Tracks when a user downloads, previews, or uploads a file. FileEventStore is a big object that stores the event data of FileEvent. This object is available in API version 57.0 and later.
Supported Calls
describeSObjects(), query()
Special Access Rules
Accessing this object requires either the Salesforce Shield or Event Monitoring add-on subscription and the View Real-Time Event Monitoring Data user permission.
Fields
CanDownloadPdf
Type: boolean
Properties: Defaulted on create
Description: Indicates whether the downloaded PDF was converted from another file type. The default value is false.
ContentSize
Type: int
Properties: Nillable
Description: The size of the document, in bytes
DocumentId
Type: reference
Properties: Nillable
Description: The 18-character ID of the document that’s being downloaded. The ID is a reference to the ContentDocument object. This is a relationship field. In some cases, DocumentId isn’t populated for FileActionAPI_DOWNLOAD.
Relationship Name: Document
Relationship Type: Lookup
Refers To: ContentDocument
EvaluationTime
Type: double
Properties: Nillable
Description: The amount of time it took to evaluate the transaction security policy in milliseconds.
EventDate
Type: dateTime
Properties: Filter, Sort
Description: The time when the file event was reported. For example, 2020-01-20T19:12:26.965Z. Milliseconds is the most granular setting.
EventIdentifier
Type: string
Properties: Filter, Sort
Description: The unique ID of the event, which is shared with the corresponding storage object. For example, 0a4779b0-0da1-4619-a373-0a36991dff90. Use this field to correlate the event with its storage object.
FileAction
Type: string
Properties: Nillable
Description: The action taken on the file. Valid values are:Values are API_DOWNLOAD, PREVIEW, UI_DOWNLOAD, or UPLOAD. This field is available in API version 58.0 and later.
FileName
Type: string
Properties: Nillable
Description: The name of the file, including the file extension. FileName isn’t populated for FileActionAPI_DOWNLOAD.
FileSource
Type: string
Properties: Nillable
Description: Origin of the document. Valid values are:
S—Document is located within Salesforce. Label is Salesforce.
E—Document is located outside of Salesforce. Label is External.
L—Document is located on a social network and accessed via Social Customer Service. Label is Social Customer Service.
FileType
Type: string
Properties: Nillable
Description: The content type of the file.
IsLatestVersion
Type: boolean
Properties: Defaulted on create
Description: Indicates whether the file is the most current version (true) or not (false). The default value is false.
LoginKey
Type: string
Properties: Nillable
Description: The string that ties together all events in a given user’s login session. The session starts with a login event and ends with either a logout event or the user session expiring. For example, lUqjLPQTWRdvRG4.
PolicyId
Type: reference
Properties: Nillable
Description: The ID of the transaction policy associated with this event. For example, 0NIB000000000KOOAY. This is a relationship field.
Relationship Name: Policy
Relationship Type: Lookup
Refers To: TransactionSecurityPolicy
PolicyOutcome
Type: picklist
Properties: Nillable, Restricted picklist
Description: The result of the transaction policy. Possible values are:
Block—The user was blocked from performing the operation that triggered the policy.
Error—The policy caused an undefined error when it executed.
ExemptNoAction—The user is exempt from transaction security policies, so the policy didn’t trigger.
MeteringBlock—The policy took longer than 3 seconds to process, so the user was blocked from performing the operation.
MeteringNoAction—The policy took longer than 3 seconds to process, but the user isn’t blocked from performing the operation.
NoAction—The policy didn’t trigger.
Notified—A notification was sent to the recipient.
ProcessDuration
Type: double
Properties: Nillable
Description: The amount of time to download the file, in milliseconds.
ProfileId
Type: reference
Properties: Nillable
Description: This is a relationship field.
Relationship Name: Profile
Refers To: Profile
RelatedEventIdentifier
Type: string
Properties: Nillable
Description: Represents the EventIdentifier of the related event. For example, bd76f3e7-9ee5-4400-9e7f-54de57ecd79c. This field is populated only when the activity that this event monitors requires extra authentication, such as multi-factor authentication. In this case, Salesforce generates more events and sets the RelatedEventIdentifier field of the new events to the value of the EventIdentifier field of the original event. Use this field with the EventIdentifier field to correlate all the related events. If no extra authentication is required, this field is blank.
RoleId
Type: reference
Properties: Nillable
Description: This is a relationship field.
Relationship Name: Role
Refers To: UserRole
SessionKey
Type: string
Properties: Nillable
Description: The user’s unique session ID. Use this value to identify all user events within a session. When a user logs out and logs in again, a new session is started. For example, vMASKIU6AxEr+Op5.
SessionLevel
Type: picklist
Properties: Nillable, Restricted picklist
Description: Session-level security controls user access to features that support it, such as connected apps and reporting. Possible values are:
HIGH_ASSURANCE—A high assurance session was used for resource access. For example, when the user tries to access a resource such as a connected app, report, or dashboard that requires a high-assurance session level.
LOW—The user’s security level for the current session meets the lowest requirements. This low level isn’t available or used in the Salesforce UI. User sessions through the UI are either standard or high assurance. You can set this level using the API, but users who are assigned this level experience unpredictable and reduced functionality in their Salesforce org.
STANDARD—The user’s security level for the current session meets the Standard requirements set in the current organization Session Security Levels.
SourceIp
Type: string
Properties: Nillable
Description: The source IP address of the client that logged in. For example, 126.7.4.2.
UserId
Type: reference
Properties: Nillable
Description: The origin user’s unique ID. For example, 005B0000001vURv. This is a polymorphic relationship field.
Relationship Name: User
Relationship Type: Lookup
Refers To: User
Username
Type: string
Properties: Nillable
Description: The origin username in the format of user@company.com at the time the event was created.
VersionId
Type: reference
Properties: Nillable
Description: The specific version of a document in Salesforce CRM Content or Salesforce Files. The ID is a reference to the ContentVersion object. This is a relationship field.
Relationship Name: Version
Relationship Type: Lookup
Refers To: ContentVersion
VersionNumber
Type: string
Properties: Nillable
Description: The version number of the file.
Standard SOQL Usage
FileEventStore allows filtering over two fields: EventDate and EventIdentifier. The only supported SOQL functions on the FileEventStore object are WHERE, ORDER BY, and LIMIT. In the WHERE clause, you can only use comparison operators (<, >, <=, and >=). The != operator isn’t supported. In the ORDER BY clause, you can only use EventDate DESC. Ascending order isn’t supported with EventDate, and EventIdentifier sorting isn’t supported.
j