Class
                      </li>

                      <li class="li">
                        <samp class="codeph nolang">E</samp>—SOAP
                        Enterprise
                      </li>

                      <li class="li">
                        <samp class="codeph nolang">M</samp>—SOAP
                        Metadata
                      </li>

                      <li class="li">
                        <samp class="codeph nolang">P</samp>—SOAP
                        Partner
                      </li>

                      <li class="li">
                        <samp class="codeph nolang">S</samp>—SOAP
                        Apex
                      </li>

                      <li class="li">
                        <samp class="codeph nolang">T</samp>—SOAP
                        Tooling
                      </li>

                      <li class="li">
                        <samp class="codeph nolang">f</samp>—Feed
                      </li>

                      <li class="li">
                        <samp class="codeph nolang">l</samp>—Live
                        Agent
                      </li>

                      <li class="li">
                        <samp class="codeph nolang">p</samp>—SOAP
                        ClientSync
                      </li>

                    </ul>
                  </dd>


                </dl>

              </td>

            </tr>

            <tr>
              <td class="entry"><span class="keyword parmname">API_VERSION</span></td>

              <td class="entry">
                <dl class="dl detailList">

                  <dt class="dt dlterm">Type</dt>

                  <dd class="dd">String</dd>



                  <dt class="dt dlterm">Description</dt>

                  <dd class="dd">The version of the API that’s being used.</dd>

                  <dd class="dd">For example: <samp class="codeph nolang">36.0</samp>.</dd>


                </dl>

              </td>

            </tr>

            <tr>
              <td class="entry"><span class="keyword parmname">AUTHENTICATION_CONTEXT_CLASS_REFERENCE</span></td>

              <td class="entry">
                <dl class="dl detailList">

                  <dt class="dt dlterm">Type</dt>

                  <dd class="dd">String</dd>



                  <dt class="dt dlterm">Description</dt>

                  <dd class="dd">If provided by a third-party identity provider, the
                    authentication method indicated in the Authentication
                    Context Class Reference (ACR) claim.<ul class="ul bulletList">
                      <li class="li">SAML providers—Stores the value of the <samp class="codeph nolang">AuthnContextClassRef</samp>
                        statement in the SAML response.</li>

                      <li class="li">OpenID Connect providers—Stores the value of the
                        ACR claim in the ID token </li>

                    </ul>
                    This field is available in API version 66.0 and
                    later.</dd>


                </dl>

              </td>

            </tr>

            <tr>
              <td class="entry"><span class="keyword parmname">AUTHENTICATION_METHOD_REFERENCE</span></td>

              <td class="entry">
                <dl class="dl detailList">

                  <dt class="dt dlterm">Type</dt>

                  <dd class="dd">String</dd>



                  <dt class="dt dlterm">Description</dt>

                  <dd class="dd">If provided by a third-party identity provider, the
                    authentication method indicated in the Authentication
                    Method Reference (AMR) claim.<ul class="ul bulletList">
                      <li class="li">SAML providers—Stores the value of any attribute
                        named <samp class="codeph nolang">AMR</samp> or
                        <samp class="codeph nolang">authmethodsreferences</samp> in the SAML
                        response.
                      </li>

                      <li class="li">OpenID Connect providers—Stores the value of the
                        AMR claim in the ID token.</li>

                    </ul>
                  </dd>

                  <dd class="dd"> This field is available in API version 51.0 and
                    later.</dd>


                </dl>

              </td>

            </tr>

            <tr>
              <td class="entry"><span class="keyword parmname">AUTHENTICATION_SERVICE_ID</span></td>

              <td class="entry">
                <dl class="dl detailList">

                  <dt class="dt dlterm">Type</dt>

                  <dd class="dd">Id</dd>



                  <dt class="dt dlterm">Description</dt>

                  <dd class="dd">The 15-character ID for the authentication service used
                    to log in. This field stores IDs for these
                    authentication services.<ul class="ul bulletList">
                      <li class="li">SAML single sign-on providers</li>

                      <li class="li">Token exchange handlers</li>

                    </ul>
                  </dd>


                </dl>

                <p class="p">Available in API version 60.0 and later.</p>

              </td>

            </tr>

            <tr>
              <td class="entry"><span class="keyword parmname">BROWSER_TYPE</span></td>

              <td class="entry">
                <dl class="dl detailList">

                  <dt class="dt dlterm">Type</dt>

                  <dd class="dd">String</dd>



                  <dt class="dt dlterm">Description</dt>

                  <dd class="dd">The identifier string returned by the browser used at
                    login.</dd>

                  <dd class="dd">Example values are:<ul class="ul bulletList">
                      <li class="li"><samp class="codeph nolang">Go-http-client/1.1</samp></li>

                      <li class="li"><samp class="codeph nolang">Mozilla/5.0
                          (Macintosh; Intel Mac OS X 10.12; rv%3A50.0)
                          Gecko/20100101 Firefox/50.0</samp></li>

                      <li class="li"><samp class="codeph nolang">Mozilla/5.0
                          (Macintosh; Intel Mac OS X 10_11_6)
                          AppleWebKit/537.36 (KHTML, like Gecko)
                          Chrome/51.0.2704.84 Safari/537.36</samp></li>

                    </ul>
                  </dd>


                </dl>

              </td>

            </tr>

            <tr>
              <td class="entry"><span class="keyword parmname">CIPHER_SUITE</span></td>

              <td class="entry">
                <dl class="dl detailList">

                  <dt class="dt dlterm">Type</dt>

                  <dd class="dd">String</dd>



                  <dt class="dt dlterm">Description</dt>

                  <dd class="dd">The TLS cipher suite used for the login. Values are
                    OpenSSL-style cipher suite names, with hyphen
                    delimiters. For more information, see <a class="xref" href="https://www.openssl.org/source/" target="_blank" title="HTML (New Window)">OpenSSL
                      Cryptography and SSL/TLS Toolkit</a>.</dd>


                </dl>

              </td>

            </tr>

            <tr>
              <td class="entry"><span class="keyword parmname">CLIENT_IP</span></td>

              <td class="entry">
                <dl class="dl detailList">

                  <dt class="dt dlterm">Type</dt>

                  <dd class="dd">String</dd>



                  <dt class="dt dlterm">Description</dt>

                  <dd class="dd"><span class="ph" id="client-ip-desc"><a name="client-ip-desc"><!-- --></a>The IP address of the client
                      that’s using Salesforce services. A Salesforce
                      internal IP (such as a login from AppExchange) is
                      shown as “Salesforce.com IP”.</span></dd>

                  <dd class="dd">
                    <span class="ph" id="client-ip-ex"><a name="client-ip-ex"><!-- --></a>For example: <samp class="codeph nolang">96.43.144.26</samp></span>.
                  </dd>


                </dl>

              </td>

            </tr>

            <tr>
              <td class="entry"><span class="keyword parmname">COUNTRY_CODE</span></td>

              <td class="entry">
                <a name="dl_sdc_wsq_xgc"><!-- --></a>
                <dl class="dl detailList" id="dl_sdc_wsq_xgc">

                  <dt class="dt dlterm">Type</dt>

                  <dd class="dd">String</dd>



                  <dt class="dt dlterm">Description</dt>

                  <dd class="dd">The country code associated with the IP address of the
                    user logging in.</dd>


                </dl>

              </td>

            </tr>

            <tr>
              <td class="entry"><span class="keyword parmname">CPU_TIME</span></td>

              <td class="entry">
                <dl class="dl detailList">

                  <dt class="dt dlterm">Type</dt>

                  <dd class="dd">Number</dd>



                  <dt class="dt dlterm">Description</dt>

                  <dd class="dd">The CPU time in milliseconds used to complete the
                    request. This field indicates the amount of activity
                    taking place in the app server layer.</dd>


                </dl>

              </td>

            </tr>

            <tr>
              <td class="entry"><span class="keyword parmname">DB_TOTAL_TIME</span></td>

              <td class="entry">
                <dl class="dl detailList">

                  <dt class="dt dlterm">Type</dt>

                  <dd class="dd">Number</dd>



                  <dt class="dt dlterm">Description</dt>

                  <dd class="dd">The time in nanoseconds for a database round trip.
                    Includes time spent in the JDBC driver, network to the
                    database, and <span class="keyword parmname">DB_CPU_TIME</span>. Compare
                    this field to <span class="keyword parmname">CPU_TIME</span> to determine
                    whether performance issues are occurring in the database
                    layer or in your own code.</dd>


                </dl>

              </td>

            </tr>

            <tr>
              <td class="entry"><span class="keyword parmname">EVENT_TYPE</span></td>

              <td class="entry">
                <dl class="dl detailList">

                  <dt class="dt dlterm">Type</dt>

                  <dd class="dd">String</dd>



                  <dt class="dt dlterm">Description</dt>

                  <dd class="dd">
                    <span class="ph" id="event-type-desc"><a name="event-type-desc"><!-- --></a>The type of event.</span> The
                    value is always <samp class="codeph nolang">Login</samp>.
                  </dd>


                </dl>

              </td>

            </tr>

            <tr>
              <td class="entry"><span class="keyword parmname">FORWARDED_FOR_IP</span></td>

              <td class="entry">
                <dl class="dl detailList">

                  <dt class="dt dlterm">Type</dt>

                  <dd class="dd">String</dd>



                  <dt class="dt dlterm">Description</dt>

                  <dd class="dd">The value in the <samp class="codeph nolang">X-Forwarded-For</samp> header of HTTP requests
                    sent by the client. For logins that use one or more HTTP
                    proxies, the <samp class="codeph nolang">X-Forwarded-For</samp> header is sometimes used
                    to store the origin IP and all proxy IPs.</dd>

                  <dd class="dd">The <span class="keyword parmname">FORWARDED_FOR_IP</span> field stores
                    whatever value the client sends, which might not be an
                    IP address. The maximum length is 256 characters. Longer
                    values are truncated. The
                    <span class="keyword parmname">FORWARDED_FOR_IP</span> field isn’t
                    populated for logins completed via OAuth flows or single
                    sign-on (SSO).
                  </dd>

                  <dd class="dd">
                    <p class="p">Available in API version 61.0 and later.</p>

                  </dd>


                </dl>

              </td>

            </tr>

            <tr>
              <td class="entry"><span class="keyword parmname">HTTP_REFERER</span></td>

              <td class="entry">
                <a name="dl_zzl_ltq_xgc"><!-- --></a>
                <dl class="dl detailList" id="dl_zzl_ltq_xgc">

                  <dt class="dt dlterm">Type</dt>

                  <dd class="dd">String</dd>



                  <dt class="dt dlterm">Description</dt>

                  <dd class="dd">The referring URI of the page that’s receiving the
                    request.</dd>


                </dl>

              </td>

            </tr>

            <tr>
              <td class="entry"><span class="keyword parmname">LOGIN_KEY</span></td>

              <td class="entry">
                <dl class="dl detailList">

                  <dt class="dt dlterm">Type</dt>

                  <dd class="dd">String</dd>



                  <dt class="dt dlterm">Description</dt>

                  <dd class="dd">The string that ties together all events in a given
                    user’s login session. It starts with a login event and
                    ends with either a logout event or the user session
                    expiring.</dd>

                  <dd class="dd">For example: <samp class="codeph nolang">GeJCsym5eyvtEK2I</samp>.</dd>


                </dl>

              </td>

            </tr>

            <tr>
              <td class="entry"><span class="keyword parmname">LOGIN_STATUS</span></td>

              <td class="entry">
                <dl class="dl detailList">

                  <dt class="dt dlterm">Type</dt>

                  <dd class="dd">String</dd>



                  <dt class="dt dlterm">Description</dt>

                  <dd class="dd">The status of the login attempt. For successful logins,
                    the value is LOGIN_NO_ERROR. All other values indicate
                    errors or authentication issues. For details, see <a class="xref" href="https://developer.salesforce.com/docs/atlas.en-us.object_reference.meta/object_reference/sforce_api_objects_eventlogfile_login_status.htm" title="When users attempt to log in to your org, the success or failure of their login attempts is tracked in event log file data. Specifically, the LOGIN_STATUS field in the Login event type contains the result of these login attempts. The data in LOGIN_STATUS can help you determine whether your users’ login attempts were successful. This field is available in the Login event type in the EventLogFile object in API version 39.0 and later.">Login Event Type
                      — LOGIN_STATUS Values</a>.</dd>


                </dl>

              </td>

            </tr>

            <tr>
              <td class="entry"><span class="keyword parmname">LOGIN_SUB_TYPE</span></td>

              <td class="entry">
                <dl class="dl detailList">

                  <dt class="dt dlterm">Type</dt>

                  <dd class="dd">picklist</dd>



                  <dt class="dt dlterm">Properties</dt>

                  <dd class="dd">Nillable, Restricted picklist</dd>



                  <dt class="dt dlterm">Description</dt>

                  <dd class="dd">
                    <span class="ph" id="def_loginsubtype"><a name="def_loginsubtype"><!-- --></a>The type of login flow
                      used.</span> See the <span class="keyword parmname">LoginSubType</span>
                    field of <a class="xref" href="https://developer.salesforce.com/docs/atlas.en-us.264.0.object_reference.meta/object_reference/sforce_api_objects_loginhistory.htm" target="_blank">LoginHistory</a> in the Object Reference guide
                    for the list of possible values. <p class="p">Label is
                      <strong class="ph uicontrol">Login Subtype</strong>.
                    </p>
                  </dd>


                </dl>

              </td>

            </tr>

            <tr>
              <td class="entry"><span class="keyword parmname">LOGIN_TYPE</span></td>

              <td class="entry">
                <dl class="dl detailList">

                  <dt class="dt dlterm">Type</dt>

                  <dd class="dd">String</dd>



                  <dt class="dt dlterm">Description</dt>

                  <dd class="dd">The type of login used to access the session.</dd>

                  <dd class="dd">Possible values are:<ul class="ul bulletList">
                      <li class="li">
                        <samp class="codeph nolang">7</samp>—AppExchange
                      </li>

                      <li class="li">
                        <samp class="codeph nolang">A</samp>—Application
                      </li>

                      <li class="li">
                        <samp class="codeph nolang">s</samp>—Certificate-based login
                      </li>

                      <li class="li">
                        <samp class="codeph nolang">k</samp>—Chatter
                        Communities External User
                      </li>

                      <li class="li">
                        <samp class="codeph nolang">n</samp>—Chatter
                        Communities External User Third Party SSO
                      </li>

                      <li class="li">
                        <samp class="codeph nolang">x</samp>—Cross
                        Tenant Login (for internal use only)
                      </li>

                      <li class="li">
                        <samp class="codeph nolang">r</samp>—Employee
                        Login to Community
                      </li>

                      <li class="li">
                        <samp class="codeph nolang">z</samp>—Lightning
                        Login
                      </li>

                      <li class="li">
                        <samp class="codeph nolang">l</samp>—Networks
                        Portal API Only
                      </li>

                      <li class="li">
                        <samp class="codeph nolang">6</samp>—Remote
                        Access Client
                      </li>

                      <li class="li">
                        <samp class="codeph nolang">i</samp>—Remote
                        Access 2.0
                      </li>

                      <li class="li">
                        <samp class="codeph nolang">I</samp>—Other
                        Apex API
                      </li>

                      <li class="li">
                        <samp class="codeph nolang">R</samp>—Partner
                        Product
                      </li>

                      <li class="li">
                        <samp class="codeph nolang">w</samp>—Passwordless Login
                      </li>

                      <li class="li">
                        <samp class="codeph nolang">3</samp>—Customer
                        Service Portal
                      </li>

                      <li class="li">
                        <samp class="codeph nolang">q</samp>—Partner
                        Portal Third-Party SSO
                      </li>

                      <li class="li">
                        <samp class="codeph nolang">9</samp>—Partner
                        Portal
                      </li>

                      <li class="li">
                        <samp class="codeph nolang">5</samp>—SAML Idp
                        Initiated SSO
                      </li>

                      <li class="li">
                        <samp class="codeph nolang">m</samp>—SAML
                        Chatter Communities External User SSO
                      </li>

                      <li class="li">
                        <samp class="codeph nolang">b</samp>—SAML
                        Customer Service Portal SSO
                      </li>

                      <li class="li">
                        <samp class="codeph nolang">c</samp>—SAML
                        Partner Portal SSO
                      </li>

                      <li class="li">
                        <samp class="codeph nolang">h</samp>—SAML Site
                        SSO
                      </li>

                      <li class="li">
                        <samp class="codeph nolang">8</samp>—SAML Sfdc
                        Initiated SSO
                      </li>

                      <li class="li">
                        <samp class="codeph nolang">E</samp>—SelfService
                      </li>

                      <li class="li">
                        <samp class="codeph nolang">j</samp>—Third
                        Party SSO
                      </li>

                    </ul>
                  </dd>


                </dl>

              </td>

            </tr>

            <tr>
              <td class="entry"><span class="keyword parmname">LOGIN_URL</span></td>

              <td class="entry">
                <dl class="dl detailList">

                  <dt class="dt dlterm">Type</dt>

                  <dd class="dd">String</dd>



                  <dt class="dt dlterm">Description</dt>

                  <dd class="dd">The URL of the login page. </dd>


                </dl>

              </td>

            </tr>

            <tr>
              <td class="entry"><span class="keyword parmname">ORGANIZATION_ID</span></td>

              <td class="entry">
                <dl class="dl detailList">

                  <dt class="dt dlterm">Type</dt>

                  <dd class="dd">Id</dd>



                  <dt class="dt dlterm">Description</dt>

                  <dd class="dd">The 15-character ID of the organization.</dd>

                  <dd class="dd">For example: <samp class="codeph nolang">00D000000000123</samp>.</dd>


                </dl>

              </td>

            </tr>

            <tr>
              <td class="entry"><span class="keyword parmname">REQUEST_ID</span></td>

              <td class="entry">
                <dl class="dl detailList">

                  <dt class="dt dlterm">Type</dt>

                  <dd class="dd">String</dd>



                  <dt class="dt dlterm">Description</dt>

                  <dd class="dd"><span class="ph" id="request-id-desc"><a name="request-id-desc"><!-- --></a>The unique ID of a single
                      transaction. A transaction can contain one or more
                      events. Each event in a given transaction has the
                      same <span class="keyword parmname">REQUEST_ID</span>.</span></dd>

                  <dd class="dd">For example: <samp class="codeph nolang">3nWgxWbDKWWDIk0FKfF5DV</samp>.</dd>


                </dl>

              </td>

            </tr>

            <tr>
              <td class="entry"><span class="keyword parmname">REQUEST_STATUS</span></td>

              <td class="entry">
                <dl class="dl detailList">

                  <dt class="dt dlterm">Type</dt>

                  <dd class="dd">String</dd>



                  <dt class="dt dlterm">Description</dt>

                  <dd class="dd">The status of the request for a page view or user
                    interface action. </dd>

                  <dd class="dd">For example:<a name="ul_wgy_1rf_4q"><!-- --></a>
                    <ul class="ul bulletList" id="ul_wgy_1rf_4q">
                      <li class="li">
                        <samp class="codeph nolang">S</samp>—Success.
                        Salesforce handled the request successfully. If an
                        Apex controller throws an exception, this status
                        is also returned.
                      </li>

                      <li class="li">
                        <samp class="codeph nolang">F</samp>—Failure.
                        Typically 4xx or 5xx HTTP codes, such as no
                        permission to view page, page took too long to
                        render, page is read-only.
                      </li>

                      <li class="li">
                        <samp class="codeph nolang">U</samp>—Undefined
                      </li>

                      <li class="li">
                        <samp class="codeph nolang">A</samp>—Authorization Error
                      </li>

                      <li class="li">
                        <samp class="codeph nolang">R</samp>—Redirect.
                        Typically a 3xx HTTP code, possibly initiated by
                        an Apex controller in a Visualforce page.
                      </li>

                      <li class="li">
                        <samp class="codeph nolang">N</samp>—Not
                        Found. 404 error.
                      </li>

                    </ul>
                    This field can have a blank value.
                  </dd>


                </dl>

              </td>

            </tr>

            <tr>
              <td class="entry"><span class="keyword parmname">RUN_TIME</span></td>

              <td class="entry">
                <dl class="dl detailList">

                  <dt class="dt dlterm">Type</dt>

                  <dd class="dd">Number</dd>



                  <dt class="dt dlterm">Description</dt>

                  <dd class="dd">The amount of time that the request took in
                    milliseconds.</dd>


                </dl>

              </td>

            </tr>

            <tr>
              <td class="entry"><span class="keyword parmname">SESSION_KEY</span></td>

              <td class="entry">
                <dl class="dl detailList">

                  <dt class="dt dlterm">Type</dt>

                  <dd class="dd">String</dd>



                  <dt class="dt dlterm">Description</dt>

                  <dd class="dd">The user’s unique session ID. You can use this value to
                    identify all user events within a session. When a user
                    logs out and logs in again, a new session is started.
                    For Login Event Type, this field is usually null because
                    the event is captured before a session is created.</dd>



                  <dt class="dt dlterm">Example</dt>

                  <dd class="dd">d7DEq/ANa7nNZZVD</dd>


                </dl>

              </td>

            </tr>

            <tr>
              <td class="entry"><span class="keyword parmname">SOURCE_IP</span></td>

              <td class="entry">
                <dl class="dl detailList">

                  <dt class="dt dlterm">Type</dt>

                  <dd class="dd">IP</dd>



                  <dt class="dt dlterm">Description</dt>

                  <dd class="dd">The IP address of the incoming client request that first
                    reaches Salesforce during a login. For example, <samp class="codeph nolang">126.7.4.2</samp>. For clients
                    that redirect through one or more HTTP proxies, this
                    field stores the IP address of the first proxy to reach
                    Salesforce. To better identify the origin IP for these
                    cases, check the <span class="keyword parmname">FORWARDED_FOR_IP</span>
                    field instead.</dd>


                </dl>

              </td>

            </tr>

            <tr>
              <td class="entry"><span class="keyword parmname">TIMESTAMP</span></td>

              <td class="entry">
                <dl class="dl detailList">

                  <dt class="dt dlterm">Type</dt>

                  <dd class="dd">String</dd>



                  <dt class="dt dlterm">Description</dt>

                  <dd class="dd">The access time of Salesforce services in GMT.</dd>

                  <dd class="dd">For example: <samp class="codeph nolang">20130715233322.670</samp>.</dd>


                </dl>

              </td>

            </tr>

            <tr>
              <td class="entry"><span class="keyword parmname">TIMESTAMP_DERIVED</span></td>

              <td class="entry">
                <dl class="dl detailList">

                  <dt class="dt dlterm">Type</dt>

                  <dd class="dd">DateTime</dd>



                  <dt class="dt dlterm">Description</dt>

                  <dd class="dd">The access time of Salesforce services in
                    ISO8601-compatible format (<samp class="codeph nolang">YYYY-MM-DDTHH:MM:SS.sssZ</samp>).</dd>

                  <dd class="dd">For example: <samp class="codeph nolang">2015-07-27T11:32:59.555Z</samp>. Time zone is
                    GMT.</dd>


                </dl>

              </td>

            </tr>

            <tr>
              <td class="entry"><span class="keyword parmname">TLS_PROTOCOL</span></td>

              <td class="entry">
                <dl class="dl detailList">

                  <dt class="dt dlterm">Type</dt>

                  <dd class="dd">String</dd>



                  <dt class="dt dlterm">Description</dt>

                  <dd class="dd">The TLS protocol used for the login.</dd>



                  <dt class="dt dlterm">Example</dt>

                  <dd class="dd">There are 3 possible values.<ul class="ul bulletList">
                      <li class="li">1.0</li>

                      <li class="li">1.1</li>

                      <li class="li">1.2</li>

                    </ul>
                  </dd>


                </dl>

              </td>

            </tr>

            <tr>
              <td class="entry"><span class="keyword parmname">URI</span></td>

              <td class="entry">
                <dl class="dl detailList">

                  <dt class="dt dlterm">Type</dt>

                  <dd class="dd">String</dd>



                  <dt class="dt dlterm">Description</dt>

                  <dd class="dd">The URI of the page that’s receiving the request.</dd>

                  <dd class="dd">For example: <span class="keyword parmname">/home/home.jsp</span>.</dd>


                </dl>

              </td>

            </tr>

            <tr>
              <td class="entry"><span class="keyword parmname">URI_ID_DERIVED</span></td>

              <td class="entry">
                <dl class="dl detailList">

                  <dt class="dt dlterm">Type</dt>

                  <dd class="dd">ID</dd>



                  <dt class="dt dlterm">Description</dt>

                  <dd class="dd">The 18-character case insensitive ID of the URI of the
                    page that’s receiving the request.</dd>


                </dl>

              </td>

            </tr>

            <tr>
              <td class="entry"><span class="keyword parmname">USE_API_TOKEN</span></td>

              <td class="entry">
                <a name="dl_h2y_2tq_xgc"><!-- --></a>
                <dl class="dl detailList" id="dl_h2y_2tq_xgc">

                  <dt class="dt dlterm">Type</dt>

                  <dd class="dd">String</dd>



                  <dt class="dt dlterm">Description</dt>

                  <dd class="dd">Login with API Token - T token, or P password.</dd>


                </dl>

              </td>

            </tr>

            <tr>
              <td class="entry"><span class="keyword parmname">USER_ID</span></td>

              <td class="entry">
                <dl class="dl detailList">

                  <dt class="dt dlterm">Type</dt>

                  <dd class="dd">Id</dd>



                  <dt class="dt dlterm">Description</dt>

                  <dd class="dd">The 15-character ID of the user who’s using Salesforce
                    services through the UI or the API.</dd>

                  <dd class="dd">For example: <samp class="codeph nolang">00530000009M943</samp>
                  </dd>


                </dl>

              </td>

            </tr>

            <tr>
              <td class="entry"><span class="keyword parmname">USER_ID_DERIVED</span></td>

              <td class="entry">
                <dl class="dl detailList">

                  <dt class="dt dlterm">Type</dt>

                  <dd class="dd">Id</dd>



                  <dt class="dt dlterm">Description</dt>

                  <dd class="dd">The 18-character case insensitive ID of the user who’s
                    using Salesforce services through the UI or the API. </dd>

                  <dd class="dd">
                    <span class="ph" id="user-id-derived-ex"><a name="user-id-derived-ex"><!-- --></a>For example: <samp class="codeph nolang">00590000000I1SNIA0</samp></span>.
                  </dd>


                </dl>

              </td>

            </tr>

            <tr>
              <td class="entry"><span class="keyword parmname">USER_NAME</span></td>

              <td class="entry">
                <dl class="dl detailList">

                  <dt class="dt dlterm">Type</dt>

                  <dd class="dd">String</dd>



                  <dt class="dt dlterm">Description</dt>

                  <dd class="dd">The username that’s used for login.</dd>


                </dl>

              </td>

            </tr>

            <tr>
              <td class="entry"><span class="keyword parmname">USER_TYPE</span></td>

              <td class="entry">
                <dl class="dl detailList">

                  <dt class="dt dlterm">Type</dt>

                  <dd class="dd">String</dd>



                  <dt class="dt dlterm">Description</dt>

                  <dd class="dd">The category of user license.</dd>

                  <dd class="dd">Possible values are:<a name="user-type-values"><!-- --></a>
                    <ul class="ul bulletList" id="user-type-values">
                      <li class="li">
                        <samp class="codeph nolang">CsnOnly</samp>—Users whose access to the
                        application is limited to Chatter. This user type
                        includes Chatter Free and Chatter moderator
                        users.
                      </li>

                      <li class="li">
                        <samp class="codeph nolang">CspLitePortal</samp>—CSP Lite Portal
                        license. Users whose access is limited because
                        they’re organization customers and access the
                        application through a customer portal or an
                        Experience Cloud site.
                      </li>

                      <li class="li">
                        <samp class="codeph nolang">CustomerSuccess</samp>—Customer Success
                        license. Users whose access is limited because
                        they’re organization customers and access the
                        application through a customer portal.
                      </li>

                      <li class="li">
                        <samp class="codeph nolang">Guest</samp>—Users whose access is
                        limited so that your customers can view and
                        interact with your site without logging in.
                      </li>

                      <li class="li">
                        <samp class="codeph nolang">PowerCustomerSuccess</samp>—Power
                        Customer Success license. Users whose access is
                        limited because they’re organization customers and
                        access the application through a customer portal.
                        Users with this license type can view and edit
                        data they directly own or data owned by or shared
                        with users below them in the customer portal role
                        hierarchy.
                      </li>

                      <li class="li">
                        <samp class="codeph nolang">PowerPartner</samp>—Power Partner
                        license. Users whose access is limited because
                        they’re partners and typically access the
                        application through a partner portal or site.
                      </li>

                      <li class="li">
                        <samp class="codeph nolang">SelfService</samp>—Users whose access is
                        limited because they’re organization customers and
                        access the application through a self-service
                        portal.
                      </li>

                      <li class="li">
                        <samp class="codeph nolang">Standard</samp>—Standard user license.
                        This user type also includes Salesforce Platform
                        and Salesforce Platform One user licenses, and
                        admins for this org.
                      </li>

                    </ul>
                  </dd>


                </dl>

              </td>

            </tr>

          </tbody>

        </table>

- **[Login Event Type — LOGIN\_STATUS Values](https://developer.salesforce.com/docs/atlas.en-us.object_reference.meta/object_reference/sforce_api_objects_eventlogfile_login_status.htm)**  
    When users attempt to log in to your org, the success or failure of their login attempts is tracked in event log file data. Specifically, the LOGIN\_STATUS field in the Login event type contains the result of these login attempts. The data in LOGIN\_STATUS can help you determine whether your users’ login attempts were successful. This field is available in the Login event type in the EventLogFile object in API version 39.0 and later.

#### See Also

- [Login Event Type — LOGIN\_STATUS Values](https://developer.salesforce.com/docs/atlas.en-us.object_reference.meta/object_reference/sforce_api_objects_eventlogfile_login_status.htm "When users attempt to log in to your org, the success or failure of their login attempts is tracked in event log file data. Specifically, the LOGIN_STATUS field in the Login event type contains the result of these login attempts. The data in LOGIN_STATUS can help you determine whether your users’ login attempts were successful. This field is available in the Login event type in the EventLogFile object in API version 39.0 and later.")
- [EventLogFile Supported Event Types](https://developer.salesforce.com/docs/atlas.en-us.object_reference.meta/object_reference/sforce_api_objects_eventlogfile_supportedeventtypes.htm "The EventType field in the EventLogFile object supports these events. Some common fields, such as CPU_TIME and RUN_TIME, can have null or zero values depending on how the events are generated for a given feature. Sometimes, three quotation marks appear around event data containing special characters in the CSV file. The third quotation mark is necessary for tools and applications to parse the field data at the correct field value boundary.")
- [EventLogFile](https://developer.salesforce.com/docs/atlas.en-us.object_reference.meta/object_reference/sforce_api_objects_eventlogfile.htm "Represents event log files generated by Event Monitoring. Use event log file data to analyze usage trends and user behavior in your Salesforce org. This object is available in API version 32.0 and later. The Interval and Sequence fields are available only in API version 37.0 and later.")