---
schema_version: "1"
id: 8e72a6f0ea4a4a1911302759bfbb96bd26060682df41b6e720504bfa6b4f89eb
title: Activity Log Site Event Type Reference
collection: tableau
version: next
locale: en-gb
portal_url: https://docs.salesforce.com/tableau/next/en-gb/server/activity_log_schema.md
canonical_url: https://help.tableau.com/v0.0/server/en-gb/activity_log_schema.htm
source_site: help.tableau.com
content_type: documentation
content_hash: 0787e3c7dc56c8856e498ae38e7280a6efcfe403fa5ada498d67ae053bfb5933
description: Reference of Activity Log site event types and attributes for auditing activity in Tableau Cloud.
---
[Skip to main content](#main-content)

# Activity Log Site Event Type Reference

This topic describes the Activity Log site event types and attributes.

## Event type details

The following content describes site event types and attributes in Activity Log. Use the alphabetically sorted list of event types on the right, or **ctrl/cmd-f** to go directly to keywords you have in mind.

**Note:** Timestamps for events are recorded in ISO 8601 UTC.

## Common attributes

The table contains common attributes for all Activity Log site events. For event-specific attributes, review the individual event tables in this topic.

<table class="simple-table" style="max-width: 100%;"><colgroup><col style="width: 20%;"><col style="width: 10%;"><col></colgroup><tbody><tr><th>Attribute Name</th><th>Type</th><th>Description</th></tr><tr><td>actorUserId</td><td>integer</td><td>ID of the user who performed the action that initiated the event</td></tr><tr><td>actorUserLuid</td><td>string</td><td>LUID of the user who performed the action that initiated the event</td></tr><tr><td>eventOutcome</td><td>string</td><td>Represents the final outcome of the operation. Possible values are:<ul><li><b>success:</b> The attempted operation was completed successfully.</li><li><b>unauthorised:</b> The initiating user wasn't authorised to perform the operation.</li><li><b>client_error:</b> The operation failed due to a cause attributable to the client/caller. For example, invalid API request parameters, client connection timeout or throttling.</li><li><b>internal_error:</b> The operation failed due to an unexpected internal error.</li></ul></td></tr><tr><td>eventOutcomeReason</td><td>string</td><td>Provides additional details about the event outcome</td></tr><tr><td>eventProcessedTime</td><td>string</td><td>Timestamp of when the event was available in Activity Log. This attribute applies to events written after the Hyperforce migration in January and February 2026. To see the timestamp for when the event occurred, use the <code>eventTime</code> attribute.</td></tr><tr><td>eventTime</td><td>string</td><td>Timestamp when the event occurred</td></tr><tr><td>initiatingUserId</td><td>integer</td><td>ID of the initiating user. This value is usually the same as <code>actorUserId</code> and differs only for delegated authentication, such as trusted tickets or impersonation. During impersonation, it’s the ID of the administrative user who initiated the session. When the session has no initiating user, or no session exists, <code>initiatingUserId</code> uses the value of <code>actorUserId</code>.</td></tr><tr><td>initiatingUserLuid</td><td>string</td><td>LUID of the initiating user. For impersonation, it's the LUID of the administrative user who initiated impersonation. For standard login, the value is the same as <code>actorUserLuid</code>.</td></tr><tr><td>licensingRoleName</td><td>string</td><td>Name of the user's licensing role when the event occurred</td></tr><tr><td>serviceName</td><td>string</td><td>Name of service that initiated the event, such as vizportal, vizqlserver or sitesaml.</td></tr><tr><td>siteLuid</td><td>string</td><td>LUID of the Tableau site where the event occurred</td></tr><tr><td>siteRoleId</td><td>integer</td><td>The user's site role ID. The value 0 = SiteAdministratorExplorer, 1 = SupportUser, 2 = ExplorerCanPublish, 3 = Explorer, 7 = Guest, 8 = Unlicensed, 9 = Viewer, 10 = Creator, and 11 = SiteAdministratorCreator.</td></tr><tr><td>systemAdminLevel</td><td>integer</td><td>Indicates if the user is a system administrator. The value 10 = System Admin and 0 = Not a system admin.</td></tr></tbody></table>

## add\_delete\_user\_to\_group

The `add_delete_user_to_group` event is logged when a user is added or removed from a group.

<table class="simple-table" style="max-width: 100%;"><colgroup><col style="width: 20%;"><col style="width: 10%;"><col></colgroup><tbody><tr><th>Attribute Name</th><th>Type</th><th>Description</th></tr><tr><td>groupID</td><td>integer</td><td>The ID of the group</td></tr><tr><td>groupLuid</td><td>string</td><td>The LUID of the group</td></tr><tr><td>groupOperation</td><td>string</td><td>Group operation, either add or delete user to a group</td></tr><tr><td>isError</td><td>boolean</td><td>Indicates if the audit scenario was completed successfully or failed with an error</td></tr><tr><td>userId</td><td>integer</td><td>The ID of the user</td></tr><tr><td>userLuid</td><td>string</td><td>The LUID of the user</td></tr></tbody></table>

## content\_owner\_change

The `content_owner_change` event is logged when the content owner changes.

<table class="simple-table" style="max-width: 100%;"><colgroup><col style="width: 20%;"><col style="width: 10%;"><col></colgroup><tbody><tr><th>Attribute Name</th><th>Type</th><th>Description</th></tr><tr><td>contentId</td><td>integer</td><td>The ID of the content that had the owner changed</td></tr><tr><td>contentLuid</td><td>string</td><td>LUID of the content that had the owner changed</td></tr><tr><td>contentName</td><td>string</td><td>Name of the content that had the owner changed</td></tr><tr><td>contentType</td><td>string</td><td>The type of content, such as data source, workbook or view</td></tr><tr><td>isError</td><td>boolean</td><td>Indicates if the audit scenario was completed successfully or failed with an error</td></tr><tr><td>newOwnerId</td><td>integer</td><td>The ID of the new content owner</td></tr><tr><td>newOwnerLuid</td><td>string</td><td>The LUID of the new content owner</td></tr><tr><td>oldOwnerId</td><td>integer</td><td>The ID of the old content owner</td></tr><tr><td>oldOwnerLuid</td><td>string</td><td>The LUID of the old content owner</td></tr></tbody></table>

## create\_delete\_group

The `create_delete_group` event is logged when a group is created or deleted.

<table class="simple-table" style="max-width: 100%;"><colgroup><col style="width: 20%;"><col style="width: 10%;"><col></colgroup><tbody><tr><th>Attribute Name</th><th>Type</th><th>Description</th></tr><tr><td>groupDomain</td><td>string</td><td>The domain of the group, such as local</td></tr><tr><td>groupID</td><td>integer</td><td>The ID of the group</td></tr><tr><td>groupLuid</td><td>string</td><td>The LUID of the group</td></tr><tr><td>groupName</td><td>string</td><td>The name of the group that had its permissions changed</td></tr><tr><td>groupOperation</td><td>string</td><td>Group operation, either create or delete</td></tr><tr><td>isError</td><td>boolean</td><td>Indicates if the audit scenario was completed successfully or failed with an error</td></tr></tbody></table>

## create\_permissions

The `create_permissions` event is logged when a new explicit permission rule is created.

**Note:** Deprecated in October 2024. Use the [set\_permissions](#set-permissions) event instead.

<table class="simple-table" style="max-width: 100%;"><colgroup><col style="width: 20%;"><col style="width: 10%;"><col></colgroup><tbody><tr><th>Attribute Name</th><th>Type</th><th>Description</th></tr><tr><td>authorisableType</td><td>string</td><td>The type of content that had its permissions changed, such as a project or workbook</td></tr><tr><td>capabilityId</td><td>integer</td><td>The ID of the capability. A capability is the ability to perform actions on content, such as view, filter, download or delete</td></tr><tr><td>capabilityValue</td><td>string</td><td>Description of the capability</td></tr><tr><td>contentId</td><td>integer</td><td>The ID of the content that had the permissions updated</td></tr><tr><td>contentLuid</td><td>string</td><td>The LUID of the content item</td></tr><tr><td>contentName</td><td>string</td><td>The name of the content that had the permissions updated</td></tr><tr><td>granteeId</td><td>integer</td><td>The ID of the grantee</td></tr><tr><td>granteeLuid</td><td>string</td><td>The LUID of the grantee</td></tr><tr><td>granteeType</td><td>string</td><td>The type of grantee, either user or group</td></tr><tr><td>granteeValue</td><td>string</td><td>The updated permissions value, such as 'user allow' or 'group allow'</td></tr><tr><td>isError</td><td>boolean</td><td>Indicates if the audit scenario was completed successfully or failed with an error</td></tr></tbody></table>

## delete\_all\_permissions

The `delete_all_permissions` event is logged when all explicit permission rules for content are deleted, typically when content is deleted.

<table class="simple-table" style="max-width: 100%;"><colgroup><col style="width: 20%;"><col style="width: 10%;"><col></colgroup><tbody><tr><th>Attribute Name</th><th>Type</th><th>Description</th></tr><tr><td>authorisableType</td><td>string</td><td>The type of content that had its permissions changed, such as a project or workbook</td></tr><tr><td>contentId</td><td>integer</td><td>The ID of the content that had the permissions updated</td></tr><tr><td>contentLuid</td><td>string</td><td>The LUID of the content</td></tr><tr><td>contentName</td><td>string</td><td>The name of the content that had the permissions updated</td></tr><tr><td>isError</td><td>boolean</td><td>Indicates if the audit scenario was completed successfully or failed with an error</td></tr></tbody></table>

## delete\_permissions

The `delete_permissions` event is logged when an explicit permission rule is removed from a content item through the REST API. For more information, see [Permissions Methods](https://help.tableau.com/current/api/rest_api/en-gb/REST/rest_api_ref_permissions.htm) in Tableau REST API Help.

Other ways of removing permissions are logged as different events:

- Removing a capability in the Permissions dialog is logged as a `set_permissions` event with a `permissionType` of `unspecified`, because the grantee’s entire permission set is replaced.
- Deleting content is logged as `delete_all_permissions`.
- Deleting a user or group is logged as `delete_permissions_grantee`.

To capture all permission removals, monitor `set_permissions`, `delete_all_permissions` and `delete_permissions_grantee`.

<table class="simple-table" style="max-width: 100%;"><colgroup><col style="width: 20%;"><col style="width: 10%;"><col></colgroup><tbody><tr><th>Attribute Name</th><th>Type</th><th>Description</th></tr><tr><td>authorisableType</td><td>string</td><td>The type of content that had its permissions changed, such as a project or workbook</td></tr><tr><td>capabilityId</td><td>integer</td><td>The ID of the capability. A capability is the ability to perform actions on content, such as view, filter, download or delete</td></tr><tr><td>capabilityValue</td><td>string</td><td>Description of the capability</td></tr><tr><td>contentId</td><td>integer</td><td>The ID of the content that had the permissions updated</td></tr><tr><td>contentLuid</td><td>string</td><td>The LUID of the content</td></tr><tr><td>contentName</td><td>string</td><td>The name of the content that had the permissions updated</td></tr><tr><td>granteeId</td><td>integer</td><td>The ID of the grantee</td></tr><tr><td>granteeLuid</td><td>string</td><td>The LUID of the grantee. This value can be null if the grantee was recently deleted or the LUID lookup service is unavailable. The <code>granteeId</code> attribute is always present.</td></tr><tr><td>granteeType</td><td>string</td><td>The type of grantee, either user or group</td></tr><tr><td>granteeValue</td><td>string</td><td>The updated permissions value, such as 'user allow' or 'group allow'</td></tr><tr><td>isError</td><td>boolean</td><td>Indicates if the audit scenario was completed successfully or failed with an error</td></tr></tbody></table>

## delete\_permissions\_grantee

The `delete_permissions_grantee` event is logged when all explicit permission rules for a user or group are deleted, typically when the user or group is deleted.

<table class="simple-table" style="max-width: 100%;"><colgroup><col style="width: 20%;"><col style="width: 10%;"><col></colgroup><tbody><tr><th>Attribute Name</th><th>Type</th><th>Description</th></tr><tr><td>granteeId</td><td>integer</td><td>The ID of the grantee</td></tr><tr><td>granteeLuid</td><td>string</td><td>The LUID of the grantee. This value can be null if the grantee was recently deleted or the LUID lookup service is unavailable. The <code>granteeId</code> attribute is always present.</td></tr><tr><td>granteeType</td><td>string</td><td>The type of grantee, either user or group</td></tr><tr><td>isError</td><td>boolean</td><td>Indicates if the audit scenario was completed successfully or failed with an error</td></tr></tbody></table>

## display\_sheet\_tabs

The `display_sheet_tabs` event is logged when the "Tabbed Views" value is updated on a workbook.

<table class="simple-table" style="max-width: 100%;"><colgroup><col style="width: 20%;"><col style="width: 10%;"><col></colgroup><tbody><tr><th>Attribute Name</th><th>Type</th><th>Description</th></tr><tr><td>displayTabs</td><td>boolean</td><td>Indicates whether sheets of the workbook are displayed as tabs or not</td></tr><tr><td>isError</td><td>boolean</td><td>Indicates if the audit scenario was completed successfully or failed with an error</td></tr><tr><td>workbookId</td><td>integer</td><td>The ID of the workbook</td></tr></tbody></table>

## move\_content

The `move_content` event is logged when content is moved, for example, moving a workbook between projects.

<table class="simple-table" style="max-width: 100%;"><colgroup><col style="width: 20%;"><col style="width: 10%;"><col></colgroup><tbody><tr><th>Attribute Name</th><th>Type</th><th>Description</th></tr><tr><td>contentId</td><td>integer</td><td>The ID of the content that had the owner changed</td></tr><tr><td>contentLuid</td><td>string</td><td>LUID of the content that had the owner changed</td></tr><tr><td>contentName</td><td>string</td><td>Name of the content that had the owner changed</td></tr><tr><td>contentType</td><td>string</td><td>The type of content, such as data source, workbook or view</td></tr><tr><td>isError</td><td>boolean</td><td>Indicates if the audit scenario was completed successfully or failed with an error</td></tr><tr><td>newContainerLuid</td><td>string</td><td>LUID of the new container</td></tr><tr><td>newContainerType</td><td>string</td><td>The new container type, such as a project</td></tr><tr><td>oldContainerLuid</td><td>string</td><td>LUID of the previous container</td></tr><tr><td>oldContainerType</td><td>string</td><td>The previous container type, such as a project</td></tr></tbody></table>

## project\_lock\_unlock

The `project_lock_unlock` event is logged when project permissions are locked or unlocked.

<table class="simple-table" style="max-width: 100%;"><colgroup><col style="width: 20%;"><col style="width: 10%;"><col></colgroup><tbody><tr><th>Attribute Name</th><th>Type</th><th>Description</th></tr><tr><td>controllingProjectLuid</td><td>string</td><td>LUID of the project that controls permissions for the nested project</td></tr><tr><td>isError</td><td>boolean</td><td>Indicates if the audit scenario was completed successfully or failed with an error</td></tr><tr><td>projectLuid</td><td>string</td><td>LUID of the project</td></tr><tr><td>projectOperation</td><td>string</td><td>Project operation, either lock or unlock</td></tr></tbody></table>

## set\_permissions

The `set_permissions` event is logged when a permission rule is created or updated for a content item, typically when you save changes in the Permissions dialog. Removing a permission rule is also logged as this event, with a `permissionType` of `unspecified`.

<table class="simple-table" style="max-width: 100%;"><colgroup><col style="width: 20%;"><col style="width: 10%;"><col></colgroup><tbody><tr><th>Attribute Name</th><th>Type</th><th>Description</th></tr><tr><td>authorisableType</td><td>string</td><td><p>The type of content that had its permissions changed, such as project or workbook</p></td></tr><tr><td>capabilityId</td><td>integer</td><td>The ID of the capability. A capability is the ability to perform a certain action on a particular piece of content, such as view, filter, download or delete.</td></tr><tr><td>capabilityValue</td><td>string</td><td>Description of the capability</td></tr><tr><td>contentId</td><td>integer</td><td>The ID of the content that had the permissions set</td></tr><tr><td>contentLuid</td><td>string</td><td>The LUID of the content item</td></tr><tr><td>contentName</td><td>string</td><td>The name of the content that had the permissions set</td></tr><tr><td>granteeId</td><td>integer</td><td>The ID of the grantee</td></tr><tr><td>granteeLuid</td><td>string</td><td>The LUID of the grantee. This value can be null if the grantee was recently deleted or the LUID lookup service is unavailable. The <code>granteeId</code> attribute is always present.</td></tr><tr><td>granteeType</td><td>string</td><td>The type of grantee, either user or group</td></tr><tr><td>granteeValue</td><td>string</td><td>The set permissions value, such as “user allow” or “group allow”</td></tr><tr><td>isError</td><td>boolean</td><td>Indicates if the audit scenario was completed successfully or failed with an error</td></tr><tr><td>permissionType</td><td>string</td><td>The permission type. A value of <code>explicit</code> means an Allow or Deny rule was set. A value of <code>unspecified</code> means a rule was removed or set to inherited.</td></tr></tbody></table>

## update\_permissions

The `update_permissions` event is logged when an explicit permission rule is updated for a content item.

**Note:** Deprecated in October 2024. Use the [set\_permissions](#set-permissions) event instead.

<table class="simple-table" style="max-width: 100%;"><colgroup><col style="width: 20%;"><col style="width: 10%;"><col></colgroup><tbody><tr><th>Attribute Name</th><th>Type</th><th>Description</th></tr><tr><td>authorisableType</td><td>string</td><td>The type of content that had its permissions changed, such as a project or workbook</td></tr><tr><td>capabilityId</td><td>integer</td><td>The ID of the capability. A capability is the ability to perform actions on content, such as view, filter, download or delete</td></tr><tr><td>capabilityValue</td><td>string</td><td>Description of the capability</td></tr><tr><td>contentId</td><td>integer</td><td>The ID of the content that had the permissions updated</td></tr><tr><td>contentLuid</td><td>string</td><td>The LUID of the content</td></tr><tr><td>contentName</td><td>string</td><td>The name of the content that had the permissions updated</td></tr><tr><td>granteeId</td><td>integer</td><td>The ID of the grantee</td></tr><tr><td>granteeLuid</td><td>string</td><td>The LUID of the grantee</td></tr><tr><td>granteeType</td><td>string</td><td>The type of grantee, either user or group</td></tr><tr><td>granteeValue</td><td>string</td><td>The updated permissions value, such as 'user allow' or 'group allow'</td></tr><tr><td>isError</td><td>boolean</td><td>Indicates if the audit scenario was completed successfully or failed with an error</td></tr><tr><td>permissionType</td><td>string</td><td>The permission type, either explicit or unspecified</td></tr></tbody></table>

## update\_permissions\_template

The `update_permissions_template` event is logged when a permission template for a project is updated.

<table class="simple-table" style="max-width: 100%;"><colgroup><col style="width: 20%;"><col style="width: 10%;"><col></colgroup><tbody><tr><th>Attribute Name</th><th>Type</th><th>Description</th></tr><tr><td>authorisableType</td><td>string</td><td>The type of content that had its permissions changed, such as a project or workbook</td></tr><tr><td>capabilityId</td><td>integer</td><td>The ID of the capability. A capability is the ability to perform actions on content, such as view, filter, download or delete</td></tr><tr><td>capabilityValue</td><td>string</td><td>Description of the capability</td></tr><tr><td>contentId</td><td>integer</td><td>The ID of the content that had the permissions updated</td></tr><tr><td>contentLuid</td><td>string</td><td>The LUID of the content</td></tr><tr><td>contentName</td><td>string</td><td>The name of the content that had the permissions updated</td></tr><tr><td>granteeId</td><td>integer</td><td>The ID of the grantee</td></tr><tr><td>granteeLuid</td><td>string</td><td>The LUID of the grantee. This value can be null if the grantee was recently deleted or the LUID lookup service is unavailable. The <code>granteeId</code> attribute is always present.</td></tr><tr><td>granteeType</td><td>string</td><td>The type of grantee, either user or group</td></tr><tr><td>granteeValue</td><td>string</td><td>The updated permissions value, such as 'user allow' or 'group allow'</td></tr><tr><td>isError</td><td>boolean</td><td>Indicates if the audit scenario was completed successfully or failed with an error</td></tr><tr><td>permissionType</td><td>string</td><td>The permission type. A value of <code>explicit</code> means an Allow or Deny rule was set. A value of <code>unspecified</code> means a rule was removed or set to inherited.</td></tr><tr><td>templateType</td><td>string</td><td>The type of permission template used to change permissions, such as workbook or data source</td></tr></tbody></table>

## user\_create\_delete

The `user_create_delete` event is logged when a user is created or deleted.

<table class="simple-table" style="max-width: 100%;"><colgroup><col style="width: 20%;"><col style="width: 10%;"><col></colgroup><tbody><tr><th>Attribute Name</th><th>Type</th><th>Description</th></tr><tr><td>forUserName</td><td>string</td><td>The name of the user whose account was either created, updated or deleted</td></tr><tr><td>isError</td><td>boolean</td><td>Indicates if the audit scenario was completed successfully or failed with an error</td></tr><tr><td>siteRole</td><td>string</td><td>Site role of the user. Determines the maximum level of access a user can have on the site</td></tr><tr><td>targetUserId</td><td>integer</td><td>The ID of the user whose account was either created, updated or deleted</td></tr><tr><td>targetUserLuid</td><td>string</td><td>The LUID of the user whose account was either created, updated or deleted</td></tr><tr><td>userOperation</td><td>string</td><td>The action performed on a user, either create, delete or site role change</td></tr></tbody></table>