Activity Log Event Type Reference

The following tables describe the Activity Log event types and attributes.

add_delete_user_to_group

The add_delete_user_to_group event is logged when a user is added or removed from a group.

Attribute Name Type Description
actorUserId integer User ID of the user who initiated the event
eventTime string Timestamp of when the event occurred
groupId integer The integer ID of the group
groupLuid string The string LUID of the group
groupOperation string Group operation, either add or delete user to a group
impersonatedUserId integer The user ID of the user who is impersonated to perform the action that initiated the event; only applies if impersonation occurs
isError bool Indicates if the audit scenario was completed successfully or failed with an error
serviceName string Name of service that emitted the event (e.g., vizportal, vizqlserver, sitesaml (outside monolith))
siteLuid string LUID of the Tableau site where the event took place
traceUuid string Auto-generated UUID identical across all the events in a batch, such as multiple permissions changed by a single user action
userId integer The integer ID of the user
userLuid string The string LUID of the user

content_owner_change

The content_owner_change event is logged when the content owner changes.

Attribute Name Type Description
actorUserId integer User ID of the user who initiated the event
contentId integer The integer ID of the content that had the owner changed
contentLuid string The LUID of the content that had the owner changed
contentName string The name of the content that had the owner changed
contentType string The type of content, such as datasource, workbook, or view
eventTime string Timestamp of when the event occurred
impersonatedUserId integer The user ID of the user who is impersonated to perform the action that initiated the event; only applies if impersonation occurs
isError boolean Indicates if the audit scenario was completed successfully or failed with an error
newOwnerId integer The integer ID of the new content owner
newOwnerLuid string The string LUID of the new content owner
oldOwnerId integer The integer ID of the old content owner
oldOwnerLuid string The string LUID of the old content owner
serviceName string Name of service that emitted the event (e.g., vizportal, vizqlserver, sitesaml (outside monolith))
siteLuid string LUID of the Tableau site where the event took place
traceUuid string Auto-generated UUID identical across all the events in a batch, such as multiple permissions changed by a single user action

create_delete_group

The create_delete_group event is logged when a group is created or deleted.

Attribute Name Type Description
actorUserId integer User ID of the user who initiated the event
eventTime string Timestamp of when the event occurred
groupDomain string The domain of the group, such as local
groupId integer The integer ID of the group
groupLuid string The string LUID of the group
groupName string The name of the group that had its permissions changed
groupOperation string Group operation, either create or delete
impersonatedUserId integer The user ID of the user who is impersonated to perform the action that initiated the event; only applies if impersonation occurs
isError boolean Indicates if the audit scenario was completed successfully or failed with an error
serviceName string Name of service that emitted the event (e.g., vizportal, vizqlserver, sitesaml (outside monolith))
siteLuid string LUID of the Tableau site where the event took place
traceUuid string Auto-generated UUID identical across all the events in a batch, such as multiple permissions changed by a single user action

create_permissions

The create_permissions event is logged when a new explicit permission rule is created.

Attribute Name Type Description
actorUserId integer User ID of the user who initiated the event
authorizableType string The type of content that had its permissions changed, such as a project or workbook
capabilityId integer The ID of the capability. A capability is the ability to perform actions on content, such as view, filter, download, or delete
capabilityValue string The description of the capability
contentId integer The ID of the content that had the permissions updated
contentLuid string The LUID of the content
contentName string The name of the content that had the permissions updated
eventTime string Timestamp of when the event occurred
granteeId integer The ID of the grantee
granteeLuid string The LUID of the grantee
granteeType string The type of grantee, either user or group
granteeValue string The updated permissions value, such as 'user allow' or 'group allow'
impersonatedUserId integer The user ID of the user who is impersonated to perform the action that initiated the event; only applies if impersonation occurs
isError boolean Indicates if the audit scenario was completed successfully or failed with an error
serviceName string Name of service that emitted the event (e.g., vizportal, vizqlserver, sitesaml (outside monolith))
siteLuid string LUID of the Tableau site where the event took place
traceUuid string Auto-generated UUID identical across all the events in a batch, such as multiple permissions changed by a single user action

delete_all_permissions

The delete_all_permissions event is logged when all explicit permission rules for content are deleted, typically when content is deleted.

Attribute Name Type Description
actorUserId integer User ID of the user who initiated the event
authorizableType string The type of content that had its permissions changed, such as a project or workbook
contentId integer The ID of the content that had the permissions updated
contentLuid string The LUID of the content
contentName string The name of the content that had the permissions updated
eventTime string Timestamp of when the event occurred
impersonatedUserId integer The user ID of the user who is impersonated to perform the action that initiated the event; only applies if impersonation occurs
isError boolean Indicates if the audit scenario was completed successfully or failed with an error
serviceName string Name of service that emitted the event (e.g., vizportal, vizqlserver, sitesaml (outside monolith))
siteLuid string LUID of the Tableau site where the event took place
traceUuid string Auto-generated UUID identical across all the events in a batch, such as multiple permissions changed by a single user action

delete_permissions_grantee

The delete_permissions_grantee event is logged when all explicit permission rules for a user are deleted, typically when the user is deleted.

Attribute Name Type Description
actorUserId integer User ID of the user who initiated the event
eventTime string Timestamp of when the event occurred
granteeId integer The ID of the grantee
granteeLuid string The LUID of the grantee
granteeType string The type of grantee, either user or group
impersonatedUserId integer The user ID of the user who is impersonated to perform the action that initiated the event; only applies if impersonation occurs
isError boolean Indicates if the audit scenario was completed successfully or failed with an error
serviceName string Name of service that emitted the event (e.g., vizportal, vizqlserver, sitesaml (outside monolith))
siteLuid string LUID of the Tableau site where the event took place
traceUuid string Auto-generated UUID identical across all the events in a batch, such as multiple permissions changed by a single user action

delete_permissions

The delete_permissions event is logged when an explicit permission rule is deleted on content.

Attribute Name Type Description
actorUserId integer User ID of the user who initiated the event
authorizableType string The type of content that had its permissions changed, such as a project or workbook
capabilityId integer The ID of the capability. A capability is the ability to perform actions on content, such as view, filter, download, or delete
capabilityValue string The description of the capability
contentId integer The ID of the content that had the permissions updated
contentLuid string The LUID of the content
contentName string The name of the content that had the permissions updated
eventTime string Timestamp of when the event occurred
granteeId integer The ID of the grantee
granteeLuid string The LUID of the grantee
granteeType string The type of grantee, either user or group
granteeValue string The updated permissions value, such as 'user allow' or 'group allow'
impersonatedUserId integer The user ID of the user who is impersonated to perform the action that initiated the event; only applies if impersonation occurs
isError boolean Indicates if the audit scenario was completed successfully or failed with an error
serviceName string Name of service that emitted the event (e.g., vizportal, vizqlserver, sitesaml (outside monolith))
siteLuid string LUID of the Tableau site where the event took place
traceUuid string Auto-generated UUID identical across all the events in a batch, such as multiple permissions changed by a single user action

display_sheet_tabs

The display_sheet_tabs event is logged when the "Tabbed Views" value is updated on a workbook.

Attribute Name Type Description
actorUserId integer User ID of the user who initiated the event
displayTabs boolean Indicates whether tabs are displayed or not
eventTime string Timestamp of when the event occurred
impersonatedUserId integer The user ID of the user who is impersonated to perform the action that initiated the event; only applies if impersonation occurs
isError boolean Indicates if the audit scenario was completed successfully or failed with an error
serviceName string Name of service that emitted the event (e.g., vizportal, vizqlserver, sitesaml (outside monolith))
siteLuid string LUID of the Tableau site where the event took place
traceUuid string Auto-generated UUID identical across all the events in a batch, such as multiple permissions changed by a single user action
workbookId integer The ID of the workbook

hist_access_datasource

The hist_access_datasource event is logged when a user accessed the data source.

Attribute Name Type Description
actorUserId integer User ID of the user who initiated the event
certificationNote string Reason for the certification status of the data source
datasourceLuid string The LUID of the data source
description string The description of the published data source
eventTime string Timestamp of when the event occurred
impersonatedUserId integer The user ID of the user who is impersonated to perform the action that initiated the event; only applies if impersonation occurs
isCertified bool Indicates whether the data source is certified
name string Name of the data source
ownerLuid string User LUID of the data source owner
ownerName string The name of the data source owner
projectLuid string LUID of the project containing the data source
projectName string Name of the project where the data source was published
remoteQueryAgentName string Name of the remote query agent used by the data source
repositoryUrl string Uniquely identifies a view in the URL. Typically contains workbook or view name but may not be apparent when non-ASCII characters are included.
revision string The revision number of the data source. Starts with 1.0 and increments by 0.1 each time a new version is published.
siteLuid string LUID of the Tableau site where the event took place
size integer The size of the data source in bytes
usingRemoteQueryAgent bool Indicates whether the data source uses remote query agent

hist_access_datasource_remotely

The hist_access_datasource_remotely event is logged when a user accessed the data sources from a remote client, such as Tableau Desktop, REST API, etc.

Attribute Name Type Description
actorUserId integer User ID of the user who initiated the event
certificationNote string Reason for the certification status of the data source
datasourceLuid string The LUID of the data source
description string The description of the published data source
eventTime string Timestamp of when the event occurred
impersonatedUserId integer The user ID of the user who is impersonated to perform the action that initiated the event; only applies if impersonation occurs
isCertified bool Indicates whether the data source is certified
name string Name of the data source
ownerLuid string User LUID of the data source owner
ownerName string The name of the data source owner
projectLuid string LUID of the project containing the data source
projectName string Name of the project where the data source was published
remoteQueryAgentName string Name of the remote query agent used by the data source
repositoryUrl string Uniquely identifies a view in the URL. Typically contains workbook or view name but may not be apparent when non-ASCII characters are included.
revision string The revision number of the data source. Starts with 1.0 and increments by 0.1 each time a new version is published.
siteLuid string LUID of the Tableau site where the event took place
size integer The size of the data source in bytes
usingRemoteQueryAgent bool Indicates whether the data source uses remote query agent

hist_access_view

The hist_access_view event is logged when a user accessed a view.

Attribute Name Type Description
actorExternalId string The external ID for the acting user. This is an opaque identifier dependent on the actor type, but could, for example, be a user email.
actorUserId integer User ID of the user who initiated the event
caption string The descriptive phrase constructed for the worksheet based on the workbook definition
description string A description of the view
eventTime string Timestamp of when the event occurred
fields string A list of fields extracted from the workbook .twb file
firstPublishedAt string Timestamp of when the view was first published. The value won't change when republishing the workbook containing the view.
impersonatedUserId integer The user ID of the user who is impersonated to perform the action that initiated the event; only applies if impersonation occurs
index integer Each view has an index that is unique among views belonging to that workbook.
name string The name of the view
ownerLuid string User LUID of the view owner
ownerName string The name of the view owner
repositoryUrl string Uniquely identifies a view in the URL. Typically contains workbook or view name but may not be apparent when non-ASCII characters are included.
revision string The revision number of the view. Starts with 1.0 and increments by 0.1 each time a new version is published.
sheetId string The ID of the worksheet
sheetType string The type of worksheet. Either a story, dashboard, or view.
siteLuid string LUID of the Tableau site where the event took place
title string The worksheet title from the workbook .twb file
viewLuid string The LUID of the view
workbookLuid string The LUID of the workbook containing the view
workbookName string Name of the workbook containing the view

hist_append_to_datasource_extract

The hist_append_to_datasource_extract event is logged when data is added to a data extract.

Attribute Name Type Description
actorUserId integer User ID of the user who initiated the event
certificationNote string Reason for the certification status of the data source
datasourceLuid string The LUID of the data source
description string The description of the published data source
eventTime string Timestamp of when the event occurred
impersonatedUserId integer The user ID of the user who is impersonated to perform the action that initiated the event; only applies if impersonation occurs
isCertified bool Indicates whether the data source is certified
name string Name of the data source
ownerLuid string User LUID of the data source owner
ownerName string The name of the data source owner
projectLuid string LUID of the project containing the data source
projectName string Name of the project where the data source was published
remoteQueryAgentName string Name of the remote query agent used by the data source
repositoryUrl string Uniquely identifies a view in the URL. Typically contains workbook or view name but may not be apparent when non-ASCII characters are included.
revision string The revision number of the data source. Starts with 1.0 and increments by 0.1 each time a new version is published.
siteLuid string LUID of the Tableau site where the event took place
size integer The size of the data source in bytes
usingRemoteQueryAgent bool Indicates whether the data source uses remote query agent

hist_change_datasource_ownership

The hist_change_datasource_ownership event is logged when changing the data source owner.

Attribute Name Type Description
actorUserId integer User ID of the user who initiated the event
certificationNote string Reason for the certification status of the data source
datasourceLuid string The LUID of the data source
description string The description of the published data source
eventTime string Timestamp of when the event occurred
impersonatedUserId integer The user ID of the user who is impersonated to perform the action that initiated the event; only applies if impersonation occurs
isCertified bool Indicates whether the data source is certified
name string Name of the data source
newOwnerLuid string The LUID of the new data source owner
newOwnerName string The name of the new data source owner
oldOwnerLuid string The LUID of the previous data source owner
oldOwnerName string The name of the previous data source owner
ownerLuid string User LUID of the data source owner
ownerName string The name of the data source owner
projectLuid string LUID of the project containing the data source
projectName string Name of the project where the data source was published
remoteQueryAgentName string Name of the remote query agent used by the data source
repositoryUrl string Uniquely identifies a view in the URL. Typically contains workbook or view name but may not be apparent when non-ASCII characters are included.
revision string The revision number of the data source. Starts with 1.0 and increments by 0.1 each time a new version is published.
siteLuid string LUID of the Tableau site where the event took place
size integer The size of the data source in bytes
usingRemoteQueryAgent bool Indicates whether the data source uses remote query agent

hist_change_flow_ownership

The hist_change_flow_ownership event is logged when changing the flow owner.

Attribute Name Type Description
actorUserId integer User ID of the user who initiated the event
contentVersion string The version of the flow file. Increments by 1 on each publish.
description string The description of the flow
eventTime string Timestamp of when the event occurred
flowLuid string The unique ID of the flow
impersonatedUserId integer The user ID of the user who is impersonated to perform the action that initiated the event; only applies if impersonation occurs
name string The name of the flow
newOwnerLuid string The LUID of the new flow owner
newOwnerName string The name of the new flow owner
oldOwnerLuid string The LUID of the previous flow owner
oldOwnerName string The name of previous flow owner
siteLuid string LUID of the Tableau site where the event took place
size integer The size of the flow in bytes

hist_create_datasource_trigger

The hist_create_datasource_trigger event specifies what caused the data source to be created.

Attribute Name Type Description
actorUserId integer User ID of the user who initiated the event
certificationNote string Reason for the certification status of the data source
datasourceLuid string The LUID of the data source
description string The description of the published data source
eventTime string Timestamp of when the event occurred
impersonatedUserId integer The user ID of the user who is impersonated to perform the action that initiated the event; only applies if impersonation occurs
isCertified bool Indicates whether the data source is certified
name string Name of the data source
ownerLuid string User LUID of the data source owner
ownerName string The name of the data source owner
projectLuid string LUID of the project containing the data source
projectName string Name of the project where the data source was published
remoteQueryAgentName string Name of the remote query agent used by the data source
repositoryUrl string Uniquely identifies a view in the URL. Typically contains workbook or view name but may not be apparent when non-ASCII characters are included.
revision string The revision number of the data source. Starts with 1.0 and increments by 0.1 each time a new version is published.
siteLuid string LUID of the Tableau site where the event took place
size integer The size of the data source in bytes
usingRemoteQueryAgent bool Indicates whether the data source uses remote query agent

hist_create_flow_trigger

The hist_create_flow_trigger event specifies what caused the flow to be created.

Attribute Name Type Description
actorUserId integer User ID of the user who initiated the event
contentVersion string The version of the flow file. Increments by 1 on each publish.
description string The description of the flow
eventTime string Timestamp of when the event occurred
flowLuid string The unique ID of the flow
impersonatedUserId integer The user ID of the user who is impersonated to perform the action that initiated the event; only applies if impersonation occurs
name string The name of the flow
siteLuid string LUID of the Tableau site where the event took place
size integer The size of the flow in bytes

hist_delete_datasource

The hist_delete_datasource event is logged when deleting a data source.

Attribute Name Type Description
actorUserId integer User ID of the user who initiated the event
certificationNote string Reason for the certification status of the data source
datasourceLuid string The LUID of the data source
description string The description of the published data source
eventTime string Timestamp of when the event occurred
impersonatedUserId integer The user ID of the user who is impersonated to perform the action that initiated the event; only applies if impersonation occurs
isCertified bool Indicates whether the data source is certified
name string Name of the data source
ownerLuid string User LUID of the data source owner
ownerName string The name of the data source owner
projectLuid string LUID of the project containing the data source
projectName string Name of the project where the data source was published
remoteQueryAgentName string Name of the remote query agent used by the data source
repositoryUrl string Uniquely identifies a view in the URL. Typically contains workbook or view name but may not be apparent when non-ASCII characters are included.
revision string The revision number of the data source. Starts with 1.0 and increments by 0.1 each time a new version is published.
siteLuid string LUID of the Tableau site where the event took place
size integer The size of the data source in bytes
usingRemoteQueryAgent bool Indicates whether the data source uses remote query agent

hist_delete_datasource_trigger

The hist_delete_datasource_trigger event specifies what caused the data source to be deleted.

Attribute Name Type Description
actorUserId integer User ID of the user who initiated the event
certificationNote string Reason for the certification status of the data source
datasourceLuid string The LUID of the data source
description string The description of the published data source
eventTime string Timestamp of when the event occurred
impersonatedUserId integer The user ID of the user who is impersonated to perform the action that initiated the event; only applies if impersonation occurs
isCertified bool Indicates whether the data source is certified
name string Name of the data source
ownerLuid string User LUID of the data source owner
ownerName string The name of the data source owner
projectLuid string LUID of the project containing the data source
projectName string Name of the project where the data source was published
remoteQueryAgentName string Name of the remote query agent used by the data source
repositoryUrl string Uniquely identifies a view in the URL. Typically contains workbook or view name but may not be apparent when non-ASCII characters are included.
revision string The revision number of the data source. Starts with 1.0 and increments by 0.1 each time a new version is published.
siteLuid string LUID of the Tableau site where the event took place
size integer The size of the data source in bytes
usingRemoteQueryAgent bool Indicates whether the data source uses remote query agent

hist_delete_flow

The hist_delete_flow event is logged when a flow is deleted.

Attribute Name Type Description
actorUserId integer User ID of the user who initiated the event
contentVersion string The version of the flow file. Increments by 1 on each publish.
description string The description of the flow
eventTime string Timestamp of when the event occurred
flowLuid string The unique ID of the flow
impersonatedUserId integer The user ID of the user who is impersonated to perform the action that initiated the event; only applies if impersonation occurs
name string The name of the flow
siteLuid string LUID of the Tableau site where the event took place
size integer The size of the flow in bytes

hist_delete_flow_trigger

The hist_delete_flow_trigger event specifies what caused the flow to be deleted.

Attribute Name Type Description
actorUserId integer User ID of the user who initiated the event
contentVersion string The version of the flow file. Increments by 1 on each publish.
description string The description of the flow
eventTime string Timestamp of when the event occurred
flowLuid string The unique ID of the flow
impersonatedUserId integer The user ID of the user who is impersonated to perform the action that initiated the event; only applies if impersonation occurs
name string The name of the flow
siteLuid string LUID of the Tableau site where the event took place
size integer The size of the flow in bytes

hist_delete_system_user

The hist_delete_system_user event is logged when a system user is deleted.

Attribute Name Type Description
actorUserId integer User ID of the user who initiated the event
email string Email of the user
eventTime string Timestamp of when the event occurred
impersonatedUserId integer The user ID of the user who is impersonated to perform the action that initiated the event; only applies if impersonation occurs
licensingRoleName string The name of the licensing role held by the user at the time of the associated event
name string Name of the user
siteAdminLevel integer Indicates whether the user is a site admin. The value 5 = site admin and 0 = not a site admin.
siteLuid string LUID of the Tableau site where the event took place
siteRoleId integer Site role ID of the user. The value 0 = SiteAdministrator, 1 = SupportUser, 2 = Publisher, 3 = Interactor, 4 = ViewerWithPublish, 5 = Viewer, 6 = UnlicensedWithPublish, 7 = Guest, 8 = Unlicensed, and 9 = BasicUser.
userLuid string The unique identifier of the user

hist_delete_view

The hist_delete_view event is logged when a view is deleted from the site.

Attribute Name Type Description
actorUserId integer User ID of the user who initiated the event
caption string The descriptive phrase constructed for the worksheet based on the workbook definition
description string A description of the view
eventTime string Timestamp of when the event occurred
fields string A list of fields extracted from the workbook .twb file
firstPublishedAt string Timestamp of when the view was first published. The value won't change when republishing the workbook containing the view.
impersonatedUserId integer The user ID of the user who is impersonated to perform the action that initiated the event; only applies if impersonation occurs
index integer Each view has an index that is unique among views belonging to that workbook.
name string The name of the view
ownerLuid string User LUID of the view owner
ownerName string The name of the view owner
repositoryUrl string Uniquely identifies a view in the URL. Typically contains workbook or view name but may not be apparent when non-ASCII characters are included.
revision string The revision number of the view. Starts with 1.0 and increments by 0.1 each time a new version is published.
sheetId string The ID of the worksheet
sheetType string The type of worksheet. Either a story, dashboard, or view.
siteLuid string LUID of the Tableau site where the event took place
title string The worksheet title from the workbook .twb file
viewLuid string The LUID of the view
workbookLuid string The LUID of the workbook containing the view
workbookName string Name of the workbook containing the view

hist_download_datasource

The hist_download_datasource event is logged when a data source is downloaded from the site.

Attribute Name Type Description
actorUserId integer User ID of the user who initiated the event
certificationNote string Reason for the certification status of the data source
datasourceLuid string The LUID of the data source
description string The description of the published data source
eventTime string Timestamp of when the event occurred
impersonatedUserId integer The user ID of the user who is impersonated to perform the action that initiated the event; only applies if impersonation occurs
isCertified bool Indicates whether the data source is certified
name string Name of the data source
ownerLuid string User LUID of the data source owner
ownerName string The name of the data source owner
projectLuid string LUID of the project containing the data source
projectName string Name of the project where the data source was published
remoteQueryAgentName string Name of the remote query agent used by the data source
repositoryUrl string Uniquely identifies a view in the URL. Typically contains workbook or view name but may not be apparent when non-ASCII characters are included.
revision string The revision number of the data source. Starts with 1.0 and increments by 0.1 each time a new version is published.
siteLuid string LUID of the Tableau site where the event took place
size integer The size of the data source in bytes
usingRemoteQueryAgent bool Indicates whether the data source uses remote query agent

hist_download_flow

The hist_download_flow event is logged when a flow is downloaded from the site.

Attribute Name Type Description
actorUserId integer User ID of the user who initiated the event
contentVersion string The version of the flow file. Increments by 1 on each publish.
description string The description of the flow
eventTime string Timestamp of when the event occurred
flowLuid string The unique ID of the flow
impersonatedUserId integer The user ID of the user who is impersonated to perform the action that initiated the event; only applies if impersonation occurs
name string The name of the flow
siteLuid string LUID of the Tableau site where the event took place
size integer The size of the flow in bytes

hist_issue_refresh_token

The hist_issue_refresh_token event is logged when a refresh token or personal access token (PAT) is issued.

Attribute Name Type Description
actorUserId integer User ID of the user who initiated the event
eventTime string Timestamp of when the event occurred
refreshTokenGuid string The unique ID of the refresh token or PAT
siteLuid string LUID of the Tableau site where the event took place

hist_login

The hist_login event is logged when a user signed in to the site.

Attribute Name Type Description
actorExternalId string The external ID for the acting user. This is an opaque identifier dependent on the actor type, but could, for example, be a user email.
actorUserId integer User ID of the user who initiated the event
eventTime string Timestamp of when the event occurred
groupNames string The list of group names assigned to the ephemeral user during login
impersonatedUserId integer The user ID of the user who is impersonated to perform the action that initiated the event; only applies if impersonation occurs
siteLuid string LUID of the Tableau site where the event took place

hist_login_with_pat

The hist_login_with_pat event is logged when a user signed in with a personal access token (PAT).

Attribute Name Type Description
actorUserId integer User ID of the user who initiated the event
clientId string Used for PATs. The client ID is typically the PAT name displayed in the Tableau UI.
createdAt string The timestamp when the PAT was first created in ISO 8601 UTC
eventTime string Timestamp of when the event occurred
expiresAt string The timestamp when the PAT expires in ISO 8601 UTC
lastUsedAt string The timestamp when the PAT was last used in ISO 8601 UTC
refreshTokenGuid string The unique ID of the PAT
siteLuid string LUID of the Tableau site where the event took place

hist_logout

The hist_logout event is logged when a user logged out of the site.

Attribute Name Type Description
actorUserId integer User ID of the user who initiated the event
eventTime string Timestamp of when the event occurred
impersonatedUserId integer The user ID of the user who is impersonated to perform the action that initiated the event; only applies if impersonation occurs
siteLuid string LUID of the Tableau site where the event took place

hist_move_datasource

The hist_move_datasource event is logged when a published data source is moved to a new project.

Attribute Name Type Description
actorUserId integer User ID of the user who initiated the event
certificationNote string Reason for the certification status of the data source
datasourceLuid string The LUID of the data source
description string The description of the published data source
destinationProjectLuid string The unique ID of the destination project
destinationProjectName string The name of the destination project
eventTime string Timestamp of when the event occurred
impersonatedUserId integer The user ID of the user who is impersonated to perform the action that initiated the event; only applies if impersonation occurs
isCertified bool Indicates whether the data source is certified
name string Name of the data source
ownerLuid string User LUID of the data source owner
ownerName string The name of the data source owner
projectLuid string LUID of the project containing the data source
projectName string Name of the project where the data source was published
remoteQueryAgentName string Name of the remote query agent used by the data source
repositoryUrl string Uniquely identifies a view in the URL. Typically contains workbook or view name but may not be apparent when non-ASCII characters are included.
revision string The revision number of the data source. Starts with 1.0 and increments by 0.1 each time a new version is published.
siteLuid string LUID of the Tableau site where the event took place
size integer The size of the data source in bytes
sourceProjectLuid string The unique ID of the source project
sourceProjectName string The name of the source project
usingRemoteQueryAgent bool Indicates whether the data source uses remote query agent

hist_move_flow

The hist_move_flow event is logged when a flow is moved to a new project.

Attribute Name Type Description
actorUserId integer User ID of the user who initiated the event
contentVersion string The version of the flow file. Increments by 1 on each publish.
description string The description of the flow
destinationProjectLuid string The unique ID of the destination project
destinationProjectName string The name of the destination project
eventTime string Timestamp of when the event occurred
flowLuid string The unique ID of the flow
impersonatedUserId integer The user ID of the user who is impersonated to perform the action that initiated the event; only applies if impersonation occurs
name string The name of the flow
siteLuid string LUID of the Tableau site where the event took place
size integer The size of the flow in bytes
sourceProjectLuid string The unique ID of the source project
sourceProjectName string The name of the source project

hist_publish_datasource

The hist_publish_datasource event is logged when a data source is published on the site.

Attribute Name Type Description
actorUserId integer User ID of the user who initiated the event
certificationNote string Reason for the certification status of the data source
datasourceLuid string The LUID of the data source
description string The description of the published data source
eventTime string Timestamp of when the event occurred
impersonatedUserId integer The user ID of the user who is impersonated to perform the action that initiated the event; only applies if impersonation occurs
isCertified bool Indicates whether the data source is certified
name string Name of the data source
ownerLuid string User LUID of the data source owner
ownerName string The name of the data source owner
projectLuid string LUID of the project containing the data source
projectName string Name of the project where the data source was published
remoteQueryAgentName string Name of the remote query agent used by the data source
repositoryUrl string Uniquely identifies a view in the URL. Typically contains workbook or view name but may not be apparent when non-ASCII characters are included.
revision string The revision number of the data source. Starts with 1.0 and increments by 0.1 each time a new version is published.
siteLuid string LUID of the Tableau site where the event took place
size integer The size of the data source in bytes
usingRemoteQueryAgent bool Indicates whether the data source uses remote query agent

hist_publish_flow

The hist_publish_flow event is logged when a flow is published on the site.

Attribute Name Type Description
actorUserId integer User ID of the user who initiated the event
contentVersion string The version of the flow file. Increments by 1 on each publish.
description string The description of the flow
eventTime string Timestamp of when the event occurred
flowLuid string The unique ID of the flow
impersonatedUserId integer The user ID of the user who is impersonated to perform the action that initiated the event; only applies if impersonation occurs
name string The name of the flow
siteLuid string LUID of the Tableau site where the event took place
size integer The size of the flow in bytes

hist_publish_view

The hist_publish_view event is logged when a view is published on the site.

Attribute Name Type Description
actorUserId integer User ID of the user who initiated the event
caption string The descriptive phrase constructed for the worksheet based on the workbook definition
description string A description of the view
eventTime string Timestamp of when the event occurred
fields string A list of fields extracted from the workbook .twb file
firstPublishedAt string Timestamp of when the view was first published. The value won't change when republishing the workbook containing the view.
impersonatedUserId integer The user ID of the user who is impersonated to perform the action that initiated the event; only applies if impersonation occurs
index integer Each view has an index that is unique among views belonging to that workbook.
name string The name of the view
ownerLuid string User LUID of the view owner
ownerName string The name of the view owner
repositoryUrl string Uniquely identifies a view in the URL. Typically contains workbook or view name but may not be apparent when non-ASCII characters are included.
revision string The revision number of the view. Starts with 1.0 and increments by 0.1 each time a new version is published.
sheetId string The ID of the worksheet
sheetType string The type of worksheet. Either a story, dashboard, or view.
siteLuid string LUID of the Tableau site where the event took place
title string The worksheet title from the workbook .twb file
viewLuid string The LUID of the view
workbookLuid string The LUID of the workbook containing the view
workbookName string Name of the workbook containing the view

hist_redeem_refresh_token

The hist_redeem_refresh_token event is logged when a refresh token or personal access token (PAT) is redeemed.

Attribute Name Type Description
actorUserId integer User ID of the user who initiated the event
eventTime string Timestamp of when the event occurred
refreshTokenGuid string The unique ID of the refresh token or PAT
siteLuid string LUID of the Tableau site where the event took place

hist_refresh_datasource_extract

The hist_refresh_datasource_extract event is logged when a data extract is refreshed.

Attribute Name Type Description
actorUserId integer User ID of the user who initiated the event
certificationNote string Reason for the certification status of the data source
datasourceLuid string The LUID of the data source
description string The description of the published data source
eventTime string Timestamp of when the event occurred
impersonatedUserId integer The user ID of the user who is impersonated to perform the action that initiated the event; only applies if impersonation occurs
isCertified bool Indicates whether the data source is certified
name string Name of the data source
ownerLuid string User LUID of the data source owner
ownerName string The name of the data source owner
projectLuid string LUID of the project containing the data source
projectName string Name of the project where the data source was published
remoteQueryAgentName string Name of the remote query agent used by the data source
repositoryUrl string Uniquely identifies a view in the URL. Typically contains workbook or view name but may not be apparent when non-ASCII characters are included.
revision string The revision number of the data source. Starts with 1.0 and increments by 0.1 each time a new version is published.
siteLuid string LUID of the Tableau site where the event took place
size integer The size of the data source in bytes
taskLuid string The LUID of the associated task
usingRemoteQueryAgent bool Indicates whether the data source uses remote query agent

hist_rename_datasource

The hist_rename_datasource event is logged when a data source is renamed.

Attribute Name Type Description
actorUserId integer User ID of the user who initiated the event
certificationNote string Reason for the certification status of the data source
datasourceLuid string The LUID of the data source
description string The description of the published data source
eventTime string Timestamp of when the event occurred
formerName string The former name of the data source
impersonatedUserId integer The user ID of the user who is impersonated to perform the action that initiated the event; only applies if impersonation occurs
isCertified bool Indicates whether the data source is certified
name string Name of the data source
ownerLuid string User LUID of the data source owner
ownerName string The name of the data source owner
projectLuid string LUID of the project containing the data source
projectName string Name of the project where the data source was published
remoteQueryAgentName string Name of the remote query agent used by the data source
repositoryUrl string Uniquely identifies a view in the URL. Typically contains workbook or view name but may not be apparent when non-ASCII characters are included.
revision string The revision number of the data source. Starts with 1.0 and increments by 0.1 each time a new version is published.
siteLuid string LUID of the Tableau site where the event took place
size integer The size of the data source in bytes
usingRemoteQueryAgent bool Indicates whether the data source uses remote query agent

hist_rename_flow

The hist_rename_flow event is logged when a flow is renamed.

Attribute Name Type Description
actorUserId integer User ID of the user who initiated the event
contentVersion string The version of the flow file. Increments by 1 on each publish.
description string The description of the flow
eventTime string Timestamp of when the event occurred
flowLuid string The unique ID of the flow
formerName string The former name of the flow
impersonatedUserId integer The user ID of the user who is impersonated to perform the action that initiated the event; only applies if impersonation occurs
name string The name of the flow
siteLuid string LUID of the Tableau site where the event took place
size integer The size of the flow in bytes

hist_replace_datasource_extract

The hist_replace_datasource_extract event is logged when a data extract is replaced.

Attribute Name Type Description
actorUserId integer User ID of the user who initiated the event
certificationNote string Reason for the certification status of the data source
datasourceLuid string The LUID of the data source
description string The description of the published data source
eventTime string Timestamp of when the event occurred
impersonatedUserId integer The user ID of the user who is impersonated to perform the action that initiated the event; only applies if impersonation occurs
isCertified bool Indicates whether the data source is certified
name string Name of the data source
ownerLuid string User LUID of the data source owner
ownerName string The name of the data source owner
projectLuid string LUID of the project containing the data source
projectName string Name of the project where the data source was published
remoteQueryAgentName string Name of the remote query agent used by the data source
repositoryUrl string Uniquely identifies a view in the URL. Typically contains workbook or view name but may not be apparent when non-ASCII characters are included.
revision string The revision number of the data source. Starts with 1.0 and increments by 0.1 each time a new version is published.
siteLuid string LUID of the Tableau site where the event took place
size integer The size of the data source in bytes
usingRemoteQueryAgent bool Indicates whether the data source uses remote query agent

hist_revoke_refresh_token

The hist_revoke_refresh_token event is logged when a refresh token or personal access token (PAT) is revoked.

Attribute Name Type Description
actorUserId integer User ID of the user who initiated the event
eventTime string Timestamp of when the event occurred
refreshTokenGuid string The unique ID of the refresh token or PAT
siteLuid string LUID of the Tableau site where the event took place

hist_run_flow

The hist_run_flow event is logged when a flow is run manually.

Attribute Name Type Description
actorUserId integer User ID of the user who initiated the event
contentVersion string The version of the flow file. Increments by 1 on each publish.
description string The description of the flow
eventTime string Timestamp of when the event occurred
flowLuid string The unique ID of the flow
impersonatedUserId integer The user ID of the user who is impersonated to perform the action that initiated the event; only applies if impersonation occurs
name string The name of the flow
siteLuid string LUID of the Tableau site where the event took place
size integer The size of the flow in bytes

hist_run_flow_scheduled

The hist_run_flow_scheduled event is logged when a flow is run from a schedule.

Attribute Name Type Description
actorUserId integer User ID of the user who initiated the event
contentVersion string The version of the flow file. Increments by 1 on each publish.
description string The description of the flow
eventTime string Timestamp of when the event occurred
flowLuid string The unique ID of the flow
impersonatedUserId integer The user ID of the user who is impersonated to perform the action that initiated the event; only applies if impersonation occurs
name string The name of the flow
siteLuid string LUID of the Tableau site where the event took place
size integer The size of the flow in bytes
taskLuid string The luid of the associated task

hist_save_flow

The hist_save_flow event is logged when a flow is saved.

Attribute Name Type Description
actorUserId integer User ID of the user who initiated the event
contentVersion string The version of the flow file. Increments by 1 on each publish.
description string The description of the flow
eventTime string Timestamp of when the event occurred
flowLuid string The unique ID of the flow
impersonatedUserId integer The user ID of the user who is impersonated to perform the action that initiated the event; only applies if impersonation occurs
name string The name of the flow
siteLuid string LUID of the Tableau site where the event took place
size integer The size of the flow in bytes

hist_send_data_driven_alert_email

The hist_send_data_driven_alert_email event is logged when a data-driven alert email or notification is sent successfully.

Attribute Name Type Description
actorUserId integer User ID of the user who initiated the event
caption string The descriptive phrase constructed for the worksheet based on the workbook definition
description string A description of the view
eventTime string Timestamp of when the event occurred
fields string A list of fields extracted from the workbook .twb file
firstPublishedAt string Timestamp of when the view was first published. The value won't change when republishing the workbook containing the view.
impersonatedUserId integer The user ID of the user who is impersonated to perform the action that initiated the event; only applies if impersonation occurs
index integer Each view has an index that is unique among views belonging to that workbook.
name string The name of the view
ownerLuid string User LUID of the view owner
ownerName string The name of the view owner
repositoryUrl string Uniquely identifies a view in the URL. Typically contains workbook or view name but may not be apparent when non-ASCII characters are included.
revision string The revision number of the view. Starts with 1.0 and increments by 0.1 each time a new version is published.
sheetId string The ID of the worksheet
sheetType string The type of worksheet. Either a story, dashboard, or view.
siteLuid string LUID of the Tableau site where the event took place
title string The worksheet title from the workbook .twb file
viewLuid string The LUID of the view
workbookLuid string The LUID of the workbook containing the view
workbookName string Name of the workbook containing the view

hist_send_failing_data_alert_email

The hist_send_failing_data_alert_email event is logged when a data-driven alert email or notification fails.

Attribute Name Type Description
actorUserId integer User ID of the user who initiated the event
caption string The descriptive phrase constructed for the worksheet based on the workbook definition
description string A description of the view
eventTime string Timestamp of when the event occurred
fields string A list of fields extracted from the workbook .twb file
firstPublishedAt string Timestamp of when the view was first published. The value won't change when republishing the workbook containing the view.
impersonatedUserId integer The user ID of the user who is impersonated to perform the action that initiated the event; only applies if impersonation occurs
index integer Each view has an index that is unique among views belonging to that workbook.
name string The name of the view
ownerLuid string User LUID of the view owner
ownerName string The name of the view owner
repositoryUrl string Uniquely identifies a view in the URL. Typically contains workbook or view name but may not be apparent when non-ASCII characters are included.
revision string The revision number of the view. Starts with 1.0 and increments by 0.1 each time a new version is published.
sheetId string The ID of the worksheet
sheetType string The type of worksheet. Either a story, dashboard, or view.
siteLuid string LUID of the Tableau site where the event took place
title string The worksheet title from the workbook .twb file
viewLuid string The LUID of the view
workbookLuid string The LUID of the workbook containing the view
workbookName string Name of the workbook containing the view

hist_send_subscription_email_for_view

The hist_send_subscription_email_for_view event is logged when a subscription email is sent successfully.

Attribute Name Type Description
actorUserId integer User ID of the user who initiated the event
caption string The descriptive phrase constructed for the worksheet based on the workbook definition
description string A description of the view
eventTime string Timestamp of when the event occurred
fields string A list of fields extracted from the workbook .twb file
firstPublishedAt string Timestamp of when the view was first published. The value won't change when republishing the workbook containing the view.
impersonatedUserId integer The user ID of the user who is impersonated to perform the action that initiated the event; only applies if impersonation occurs
index integer Each view has an index that is unique among views belonging to that workbook.
name string The name of the view
ownerLuid string User LUID of the view owner
ownerName string The name of the view owner
repositoryUrl string Uniquely identifies a view in the URL. Typically contains workbook or view name but may not be apparent when non-ASCII characters are included.
revision string The revision number of the view. Starts with 1.0 and increments by 0.1 each time a new version is published.
scheduleLuid string The uuid for schedules used in REST API
scheduleName string The name of the schedule
sheetId string The ID of the worksheet
sheetType string The type of worksheet. Either a story, dashboard, or view.
siteLuid string LUID of the Tableau site where the event took place
title string The worksheet title from the workbook .twb file
viewLuid string The LUID of the view
workbookLuid string The LUID of the workbook containing the view
workbookName string Name of the workbook containing the view

hist_send_suspended_data_alert_email

The hist_send_suspended_data_alert_email event is logged when a data-driven alert is suspended.

Attribute Name Type Description
actorUserId integer User ID of the user who initiated the event
caption string The descriptive phrase constructed for the worksheet based on the workbook definition
description string A description of the view
eventTime string Timestamp of when the event occurred
fields string A list of fields extracted from the workbook .twb file
firstPublishedAt string Timestamp of when the view was first published. The value won't change when republishing the workbook containing the view.
impersonatedUserId integer The user ID of the user who is impersonated to perform the action that initiated the event; only applies if impersonation occurs
index integer Each view has an index that is unique among views belonging to that workbook.
name string The name of the view
ownerLuid string User LUID of the view owner
ownerName string The name of the view owner
repositoryUrl string Uniquely identifies a view in the URL. Typically contains workbook or view name but may not be apparent when non-ASCII characters are included.
revision string The revision number of the view. Starts with 1.0 and increments by 0.1 each time a new version is published.
sheetId string The ID of the worksheet
sheetType string The type of worksheet. Either a story, dashboard, or view.
siteLuid string LUID of the Tableau site where the event took place
title string The worksheet title from the workbook .twb file
viewLuid string The LUID of the view
workbookLuid string The LUID of the workbook containing the view
workbookName string Name of the workbook containing the view

hist_update_datasource

The hist_update_datasource event is logged when a data source is updated.

Attribute Name Type Description
actorUserId integer User ID of the user who initiated the event
certificationNote string Reason for the certification status of the data source
datasourceLuid string The LUID of the data source
description string The description of the published data source
eventTime string Timestamp of when the event occurred
impersonatedUserId integer The user ID of the user who is impersonated to perform the action that initiated the event; only applies if impersonation occurs
isCertified bool Indicates whether the data source is certified
name string Name of the data source
ownerLuid string User LUID of the data source owner
ownerName string The name of the data source owner
projectLuid string LUID of the project containing the data source
projectName string Name of the project where the data source was published
remoteQueryAgentName string Name of the remote query agent used by the data source
repositoryUrl string Uniquely identifies a view in the URL. Typically contains workbook or view name but may not be apparent when non-ASCII characters are included.
revision string The revision number of the data source. Starts with 1.0 and increments by 0.1 each time a new version is published.
siteLuid string LUID of the Tableau site where the event took place
size integer The size of the data source in bytes
usingRemoteQueryAgent bool Indicates whether the data source uses remote query agent

hist_update_datasource_trigger

The hist_update_datasource_trigger event specifies what caused the data source to be updated.

Attribute Name Type Description
actorUserId integer User ID of the user who initiated the event
certificationNote string Reason for the certification status of the data source
datasourceLuid string The LUID of the data source
description string The description of the published data source
eventTime string Timestamp of when the event occurred
impersonatedUserId integer The user ID of the user who is impersonated to perform the action that initiated the event; only applies if impersonation occurs
isCertified bool Indicates whether the data source is certified
name string Name of the data source
ownerLuid string User LUID of the data source owner
ownerName string The name of the data source owner
projectLuid string LUID of the project containing the data source
projectName string Name of the project where the data source was published
remoteQueryAgentName string Name of the remote query agent used by the data source
repositoryUrl string Uniquely identifies a view in the URL. Typically contains workbook or view name but may not be apparent when non-ASCII characters are included.
revision string The revision number of the data source. Starts with 1.0 and increments by 0.1 each time a new version is published.
siteLuid string LUID of the Tableau site where the event took place
size integer The size of the data source in bytes
usingRemoteQueryAgent bool Indicates whether the data source uses remote query agent

hist_update_flow

The hist_update_flow event is logged when a flow is updated.

Attribute Name Type Description
actorUserId integer User ID of the user who initiated the event
contentVersion string The version of the flow file. Increments by 1 on each publish.
description string The description of the flow
eventTime string Timestamp of when the event occurred
flowLuid string The unique ID of the flow
impersonatedUserId integer The user ID of the user who is impersonated to perform the action that initiated the event; only applies if impersonation occurs
name string The name of the flow
siteLuid string LUID of the Tableau site where the event took place
size integer The size of the flow in bytes

hist_update_flow_trigger

The hist_update_flow_trigger event specifies what caused the flow to update.

Attribute Name Type Description
actorUserId integer User ID of the user who initiated the event
contentVersion string The version of the flow file. Increments by 1 on each publish.
description string The description of the flow
eventTime string Timestamp of when the event occurred
flowLuid string The unique ID of the flow
impersonatedUserId integer The user ID of the user who is impersonated to perform the action that initiated the event; only applies if impersonation occurs
name string The name of the flow
siteLuid string LUID of the Tableau site where the event took place
size integer The size of the flow in bytes

move_content

The move_content event is logged when content is moved, for example, moving a workbook between projects.

Attribute Name Type Description
actorUserId integer User ID of the user who initiated the event
contentId integer The integer ID of the content that had the owner changed
contentLuid string The LUID of the content that had the owner changed
contentName string The name of the content that had the owner changed
contentType string The type of content, such as datasource, workbook, or view
eventTime string Timestamp of when the event occurred
impersonatedUserId integer The user ID of the user who is impersonated to perform the action that initiated the event; only applies if impersonation occurs
isError boolean Indicates if the audit scenario was completed successfully or failed with an error
newContainerLuid string The LUID of the new container
newContainerType string The type of new container, such as a project
oldContainerLuid string The string LUID of the old container
oldContainerType string The type of old container, such as project
serviceName string Name of service that emitted the event (e.g., vizportal, vizqlserver, sitesaml (outside monolith))
siteLuid string LUID of the Tableau site where the event took place
traceUuid string Auto-generated UUID identical across all the events in a batch, such as multiple permissions changed by a single user action

project_lock_unlock

The project_lock_unlock event is logged when project permissions are locked or unlocked.

Attribute Name Type Description
actorUserId integer User ID of the user who initiated the event
controllingProjectLuid string The LUID of the project that controls permissions for the nested project.
eventTime string Timestamp of when the event occurred
impersonatedUserId integer The user ID of the user who is impersonated to perform the action that initiated the event; only applies if impersonation occurs
isError boolean Indicates if the audit scenario was completed successfully or failed with an error
projectLuid string The LUID of the project
projectOperation string Project operation, either lock or unlock
serviceName string Name of service that emitted the event (e.g., vizportal, vizqlserver, sitesaml (outside monolith))
siteLuid string LUID of the Tableau site where the event took place
traceUuid string Auto-generated UUID identical across all the events in a batch, such as multiple permissions changed by a single user action

update_permissions

The update_permissions event is logged when an explicit permission rule is updated for a content item.

Attribute Name Type Description
actorUserId integer User ID of the user who initiated the event
authorizableType string The type of content that had its permissions changed, such as a project or workbook
capabilityId integer The ID of the capability. A capability is the ability to perform actions on content, such as view, filter, download, or delete
capabilityValue string The description of the capability
contentId integer The ID of the content that had the permissions updated
contentLuid string The LUID of the content
contentName string The name of the content that had the permissions updated
eventTime string Timestamp of when the event occurred
granteeId integer The ID of the grantee
granteeLuid string The LUID of the grantee
granteeType string The type of grantee, either user or group
granteeValue string The updated permissions value, such as 'user allow' or 'group allow'
impersonatedUserId integer The user ID of the user who is impersonated to perform the action that initiated the event; only applies if impersonation occurs
isError boolean Indicates if the audit scenario was completed successfully or failed with an error
permissionType string The permission type, either explicit or unspecified
serviceName string Name of service that emitted the event (e.g., vizportal, vizqlserver, sitesaml (outside monolith))
siteLuid string LUID of the Tableau site where the event took place
traceUuid string Auto-generated UUID identical across all the events in a batch, such as multiple permissions changed by a single user action

update_permissions_template

The update_permissions_template event is logged when a permission template for a project is updated.

Attribute Name Type Description
actorUserId integer User ID of the user who initiated the event
authorizableType string The type of content that had its permissions changed, such as a project or workbook
capabilityId integer The ID of the capability. A capability is the ability to perform actions on content, such as view, filter, download, or delete
capabilityValue string The description of the capability
contentId integer The ID of the content that had the permissions updated
contentLuid string The LUID of the content
contentName string The name of the content that had the permissions updated
eventTime string Timestamp of when the event occurred
granteeId integer The ID of the grantee
granteeLuid string The LUID of the grantee
granteeType string The type of grantee, either user or group
granteeValue string The updated permissions value, such as 'user allow' or 'group allow'
impersonatedUserId integer The user ID of the user who is impersonated to perform the action that initiated the event; only applies if impersonation occurs
isError boolean Indicates if the audit scenario was completed successfully or failed with an error
permissionType string The permission type, either explicit or unspecified
serviceName string Name of service that emitted the event (e.g., vizportal, vizqlserver, sitesaml (outside monolith))
siteLuid string LUID of the Tableau site where the event took place
templateType string The type of permission template used to change permissions, such as workbook or data source
traceUuid string Auto-generated UUID identical across all the events in a batch, such as multiple permissions changed by a single user action

user_create_delete

The user_create_delete event is logged when a user is created or deleted.

Attribute Name Type Description
actorUserId integer User ID of the user who initiated the event
eventTime string Timestamp of when the event occurred
forUserName string The name of the user whose account was either created, updated or deleted
impersonatedUserId integer The user ID of the user who is impersonated to perform the action that initiated the event; only applies if impersonation occurs
isError boolean Indicates if the audit scenario was completed successfully or failed with an error
serviceName string Name of service that emitted the event (e.g., vizportal, vizqlserver, sitesaml (outside monolith))
siteLuid string LUID of the Tableau site where the event took place
siteRole string Site role of the user. Determines the maximum level of access a user can have on the site
targetUserId integer The integer ID of the user whose account was either created, updated or deleted
targetUserLuid string The string LUID of the user whose account was either created, updated or deleted
traceUuid string Auto-generated UUID identical across all the events in a batch, such as multiple permissions changed by a single user action
userOperation string The action performed on a user, either create, delete, or site role change
Thanks for your feedback!