---
schema_version: "1"
id: 19f1ed703083e90ffef6d8fbd622d9bc6cfcc8c3a03ab5c348c1f131b76a3f89
title: Activity Log Tenant Event Type Reference
collection: tableau
version: next
locale: en-us
portal_url: https://docs.salesforce.com/tableau/next/en-us/online/activity_log_tenant_schema.md
canonical_url: https://help.tableau.com/v0.0/online/en-us/activity_log_tenant_schema.htm
source_site: help.tableau.com
content_type: documentation
content_hash: e53621f290ae300530130d79a4566760e2e5c84a239b43543043e1ea4e468dc6
description: Reference of Activity Log tenant event types and attributes for auditing activity in Tableau Cloud.
---
[Skip to main content](#main-content)

# Activity Log Tenant Event Type Reference

This topic describes the Activity Log tenant event types and attributes. For information about site events, see [Activity Log Site Event Type Reference](https://help.tableau.com/v0.0/online/en-us/activity_log_schema.htm).

## Event type details

The following content describes tenant event types and attributes in Activity Log. Use the alphabetically sorted list of event types on the right, or **ctrl/cmd-f** to go directly to keywords you have in mind.

**Note:** Timestamps for events are recorded in ISO 8601 UTC.

## Common attributes

The table contains common attributes for all Activity Log tenant events. For event-specific attributes, review the individual event tables in this topic.

<table class="simple-table" style="max-width: 100%;">
                    <colgroup><col style="width: 20%;">
                    <col style="width: 10%;">
                    <col>
                    </colgroup><tbody>
                        <tr>
                            <th>Attribute Name</th>
                            <th>Type</th>
                            <th>Description</th>
                        </tr>
                        <tr>
                            <td>eventId</td>
                            <td>string</td>
                            <td>Unique identifier for the event</td>
                        </tr>
                        <tr>
                            <td>eventOutcome</td>
                            <td>string</td>
                            <td>
						Represents the final outcome of the operation. Possible values are:
						<ul><li><b>success:</b> The attempted operation completed successfully.</li><li><b>unauthorized:</b> The initiating user wasn't authorized to perform the operation.</li><li><b>client_error:</b> The operation failed due to a cause attributable to the client/caller. For example, invalid API request parameters, client connection timeout, or throttling.</li><li><b>internal_error:</b> The operation failed due to an unexpected internal error.</li></ul></td>
                        </tr>
                        <tr>
                            <td>eventOutcomeReason</td>
                            <td>string</td>
                            <td>Provides additional details about the event outcome</td>
                        </tr>
                        <tr>
                            <td>eventProcessedTime</td>
                            <td>string</td>
                            <td>Timestamp of when the event was available in Activity Log. To see the timestamp for when the event occurred, use the <code>eventTime</code> attribute.</td>
                        </tr>
                        <tr>
                            <td>eventTime</td>
                            <td>string</td>
                            <td>Timestamp when the event occurred</td>
                        </tr>
                        <tr>
                            <td>eventType</td>
                            <td>string</td>
                            <td>Type of the event</td>
                        </tr>
                        <tr>
                            <td>eventVersion</td>
                            <td>string</td>
                            <td>Schema version of the event</td>
                        </tr>
                        <tr>
                            <td>initiatingSessionId</td>
                            <td>string</td>
                            <td>ID of user's session which initiated the operation</td>
                        </tr>
                        <tr>
                            <td>initiatingUrl</td>
                            <td>string</td>
                            <td>URL associated with the request that initiated the operation, such as the URL of a REST API endpoint that was invoked.</td>
                        </tr>
                        <tr>
                            <td>initiatingUserAgent</td>
                            <td>string</td>
                            <td>User-Agent HTTP header associated with the request that initiated the operation</td>
                        </tr>
                        <tr>
                            <td>initiatingUserDisplayName</td>
                            <td>string</td>
                            <td>Display name of the user who initiated the operation</td>
                        </tr>
                        <tr>
                            <td>initiatingUserEmail</td>
                            <td>string</td>
                            <td>Email address of the user who initiated the operation</td>
                        </tr>
                        <tr>
                            <td>initiatingUserId</td>
                            <td>string</td>
                            <td>ID of the user who initiated the operation</td>
                        </tr>
                        <tr>
                            <td>initiatingUserIpAddress</td>
                            <td>string</td>
                            <td>Remote client IP address of the request that initiated the operation. Either a valid IPv4 or IPv6 address.</td>
                        </tr>
                        <tr>
                            <td>initiatingUserRole</td>
                            <td>string</td>
                            <td>Role or privilege level that allowed the initiating user to perform the operation</td>
                        </tr>
                        <tr>
                            <td>podUri</td>
                            <td>string</td>
                            <td>Uniform Resource Identifier (URI) of pod where the operation occurred</td>
                        </tr>
                        <tr>
                            <td>siteId</td>
                            <td>string</td>
                            <td>ID of site where the operation occurred</td>
                        </tr>
                        <tr>
                            <td>siteName</td>
                            <td>string</td>
                            <td>Name of site where the operation occurred</td>
                        </tr>
                        <tr>
                            <td>siteUri</td>
                            <td>string</td>
                            <td>Uniform Resource Identifier (URI) of site where the operation occurred</td>
                        </tr>
                        <tr>
                            <td>tenantId</td>
                            <td>string</td>
                            <td>ID of tenant where the operation occurred</td>
                        </tr>
                        <tr>
                            <td>tenantName</td>
                            <td>string</td>
                            <td>Name of tenant where the operation occurred</td>
                        </tr>
                        <tr>
                            <td>tenantUri</td>
                            <td>string</td>
                            <td>Uniform Resource Identifier (URI) of tenant where the operation occurred</td>
                        </tr>
                        <tr>
                            <td>traceUuid</td>
                            <td>string</td>
                            <td>Auto-generated UUID identical across all the events in a batch, such as multiple permissions changed by a single user action.</td>
                        </tr>
                    </tbody>
                </table>

## batch\_revoke\_personal\_access\_token

The `batch_revoke_personal_access_token` event occurs when a tenant is suspended or deleted, or a user is removed​​.

<table class="simple-table" style="max-width: 100%;"><colgroup><col style="width: 20%;"> <col style="width: 10%;"> <col></colgroup><tbody><tr><th>Attribute Name</th><th>Type</th><th>Description</th></tr><tr><td>patUserId</td><td>string</td><td>ID of the user whose PATs were revoked. Not included if PATs were revoked for the entire tenant.</td></tr></tbody></table>

## batch\_revoke\_session

The `batch_revoke_sessions` event occurs when all sessions associated with a tenant or user are revoked.

<table class="simple-table" style="max-width: 100%;"><colgroup><col style="width: 20%;"> <col style="width: 10%;"> <col></colgroup><tbody><tr><th>Attribute Name</th><th>Type</th><th>Description</th></tr><tr><td>sessionUserId</td><td>string</td><td>ID of the user whose sessions were revoked. Not included if sessions were revoked for the entire tenant.</td></tr></tbody></table>

## create\_or\_update\_oidc\_config

The `create_or_update_oidc_config` event occurs when the OIDC configuration is changed.

<table class="simple-table" style="max-width: 100%;"><colgroup><col style="width: 20%;"> <col style="width: 10%;"> <col></colgroup><tbody><tr><th>Attribute Name</th><th>Type</th><th>Description</th></tr><tr><td>isSecretUpdated</td><td>bool</td><td>Indicates whether the secret has been updated. The actual secret value isn't recorded. This attribute helps admins track changes in their organization, such as those affecting system functionality or ensuring scheduled secret rotations are carried out properly.</td></tr><tr><td>newSettingsValue</td><td>string</td><td>New OIDC configuration settings</td></tr><tr><td>oldSettingsValue</td><td>string</td><td>Previous OIDC configuration settings</td></tr><tr><td>resourceId</td><td>string</td><td>Resource ID of an OIDC configuration</td></tr></tbody></table>

## create\_or\_update\_saml\_config

The `create_or_update_saml_config` event occurs when the SAML configuration is changed.

<table class="simple-table" style="max-width: 100%;"><colgroup><col style="width: 20%;"> <col style="width: 10%;"> <col></colgroup><tbody><tr><th>Attribute Name</th><th>Type</th><th>Description</th></tr><tr><td>newSettingsValue</td><td>string</td><td>New SAML configuration settings</td></tr><tr><td>oldSettingsValue</td><td>string</td><td>Previous SAML configuration settings</td></tr><tr><td>resourceId</td><td>string</td><td>Resource ID of a SAML configuration</td></tr></tbody></table>

## create\_or\_update\_uat\_configuration

The `create_or_update_uat_configuration` event occurs when changes are made to Unified Access Token (UAT) JSON Web Token (JWT) configuration. This event is used to track changes for security compliance and troubleshooting.

<table class="simple-table" style="max-width: 100%;"><colgroup><col style="width: 20%;"> <col style="width: 10%;"> <col></colgroup><tbody><tr><th>Attribute Name</th><th>Type</th><th>Description</th></tr><tr><td>configId</td><td>string</td><td>Unique identifier (UUID) of the UAT JWT configuration</td></tr><tr><td>isSecretUpdated</td><td>bool</td><td>Indicates whether the secret has been updated. The actual secret value isn't recorded. This attribute helps admins track changes to public key or jwks_uri values.</td></tr><tr><td>issuer</td><td>string</td><td>JWT issuer claim value. Used to identify the IdP affected by the configuration change.</td></tr><tr><td>newSettingsValue</td><td>string</td><td>New UAT JWT configuration settings. The values are JSON serialized and exclude sensitive keys, such as publicKey and publicKeyActive.</td></tr><tr><td>oldSettingsValue</td><td>string</td><td>Previous UAT JWT configuration settings. The values are JSON serialized and exclude sensitive keys, such as publicKey and publicKeyActive.</td></tr></tbody></table>

## create\_personal\_access\_token

The `create_personal_access_token` event occurs when a personal access token (PAT) is generated.

<table class="simple-table" style="max-width: 100%;"><colgroup><col style="width: 20%;"> <col style="width: 10%;"> <col></colgroup><tbody><tr><th>Attribute Name</th><th>Type</th><th>Description</th></tr><tr><td>expiresAt</td><td>string</td><td>Timestamp when the PAT expires. Not included if the creation attempt failed.</td></tr><tr><td>tokenId</td><td>string</td><td>ID of the PAT created. Not included if the creation attempt failed.</td></tr><tr><td>tokenName</td><td>string</td><td>Name of the PAT</td></tr></tbody></table>

## create\_private\_connection

The `create_private_connection` event occurs when a private connection is created.

<table class="simple-table" style="max-width: 100%;"><colgroup><col style="width: 20%;"> <col style="width: 10%;"> <col></colgroup><tbody><tr><th>Attribute Name</th><th>Type</th><th>Description</th></tr><tr><td>description</td><td>string</td><td>Description of the private connection</td></tr><tr><td>endpointServiceName</td><td>string</td><td>AWS endpoint service name of the private connection</td></tr><tr><td>name</td><td>string</td><td>Name of the private connection</td></tr><tr><td>privateConnectionId</td><td>string</td><td>ID of the created private connection</td></tr><tr><td>region</td><td>string</td><td>AWS region where the private connection is created</td></tr></tbody></table>

## create\_site

The `create_site` event occurs when a site is created in a tenant.

<table class="simple-table" style="max-width: 100%;">
                        <colgroup><col style="width: 20%;">
                        <col style="width: 10%;">
                        <col>
                        </colgroup><tbody>
                            <tr>
                                <th>Attribute Name</th>
                                <th>Type</th>
                                <th>Description</th>
                            </tr>
                            <tr>
                                <td colspan="3">This event only uses common attributes. For more information, see the <a href="#common-attributes">Common attributes</a> section in this topic.</td>
                            </tr>
                        </tbody>
                    </table>

## create\_tenant

The `create_tenant` event occurs when a tenant is created.

<table class="simple-table" style="max-width: 100%;">
                        <colgroup><col style="width: 20%;">
                        <col style="width: 10%;">
                        <col>
                        </colgroup><tbody>
                            <tr>
                                <th>Attribute Name</th>
                                <th>Type</th>
                                <th>Description</th>
                            </tr>
                            <tr>
                                <td colspan="3">This event only uses common attributes. For more information, see the <a href="#common-attributes">Common attributes</a> section in this topic.</td>
                            </tr>
                        </tbody>
                    </table>

## create\_user

The `create_user` event occurs when a new user is created in a tenant.

<table class="simple-table" style="max-width: 100%;"><colgroup><col style="width: 20%;"> <col style="width: 10%;"> <col></colgroup><tbody><tr><th>Attribute Name</th><th>Type</th><th>Description</th></tr><tr><td>email</td><td>string</td><td>Email of the user added to the tenant</td></tr><tr><td>language</td><td>string</td><td>Language code of the user added to the tenant</td></tr><tr><td>locale</td><td>string</td><td>Locale code of the user added to the tenant</td></tr><tr><td>userId</td><td>string</td><td>Unique identifier of the user added to the tenant</td></tr><tr><td>userName</td><td>string</td><td>User name of the user added to the tenant</td></tr></tbody></table>

## create\_uat\_revocation

The `create_uat_revocation` event occurs when a JSON Web Token (JWT) is added to the blocked list. This event is used to track changes for security compliance and access control.

<table class="simple-table" style="max-width: 100%;"><colgroup><col style="width: 20%;"> <col style="width: 10%;"> <col></colgroup><tbody><tr><th>Attribute Name</th><th>Type</th><th>Description</th></tr><tr><td>revokedJwtRecords</td><td>string</td><td>JSON array of JWT records added to the blocked list. Each record contains 'jti' (JWT ID) and 'exp' (expiration timestamp in Unix epoch seconds).</td></tr></tbody></table>

## delete\_oidc\_config

The `delete_oidc_config` event occurs when the OIDC configuration is deleted.

<table class="simple-table" style="max-width: 100%;"><colgroup><col style="width: 20%;"> <col style="width: 10%;"> <col></colgroup><tbody><tr><th>Attribute Name</th><th>Type</th><th>Description</th></tr><tr><td>idpConfigurationId</td><td>string</td><td>ID of the IdP configuration</td></tr><tr><td>idpConfigurationName</td><td>string</td><td>Name of the IdP configuration</td></tr><tr><td>resourceId</td><td>string</td><td>Resource ID of the OIDC configuration</td></tr></tbody></table>

## delete\_private\_connection

The `delete_private_connection` event occurs when a private connection is deleted in a tenant.

<table class="simple-table" style="max-width: 100%;"><colgroup><col style="width: 20%;"> <col style="width: 10%;"> <col></colgroup><tbody><tr><th>Attribute Name</th><th>Type</th><th>Description</th></tr><tr><td>privateConnectionId</td><td>string</td><td>ID of the deleted private connection</td></tr></tbody></table>

## delete\_saml\_config

The `delete_saml_config` event occurs when the SAML configuration is deleted.

<table class="simple-table" style="max-width: 100%;"><colgroup><col style="width: 20%;"> <col style="width: 10%;"> <col></colgroup><tbody><tr><th>Attribute Name</th><th>Type</th><th>Description</th></tr><tr><td>idpConfigurationId</td><td>string</td><td>ID of the IdP configuration</td></tr><tr><td>idpConfigurationName</td><td>string</td><td>Name of the IdP configuration</td></tr><tr><td>resourceId</td><td>string</td><td>Resource ID of the SAML configuration</td></tr></tbody></table>

## delete\_site

The `delete_site` event occurs when a site is deleted from a tenant.

<table class="simple-table" style="max-width: 100%;">
                        <colgroup><col style="width: 20%;">
                        <col style="width: 10%;">
                        <col>
                        </colgroup><tbody>
                            <tr>
                                <th>Attribute Name</th>
                                <th>Type</th>
                                <th>Description</th>
                            </tr>
                            <tr>
                                <td colspan="3">This event only uses common attributes. For more information, see the <a href="#common-attributes">Common attributes</a> section in this topic.</td>
                            </tr>
                        </tbody>
                    </table>

## delete\_tenant

The `delete_tenant` event occurs when a tenant is deleted.

<table class="simple-table" style="max-width: 100%;">
                        <colgroup><col style="width: 20%;">
                        <col style="width: 10%;">
                        <col>
                        </colgroup><tbody>
                            <tr>
                                <th>Attribute Name</th>
                                <th>Type</th>
                                <th>Description</th>
                            </tr>
                            <tr>
                                <td colspan="3">This event only uses common attributes. For more information, see the <a href="#common-attributes">Common attributes</a> section in this topic.</td>
                            </tr>
                        </tbody>
                    </table>

## delete\_user

The `delete_user` event occurs when a user is deleted from a tenant.

<table class="simple-table" style="max-width: 100%;"><colgroup><col style="width: 20%;"> <col style="width: 10%;"> <col></colgroup><tbody><tr><th>Attribute Name</th><th>Type</th><th>Description</th></tr><tr><td>email</td><td>string</td><td>Email of the user removed</td></tr><tr><td>userId</td><td>string</td><td>ID of the user removed</td></tr><tr><td>userName</td><td>string</td><td>User name of the user removed</td></tr></tbody></table>

## delete\_uat\_configuration

The `delete_uat_configuration` event occurs when a JSON Web Token (JWT) configuration is removed for an identity provider (IdP). This event is used to track changes for security compliance and access monitoring.

<table class="simple-table" style="max-width: 100%;"><colgroup><col style="width: 20%;"> <col style="width: 10%;"> <col></colgroup><tbody><tr><th>Attribute Name</th><th>Type</th><th>Description</th></tr><tr><td>configId</td><td>string</td><td>Unique identifier (UUID) of the deleted UAT JWT configuration</td></tr><tr><td>issuer</td><td>string</td><td>JWT issuer claim value of the deleted configuration. Used to identify the affected IdP.</td></tr></tbody></table>

## delete\_uat\_revocation

The `delete_uat_revocation` event occurs when a JSON Web Token (JWT) is deleted from the blocked list.

<table class="simple-table" style="max-width: 100%;"><colgroup><col style="width: 20%;"> <col style="width: 10%;"> <col></colgroup><tbody><tr><th>Attribute Name</th><th>Type</th><th>Description</th></tr><tr><td>jti</td><td>string</td><td>JWT ID deleted from the blocked list</td></tr></tbody></table>

## get\_sites

The `get_sites` event occurs when a list of sites under a tenant is requested.

<table class="simple-table" style="max-width: 100%;">
                        <colgroup><col style="width: 20%;">
                        <col style="width: 10%;">
                        <col>
                        </colgroup><tbody>
                            <tr>
                                <th>Attribute Name</th>
                                <th>Type</th>
                                <th>Description</th>
                            </tr>
                            <tr>
                                <td colspan="3">This event only uses common attributes. For more information, see the <a href="#common-attributes">Common attributes</a> section in this topic.</td>
                            </tr>
                        </tbody>
                    </table>

## get\_users

The `get_user` event occurs when a list of users within a tenant or site is requested.

<table class="simple-table" style="max-width: 100%;">
                        <colgroup><col style="width: 20%;">
                        <col style="width: 10%;">
                        <col>
                        </colgroup><tbody>
                            <tr>
                                <th>Attribute Name</th>
                                <th>Type</th>
                                <th>Description</th>
                            </tr>
                            <tr>
                                <td colspan="3">This event only uses common attributes. For more information, see the <a href="#common-attributes">Common attributes</a> section in this topic.</td>
                            </tr>
                        </tbody>
                    </table>

## jwt\_login

The `jwt_login` event occurs when signing in to Tableau Cloud Manager (TCM) using a JSON Web Token (JWT).

<table class="simple-table" style="max-width: 100%;"><colgroup><col style="width: 20%;"> <col style="width: 10%;"> <col></colgroup><tbody><tr><th>Attribute Name</th><th>Type</th><th>Description</th></tr><tr><td>jti</td><td>string</td><td>JWT ID claim. Used to track the token when signing in to TCM.</td></tr><tr><td>jwtType</td><td>string</td><td>Type of JWT used for the login request</td></tr><tr><td>newSessionId</td><td>string</td><td>ID of the session created by the login request. This attribute isn't included for failed login attempts.</td></tr></tbody></table>

## list\_personal\_access\_tokens

The `list_personal_access_tokens` event occurs when all valid personal access tokens (PATs) in Tableau Cloud Manager (TCM) are requested.

<table class="simple-table" style="max-width: 100%;">
                        <colgroup><col style="width: 20%;">
                        <col style="width: 10%;">
                        <col>
                        </colgroup><tbody>
                            <tr>
                                <th>Attribute Name</th>
                                <th>Type</th>
                                <th>Description</th>
                            </tr>
                            <tr>
                                <td colspan="3">This event only uses common attributes. For more information, see the <a href="#common-attributes">Common attributes</a> section in this topic.</td>
                            </tr>
                        </tbody>
                    </table>

## merge\_tenant

The `merge_tenant` event occurs when a Tableau Cloud Manager tenant is merged into another tenant. This consolidation allows cloud admins to manage all sites under one tenant and benefit from unified governance.

<table class="simple-table" style="max-width: 100%;"><colgroup><col style="width: 20%;"> <col style="width: 10%;"> <col></colgroup><tbody><tr><th>Attribute Name</th><th>Type</th><th>Description</th></tr><tr><td>sourceTenantId</td><td>string</td><td>ID of source tenant in the merge operation</td></tr><tr><td>sourceTenantName</td><td>string</td><td>Name of the source tenant in the merge operation</td></tr><tr><td>sourceTenantUri</td><td>string</td><td>Uniform Resource Identifier (URI) of the source tenant in the merge operation</td></tr></tbody></table>

## migrate\_site

The `migrate_site` event occurs when a site is migrated to a tenant.

<table class="simple-table" style="max-width: 100%;">
                        <colgroup><col style="width: 20%;">
                        <col style="width: 10%;">
                        <col>
                        </colgroup><tbody>
                            <tr>
                                <th>Attribute Name</th>
                                <th>Type</th>
                                <th>Description</th>
                            </tr>
                            <tr>
                                <td colspan="3">This event only uses common attributes. For more information, see the <a href="#common-attributes">Common attributes</a> section in this topic.</td>
                            </tr>
                        </tbody>
                    </table>

## personal\_access\_token\_login

The `personal_access_token_login` event occurs when a personal access token (PAT) is used to sign in to Tableau Cloud Manager.

<table class="simple-table" style="max-width: 100%;"><colgroup><col style="width: 20%;"> <col style="width: 10%;"> <col></colgroup><tbody><tr><th>Attribute Name</th><th>Type</th><th>Description</th></tr><tr><td>newSessionId</td><td>string</td><td>ID of the session created by this login request. Not included if the login failed.</td></tr><tr><td>tokenId</td><td>string</td><td>ID of the PAT used to login</td></tr><tr><td>tokenName</td><td>string</td><td>Name of the PAT</td></tr></tbody></table>

## reactivate\_site

The `reactivate_site` event occurs when a site in a tenant is reactivated.

<table class="simple-table" style="max-width: 100%;">
                        <colgroup><col style="width: 20%;">
                        <col style="width: 10%;">
                        <col>
                        </colgroup><tbody>
                            <tr>
                                <th>Attribute Name</th>
                                <th>Type</th>
                                <th>Description</th>
                            </tr>
                            <tr>
                                <td colspan="3">This event only uses common attributes. For more information, see the <a href="#common-attributes">Common attributes</a> section in this topic.</td>
                            </tr>
                        </tbody>
                    </table>

## revoke\_personal\_access\_token

The `revoke_personal_access_token` event occurs when a personal access token (PAT) is revoked in Tableau Cloud Manager.

<table class="simple-table" style="max-width: 100%;"><colgroup><col style="width: 20%;"> <col style="width: 10%;"> <col></colgroup><tbody><tr><th>Attribute Name</th><th>Type</th><th>Description</th></tr><tr><td>tokenId</td><td>string</td><td>ID of the PAT revoked</td></tr><tr><td>tokenName</td><td>string</td><td>Name of the PAT</td></tr></tbody></table>

## revoke\_session

The `revoke_session` event occurs when a user is logged out due to a revoked session, such as a user explicitly logging out or the session expiring.

<table class="simple-table" style="max-width: 100%;">
                        <colgroup><col style="width: 20%;">
                        <col style="width: 10%;">
                        <col>
                        </colgroup><tbody>
                            <tr>
                                <th>Attribute Name</th>
                                <th>Type</th>
                                <th>Description</th>
                            </tr>
                            <tr>
                                <td colspan="3">This event only uses common attributes. For more information, see the <a href="#common-attributes">Common attributes</a> section in this topic.</td>
                            </tr>
                        </tbody>
                    </table>

## site\_capacity\_change

The `site_capacity_change` event occurs when the capacity allocation for a specific site is changed. Each event applies to a single capacity type. Changing multiple capacities produces a separate event for each.

<table class="simple-table" style="max-width: 100%;"><colgroup><col style="width: 20%;"> <col style="width: 10%;"> <col></colgroup><tbody><tr><th>Attribute Name</th><th>Type</th><th>Description</th></tr><tr><td>capacityName</td><td>string</td><td>Canonical name of the capacity type that was changed</td></tr><tr><td>newCapacityAmount</td><td>integer</td><td>New capacity amount allocated to the site</td></tr><tr><td>oldCapacityAmount</td><td>integer</td><td>Previous capacity amount allocated to the site</td></tr></tbody></table>

## site\_capacity\_default\_change

The `site_capacity_default_change` event occurs when the default site capacity allocation is changed at the tenant level. The default applies to new sites added to the tenant and doesn't change existing sites. Because the change sets the tenant default rather than modifying a specific site, the `siteId`, `siteName`, and `siteUri` attributes are null.

<table class="simple-table" style="max-width: 100%;"><colgroup><col style="width: 20%;"> <col style="width: 10%;"> <col></colgroup><tbody><tr><th>Attribute Name</th><th>Type</th><th>Description</th></tr><tr><td>capacityName</td><td>string</td><td>Canonical name of the capacity type that was changed</td></tr><tr><td>newCapacityAmount</td><td>integer</td><td>New default capacity amount</td></tr><tr><td>oldCapacityAmount</td><td>integer</td><td>Previous default capacity amount</td></tr></tbody></table>

## site\_limits\_change

The `site_limits_change` event occurs when site-level license capacity limits for site roles (Creator, Explorer, or Viewer) are changed.

<table class="simple-table" style="max-width: 100%;"><colgroup><col style="width: 20%;"> <col style="width: 10%;"> <col></colgroup><tbody><tr><th>Attribute Name</th><th>Type</th><th>Description</th></tr><tr><td>newCreatorCapacity</td><td>integer</td><td>New value for the Creator site role limit. Not included if the new limit is the default cloud limit.</td></tr><tr><td>newCreatorCapacityIsDefaultCloudLimit</td><td>bool</td><td>New Creator limit was set to the default cloud limit</td></tr><tr><td>newExplorerCapacity</td><td>integer</td><td>New value for the Explorer site role limit. Not included if the new limit is the default cloud limit.</td></tr><tr><td>newExplorerCapacityIsDefaultCloudLimit</td><td>bool</td><td>New Explorer limit is set to the default cloud limit</td></tr><tr><td>newViewerCapacity</td><td>integer</td><td>New value for the Viewer site role limit. Not included if the new limit is the default cloud limit.</td></tr><tr><td>newViewerCapacityIsDefaultCloudLimit</td><td>bool</td><td>New Viewer limit is set to the default cloud limit</td></tr><tr><td>oldCreatorCapacity</td><td>integer</td><td>Previous value for the Creator site role limit. Not included if the previous limit was the default cloud limit.</td></tr><tr><td>oldCreatorCapacityIsDefaultCloudLimit</td><td>bool</td><td>Previous Creator limit was set to the default cloud limit</td></tr><tr><td>oldExplorerCapacity</td><td>integer</td><td>Previous value for the Explorer site role limit. Not included if the previous limit was the default cloud limit.</td></tr><tr><td>oldExplorerCapacityIsDefaultCloudLimit</td><td>bool</td><td>Previous Explorer limit was set to the default cloud limit</td></tr><tr><td>oldViewerCapacity</td><td>integer</td><td>Previous value for the Viewer site role limit. Not included if the previous limit was the default cloud limit.</td></tr><tr><td>oldViewerCapacityIsDefaultCloudLimit</td><td>bool</td><td>Previous Viewer limit was set to the default cloud limit</td></tr></tbody></table>

## suspend\_site

The `suspend_site` event occurs when a site in a tenant is suspended.

<table class="simple-table" style="max-width: 100%;"><colgroup><col style="width: 20%;"> <col style="width: 10%;"> <col></colgroup><tbody><tr><th>Attribute Name</th><th>Type</th><th>Description</th></tr><tr><td>suspensionSource</td><td>string</td><td>Source for the site suspension</td></tr></tbody></table>

## tcm\_activity\_log\_access

The `tcm_activity_log_access` event occurs when Tableau Cloud Manager (TCM) Activity Log data is accessed.

<table class="simple-table" style="max-width: 100%;"><colgroup><col style="width: 20%;"> <col style="width: 10%;"> <col></colgroup><tbody><tr><th>Attribute Name</th><th>Type</th><th>Description</th></tr><tr><td>eventProcessedTimeEnd</td><td>string</td><td>End time (based on the events' processed timestamp) of the data accessed. If not included, assume all available data was accessed.</td></tr><tr><td>eventProcessedTimeStart</td><td>string</td><td>Start time (based on the events' processed timestamp) of the data accessed. If not included, assume all available data was accessed.</td></tr><tr><td>eventTypeAccessed</td><td>string</td><td>Type of events accessed. If not included, assume all available data was accessed.</td></tr></tbody></table>

## track\_private\_connection\_usage

The `track_private_connection_usage` event monitors private connection usage in a tenant, logging data every hour.

<table class="simple-table" style="max-width: 100%;"><colgroup><col style="width: 20%;"> <col style="width: 10%;"> <col></colgroup><tbody><tr><th>Attribute Name</th><th>Type</th><th>Description</th></tr><tr><td>endpointId</td><td>string</td><td>The virtual private cloud (VPC) endpoint ID of the private connection</td></tr><tr><td>endpointServiceName</td><td>string</td><td>AWS endpoint service name of the private connection</td></tr><tr><td>endpointServiceRegion</td><td>string</td><td>AWS endpoint service region of the private connection</td></tr><tr><td>usageQuantity</td><td>long</td><td>The amount of data transferred through a private connection, in bytes. This value reflects usage for the hour before the log entry.</td></tr></tbody></table>

## update\_personal\_access\_token

The `update_personal_access_token` event occurs when a personal access token (PAT) is updated.

<table class="simple-table" style="max-width: 100%;"><colgroup><col style="width: 20%;"> <col style="width: 10%;"> <col></colgroup><tbody><tr><th>Attribute Name</th><th>Type</th><th>Description</th></tr><tr><td>expiresAt</td><td>string</td><td>Timestamp when the PAT expires</td></tr><tr><td>tokenId</td><td>string</td><td>ID of the PAT created. Not included if the creation attempt failed.</td></tr><tr><td>tokenName</td><td>string</td><td>Name of the PAT</td></tr></tbody></table>

## update\_private\_connection

The `update_private_connection` event occurs when a private connection is updated.

<table class="simple-table" style="max-width: 100%;"><colgroup><col style="width: 20%;"> <col style="width: 10%;"> <col></colgroup><tbody><tr><th>Attribute Name</th><th>Type</th><th>Description</th></tr><tr><td>newDescription</td><td>string</td><td>New description of the private connection</td></tr><tr><td>newSiteIds</td><td>string</td><td>Comma-separated list of new private connection site IDs.</td></tr><tr><td>oldDescription</td><td>string</td><td>Previous description of the private connection</td></tr><tr><td>oldSiteIds</td><td>string</td><td>Comma-separated list of previous private connection site IDs.</td></tr><tr><td>privateConnectionId</td><td>string</td><td>ID of the updated private connection</td></tr></tbody></table>

## update\_session

The `update_session` event occurs when the expiration time of a session is updated.

<table class="simple-table" style="max-width: 100%;"><colgroup><col style="width: 20%;"> <col style="width: 10%;"> <col></colgroup><tbody><tr><th>Attribute Name</th><th>Type</th><th>Description</th></tr><tr><td>expiresAt</td><td>string</td><td>New expiration time of the session</td></tr></tbody></table>

## update\_tenant

The `update_tenant` event occurs when the tenant name or status is updated.

<table class="simple-table" style="max-width: 100%;"><colgroup><col style="width: 20%;"> <col style="width: 10%;"> <col></colgroup><tbody><tr><th>Attribute Name</th><th>Type</th><th>Description</th></tr><tr><td>newStatus</td><td>string</td><td>Tenant status after the update</td></tr><tr><td>newTenantName</td><td>string</td><td>Tenant name after the update</td></tr><tr><td>newTenantOrg62Id</td><td>string</td><td>Tenant Org62 ID after the update</td></tr><tr><td>newTenantUri</td><td>string</td><td>Tenant Uniform Resource Identifier (URI) after the update</td></tr><tr><td>oldStatus</td><td>string</td><td>Tenant status before the update</td></tr><tr><td>oldTenantOrg62Id</td><td>string</td><td>Tenant Org62 ID before the update</td></tr></tbody></table>

## update\_user

The `update_user` event occurs when an existing user in the tenant is updated.

<table class="simple-table" style="max-width: 100%;"><colgroup><col style="width: 20%;"> <col style="width: 10%;"> <col></colgroup><tbody><tr><th>Attribute Name</th><th>Type</th><th>Description</th></tr><tr><td>newEmail</td><td>string</td><td>New email of the user</td></tr><tr><td>newLanguage</td><td>string</td><td>New language code of the user</td></tr><tr><td>newLocale</td><td>string</td><td>New locale code of the user</td></tr><tr><td>oldEmail</td><td>string</td><td>Previous email of the user</td></tr><tr><td>oldLanguage</td><td>string</td><td>Previous language code of the user</td></tr><tr><td>oldLocale</td><td>string</td><td>Previous locale code of the user</td></tr><tr><td>userId</td><td>string</td><td>Unique ID of the user added</td></tr><tr><td>userName</td><td>string</td><td>User name of the user added to the tenant</td></tr></tbody></table>

## update\_user\_site\_role

The `update_user_site_role` event occurs when a user's access to a site is updated, either by adding, changing, or removing their site role.

<table class="simple-table" style="max-width: 100%;"><colgroup><col style="width: 20%;"> <col style="width: 10%;"> <col></colgroup><tbody><tr><th>Attribute Name</th><th>Type</th><th>Description</th></tr><tr><td>email</td><td>string</td><td>Email of the user added to the tenant</td></tr><tr><td>newIdp</td><td>string</td><td>New authentication method assigned to the site user, or null if the user is being removed from the site.</td></tr><tr><td>newRole</td><td>string</td><td>New role of the user on the site, or null if the user is being removed from the site.</td></tr><tr><td>oldIdp</td><td>string</td><td>Previous authentication method assigned to the site user, or null if the user didn't previously have a role on the site.</td></tr><tr><td>oldRole</td><td>string</td><td>Previous role of the user on the site, or null if the user didn't previously have a role on the site.</td></tr><tr><td>userId</td><td>string</td><td>The unique identifier of the user</td></tr><tr><td>userName</td><td>string</td><td>User name of the user added to the site</td></tr></tbody></table>

## update\_user\_tenant\_role

The `update_user_tenant_role` event occurs when a user's access to a tenant is updated by adding, changing, or removing the cloud administrator role.

<table class="simple-table" style="max-width: 100%;"><colgroup><col style="width: 20%;"> <col style="width: 10%;"> <col></colgroup><tbody><tr><th>Attribute Name</th><th>Type</th><th>Description</th></tr><tr><td>email</td><td>string</td><td>Email of the user added to the tenant</td></tr><tr><td>newIdp</td><td>string</td><td>New authentication method assigned to the tenant user, or null if the user is being removed from the tenant.</td></tr><tr><td>newRole</td><td>string</td><td>New role of the user on the tenant, or null if the user is being removed from the tenant.</td></tr><tr><td>oldIdp</td><td>string</td><td>Previous authentication method assigned to the tenant user, or null if the user didn't previously have a role on the tenant.</td></tr><tr><td>oldRole</td><td>string</td><td>Previous role of the user on the tenant, or null if the user didn't previously have a role on the tenant.</td></tr><tr><td>userId</td><td>string</td><td>The unique identifier of the user</td></tr><tr><td>userName</td><td>string</td><td>User name of the user added to the tenant</td></tr></tbody></table>

## user\_login\_create\_session

The `user_login_create_session` event occurs when a user signs in to Tableau Cloud Manager (TCM) through the sign-in page or other interactive login.

<table class="simple-table" style="max-width: 100%;"><colgroup><col style="width: 20%;"> <col style="width: 10%;"> <col></colgroup><tbody><tr><th>Attribute Name</th><th>Type</th><th>Description</th></tr><tr><td>expiresAt</td><td>string</td><td>Timestamp when the session expires. Not included if the creation attempt failed.</td></tr><tr><td>idpId</td><td>string</td><td>ID of the IdP, indicating how the user is authenticated.</td></tr><tr><td>idpName</td><td>string</td><td>Name of the IdP, indicating how the user is authenticated.</td></tr><tr><td>newSessionId</td><td>string</td><td>New ID of the session key. Not included if the creation attempt failed.</td></tr></tbody></table>

## validate\_uat\_jwt

The `validate_uat_jwt` event occurs when validating a JSON Web Token (JWT).

<table class="simple-table" style="max-width: 100%;"><colgroup><col style="width: 20%;"> <col style="width: 10%;"> <col></colgroup><tbody><tr><th>Attribute Name</th><th>Type</th><th>Description</th></tr><tr><td>configId</td><td>string</td><td>JWT configuration ID used for validation</td></tr><tr><td>jti</td><td>string</td><td>JWT ID claim. Used to track the token when signing in.</td></tr><tr><td>jwtIssuer</td><td>string</td><td>JWT issuer (iss) claim</td></tr><tr><td>resourceId</td><td>string</td><td>ID of the resource passed to the validation endpoint. Either tenantId or siteId.</td></tr><tr><td>scope</td><td>string</td><td>JWT scope claim used for authorization</td></tr><tr><td>tokenExpirationTime</td><td>string</td><td>JWT expiration time (exp) claim value</td></tr><tr><td>username</td><td>string</td><td>Username included in the JWT</td></tr></tbody></table>