--- schema_version: "1" id: 0317c9cc2b0f8f5218da2649582fd4cce122e214095a4a1d16e3054cb22e075d title: Named Credential Event Type collection: legacydeveloper version: current locale: en-us portal_url: https://docs.salesforce.com/legacydeveloper/current/en-us/object_reference/sforce_api_objects_eventlogfile_namedcredential.md canonical_url: https://developer.salesforce.com/docs/atlas.en-us.object_reference.meta/object_reference/sforce_api_objects_eventlogfile_namedcredential.htm source_site: developer.salesforce.com content_type: documentation content_hash: 217c7c20d055ed7a80edba9f35bc7bc240de1fbef2b3126b9c333072a29232b9 description: The Named Credential event type captures information about Apex callouts that use named credentials as their endpoints. Use this event type to audit the installed managed packages that use named credentials. If you don’t recognize the package namespace in the named credential event log file, then you can investigate whether a security breach has occurred. This event type is available in the EventLogFile object in API version 53.0 and later. --- # Named Credential Event Type The Named Credential event type captures information about Apex callouts that use named credentials as their endpoints. Use this event type to audit the installed managed packages that use named credentials. If you don’t recognize the package namespace in the named credential event log file, then you can investigate whether a security breach has occurred. This event type is available in the EventLogFile object in API version 53.0 and later. For details about event monitoring, see the [Trailhead Event Monitoring module](https://trailhead.salesforce.com/en/modules/event_monitoring/units/event_monitoring_intro "HTML (New Window)") or [REST API Developer’s Guide](https://developer.salesforce.com/docs/atlas.en-us.264.0.api_rest.meta/api_rest/using_resources_event_log_files.htm "HTML (New Window)"). ## Fields | Field | Details | | --- | --- | | BOT\_IDENTIFIER | Type String Description The ID of the bot. | | BOT\_SESSION\_IDENTIFIER | Type String Description The bot session ID. | | CALLER\_PACKAGE\_NAMESPACE | Type String Description If an Apex callout using a Named Credential endpoint is initiated from a package, then this field contains the package’s namespace. If the callout isn’t initiated from a package, then this field is empty. Example Acme | | CLIENT\_IP | Type String Description The IP address of the client that’s using Salesforce services. A Salesforce internal IP (such as a login from AppExchange) is shown as “Salesforce.com IP”. For example: 96.43.144.26. | | CPU\_TIME | Type Number Description The CPU time in milliseconds used to complete the request. This field indicates the amount of activity taking place in the app server layer. | | EVENT\_TYPE | Type String Description The type of event. The value is always NamedCredential. | | LOGIN\_KEY | Type String Description The string that ties together all events in a given user’s login session. It starts with a login event and ends with either a logout event or the user session expiring. For example: GeJCsym5eyvtEK2I. | | NAMED\_CREDENTIAL\_NAME | Type String Description The name of the named credential that’s the endpoint of the Apex callout. Example My\_Named\_Credential | | ORGANIZATION\_ID | Type ID Description The 15-character ID of the org. Example 00D000000000123 | | PLANNER\_IDENTIFIER | Type String Description The ID of the agent planner. | | REQUEST\_ID | Type String Description The unique ID of a single transaction. A transaction can contain one or more events. Each event in a given transaction has the same REQUEST\_ID. For example: 3nWgxWbDKWWDIk0FKfF5DV. | | RUN\_TIME | Type Number Description The amount of time that the request took in milliseconds. | | SESSION\_KEY | Type String Description The user’s unique session ID. You can use this value to identify all user events within a session. When a user logs out and logs in again, a new session is started. For example: d7DEq/ANa7nNZZVD. | | TIMESTAMP | Type String Description The access time of Salesforce services in GMT. For example: 20130715233322.670. | | TIMESTAMP\_DERIVED | Type DateTime Description The access time of Salesforce services in ISO8601-compatible format (YYYY-MM-DDTHH:MM:SS.sssZ). For example: 2015-07-27T11:32:59.555Z. Timezone is GMT. | | URI | Type String Description The URI of the page that’s receiving the request. For example: /home/home.jsp. | | URI\_ID\_DERIVED | Type ID Description The 18-character case-safe ID of the URI of the page that’s receiving the request. | | USER\_ID | Type Id Description The 15-character ID of the user who’s using Salesforce services through the UI or the API. For example: 00530000009M943 | | USER\_ID\_DERIVED | Type Id Description The 18-character case-safe ID of the user who’s using Salesforce services through the UI or the API. For example: 00590000000I1SNIA0. | #### See Also - [_Salesforce Help_: Named Credentials](https://help.salesforce.com/articleView?id=xcloud.named_credentials_about.htm&type=5&language=en_US " Salesforce Help: Named Credentials - HTML (New Window)") - [EventLogFile Supported Event Types](https://developer.salesforce.com/docs/atlas.en-us.object_reference.meta/object_reference/sforce_api_objects_eventlogfile_supportedeventtypes.htm "The EventType field in the EventLogFile object supports these events. Some common fields, such as CPU_TIME and RUN_TIME, can have null or zero values depending on how the events are generated for a given feature. Sometimes, three quotation marks appear around event data containing special characters in the CSV file. The third quotation mark is necessary for tools and applications to parse the field data at the correct field value boundary.") - [EventLogFile](https://developer.salesforce.com/docs/atlas.en-us.object_reference.meta/object_reference/sforce_api_objects_eventlogfile.htm "Represents event log files generated by Event Monitoring. Use event log file data to analyze usage trends and user behavior in your Salesforce org. This object is available in API version 32.0 and later. The Interval and Sequence fields are available only in API version 37.0 and later.")