Activity Log Tenant Event Type Reference

This topic describes the Activity Log tenant event types and attributes. For information about site events, see Activity Log Site Event Type Reference.

Event type details

The following content describes tenant event types and attributes in Activity Log. Use the alphabetically sorted list of event types on the right, or ctrl/cmd-f to go directly to keywords you have in mind.

Note: Timestamps for events are recorded in ISO 8601 UTC.

Common attributes

The table contains common attributes for all Activity Log tenant events. For event-specific attributes, review the individual event tables in this topic.

Attribute Name Type Description
eventOutcome string Represents the final outcome of the operation. Possible values are:
  • success: The attempted operation completed successfully.
  • unauthorized: The initiating user wasn't authorized to perform the operation.
  • client_error: The operation failed due to a cause attributable to the client/caller. For example, invalid API request parameters, client connection timeout, or throttling.
  • internal_error: The operation failed due to an unexpected internal error.
eventOutcomeReason string Provides additional details about the event outcome
eventTime string Timestamp when the event occurred
initiatingSessionId string ID of user's session which initiated the operation
initiatingUrl string URL associated with the request that initiated the operation, such as the URL of a REST API endpoint that was invoked.
initiatingUserAgent string User-Agent HTTP header associated with the request that initiated the operation
initiatingUserDisplayName string Display name of the user who initiated the operation
initiatingUserEmail string Email address of the user who initiated the operation
initiatingUserIpAddress string Remote client IP address of the request that initiated the operation. Either a valid IPv4 or IPv6 address.
initiatingUserId string ID of the user who initiated the operation
initiatingUserRole string Role or privilege level that allowed the initiating user to perform the operation
podUri string Uniform Resource Identifier (URI) of pod where the operation occurred
siteId string ID of site where the operation occurred
siteName string Name of site where the operation occurred
siteUri string Uniform Resource Identifier (URI) of site where the operation occurred
tenantId string ID of tenant where the operation occurred
tenantName string Name of tenant where the operation occurred
tenantUri string Uniform Resource Identifier (URI) of tenant where the operation occurred
traceUuid string Auto-generated UUID identical across all the events in a batch, such as multiple permissions changed by a single user action.

batch_revoke_personal_access_token

The batch_revoke_personal_access_token event occurs when a tenant is suspended or deleted, or a user is removed​​.

Attribute Name Type Description
patUserId string ID of the user whose PATs were revoked. Not included if PATs were revoked for the entire tenant.

batch_revoke_session

The batch_revoke_sessions event occurs when all sessions associated with a tenant or user are revoked.

Attribute Name Type Description
sessionUserId string ID of the user whose sessions were revoked. Not included if sessions were revoked for the entire tenant.

create_or_update_oidc_config

The create_or_update_oidc_config event occurs when the OIDC configuration is changed.

Attribute Name Type Description
isSecretUpdated bool Indicates whether the secret has been updated. The actual secret value isn't recorded. This attribute helps admins track changes in their organization, such as those affecting system functionality or ensuring scheduled secret rotations are carried out properly.
newSettingsValue string New OIDC configuration settings
oldSettingsValue string Previous OIDC configuration settings
resourceId string Resource ID of an OIDC configuration

create_or_update_saml_config

The create_or_update_saml_config event occurs when the SAML configuration is changed.

Attribute Name Type Description
newSettingsValue string New SAML configuration settings
oldSettingsValue string Previous SAML configuration settings
resourceId string Resource ID of a SAML configuration

create_personal_access_token

The create_personal_access_token event occurs when a personal access token (PAT) is generated.

Attribute Name Type Description
expiresAt string Timestamp when the PAT expires. Not included if the creation attempt failed.
tokenId string ID of the PAT created. Not included if the creation attempt failed.
tokenName string Name of the PAT

create_private_connection

The create_private_connection event occurs when a private connection is created in a tenant.

Attribute Name Type Description
description string Description of the private connection created
endpointServiceName string Endpoint service name of the private connection created
name string Name of the private connection created
privateConnectionId string ID of the private connection created
region string AWS Region where the private connection is created

create_site

The create_site event occurs when a site is created in a tenant.

Attribute Name Type Description
This event only uses common attributes. For more information, see the Common attributes section in this topic.

create_tenant

The create_tenant event occurs when a tenant is created.

Attribute Name Type Description
This event only uses common attributes. For more information, see the Common attributes section in this topic.

create_user

The create_user event occurs when a new user is created in a tenant.

Attribute Name Type Description
email string Email of the user added to the tenant
language string Language code of the user added to the tenant
locale string Locale code of the user added to the tenant
userId string Unique identifier of the user added to the tenant
userName string User name of the user added to the tenant

delete_oidc_config

The delete_oidc_config event occurs when the OIDC configuration is deleted.

Attribute Name Type Description
idpConfigurationId string ID of the IdP configuration
idpConfigurationName string Name of the IdP configuration
resourceId string Resource ID of the OIDC configuration

delete_private_connection

The delete_private_connection event occurs when a private connection is deleted in a tenant.

Attribute Name Type Description
privateConnectionId string ID of the deleted private connection

delete_saml_config

The delete_saml_config event occurs when the SAML configuration is deleted.

Attribute Name Type Description
idpConfigurationId string ID of the IdP configuration
idpConfigurationName string Name of the IdP configuration
resourceId string Resource ID of the SAML configuration

delete_site

The delete_site event occurs when a site is deleted from a tenant.

Attribute Name Type Description
This event only uses common attributes. For more information, see the Common attributes section in this topic.

delete_tenant

The delete_tenant event occurs when a tenant is deleted.

Attribute Name Type Description
This event only uses common attributes. For more information, see the Common attributes section in this topic.

delete_user

The delete_user event occurs when a user is deleted from a tenant.

Attribute Name Type Description
email string Email of the user removed
userId string ID of the user removed
userName string User name of the user removed

get_sites

The get_sites event occurs when a list of sites under a tenant is requested.

Attribute Name Type Description
This event only uses common attributes. For more information, see the Common attributes section in this topic.

get_users

The get_user event occurs when a list of users within a tenant or site is requested.

Attribute Name Type Description
This event only uses common attributes. For more information, see the Common attributes section in this topic.

list_personal_access_tokens

The list_personal_access_tokens event occurs when all valid personal access tokens (PATs) in Tableau Cloud Manager (TCM) are requested.

Attribute Name Type Description
This event only uses common attributes. For more information, see the Common attributes section in this topic.

merge_tenant

The merge_tenant event occurs when a Tableau Cloud Manager tenant is merged into another tenant. This consolidation allows cloud admins to manage all sites under one tenant and benefit from unified governance.

Attribute Name Type Description
sourceTenantId string ID of source tenant in the merge operation
sourceTenantName string Name of the source tenant in the merge operation
sourceTenantUri string Uniform Resource Identifier (URI) of the source tenant in the merge operation

migrate_site

The migrate_site event occurs when a site is migrated to a tenant.

Attribute Name Type Description
This event only uses common attributes. For more information, see the Common attributes section in this topic.

personal_access_token_login

The personal_access_token_login event occurs when a personal access token (PAT) is used to sign in to Tableau Cloud Manager.

Attribute Name Type Description
newSessionId string ID of the session created by this login request. Not included if the login failed.
tokenId string ID of the PAT used to login
tokenName string Name of the PAT

reactivate_site

The reactivate_site event occurs when a site in a tenant is reactivated.

Attribute Name Type Description
This event only uses common attributes. For more information, see the Common attributes section in this topic.

revoke_personal_access_token

The revoke_personal_access_token event occurs when a personal access token (PAT) is revoked in Tableau Cloud Manager.

Attribute Name Type Description
tokenId string ID of the PAT revoked
tokenName string Name of the PAT

revoke_session

The revoke_session event occurs when a user is logged out due to a revoked session, such as a user explicitly logging out or the session expiring.

Attribute Name Type Description
This event only uses common attributes. For more information, see the Common attributes section in this topic.

site_limits_change

The site_limits_change event occurs when site-level license capacity limits for site roles (Creator, Explorer, or Viewer) are changed.

Attribute Name Type Description
newCreatorCapacity integer New value for the Creator site role limit. Not included if the new limit is the default cloud limit.
newCreatorCapacityIsDefaultCloudLimit bool New Creator limit was set to the default cloud limit
newExplorerCapacity integer New value for the Explorer site role limit. Not included if the new limit is the default cloud limit.
newExplorerCapacityIsDefaultCloudLimit bool New Explorer limit is set to the default cloud limit
newViewerCapacity integer New value for the Viewer site role limit. Not included if the new limit is the default cloud limit.
newViewerCapacityIsDefaultCloudLimit bool New Viewer limit is set to the default cloud limit
oldCreatorCapacity integer Previous value for the Creator site role limit. Not included if the previous limit was the default cloud limit.
oldCreatorCapacityIsDefaultCloudLimit bool Previous Creator limit was set to the default cloud limit
oldExplorerCapacity integer Previous value for the Explorer site role limit. Not included if the previous limit was the default cloud limit.
oldExplorerCapacityIsDefaultCloudLimit bool Previous Explorer limit was set to the default cloud limit
oldViewerCapacity integer Previous value for the Viewer site role limit. Not included if the previous limit was the default cloud limit.
oldViewerCapacityIsDefaultCloudLimit bool Previous Viewer limit was set to the default cloud limit

suspend_site

The suspend_site event occurs when a site in a tenant is suspended.

Attribute Name Type Description
suspensionSource string Source for the site suspension

tcm_activity_log_access

The tcm_activity_log_access event occurs when Tableau Cloud Manager (TCM) Activity Log data is accessed.

Attribute Name Type Description
eventProcessedTimeEnd string End time (based on the events' processed timestamp) of the data accessed. If not included, assume all available data was accessed.
eventProcessedTimeStart string Start time (based on the events' processed timestamp) of the data accessed. If not included, assume all available data was accessed.
eventTypeAccessed string Type of events accessed. If not included, assume all available data was accessed.

update_personal_access_token

The update_personal_access_token event occurs when a personal access token (PAT) is updated.

Attribute Name Type Description
expiresAt string Timestamp when the PAT expires
tokenId string ID of the PAT created. Not included if the creation attempt failed.
tokenName string Name of the PAT

update_private_connection

The update_private_connection event occurs when a private connection is updated.

Attribute Name Type Description
newDescription string Description of private connection after update
newSiteIds string Comma-separated list of site IDs, representing the private connection after the update.
oldDescription string Description of private connection before update
oldSiteIds string Comma-separated list of site IDs, representing the private connection before the update.
privateConnectionId string ID of the updated private connection

update_session

The update_session event occurs when the expiration time of a session is updated.

Attribute Name Type Description
expiresAt string New expiration time of the session

update_tenant

The update_tenant event occurs when the tenant name or status is updated.

Attribute Name Type Description
newStatus string Tenant status after the update
newTenantName string Tenant name after the update
newTenantOrg62Id string Tenant Org62 ID after the update
newTenantUri string Tenant Uniform Resource Identifier (URI) after the update
oldStatus string Tenant status before the update
oldTenantOrg62Id string Tenant Org62 ID before the update

update_user

The update_user event occurs when an existing user in the tenant is updated.

Attribute Name Type Description
newEmail string New email of the user
newLanguage string New language code of the user
newLocale string New locale code of the user
oldEmail string Previous email of the user
oldLanguage string Previous language code of the user
oldLocale string Previous locale code of the user
userId string Unique ID of the user added
userName string User name of the user added to the tenant

update_user_site_role

The update_user_site_role event occurs when a user’s access to a site is updated, either by adding, changing, or removing their site role.

Attribute Name Type Description
email string Email of the user added to the tenant
newIdp string New authentication method assigned to the site user, or null if the user is being removed from the site.
newRole string New role of the user on the site, or null if the user is being removed from the site.
oldIdp string Previous authentication method assigned to the site user, or null if the user didn't previously have a role on the site.
oldRole string Previous role of the user on the site, or null if the user didn’t previously have a role on the site.
userId string The unique identifier of the user
userName string User name of the user added to the site

update_user_tenant_role

The update_user_tenant_role event occurs when a user’s access to a tenant is updated by adding, changing, or removing the cloud administrator role.

Attribute Name Type Description
email string Email of the user added to the tenant
newIdp string New authentication method assigned to the tenant user, or null if the user is being removed from the tenant.
newRole string New role of the user on the tenant, or null if the user is being removed from the tenant.
oldIdp string Previous authentication method assigned to the tenant user, or null if the user didn't previously have a role on the tenant.
oldRole string Previous role of the user on the tenant, or null if the user didn’t previously have a role on the tenant.
userId string The unique identifier of the user
userName string User name of the user added to the tenant

user_login_create_session

The user_login_create_session event occurs when a user signs in to Tableau Cloud Manager (TCM) through the sign-in page or other interactive login.

Attribute Name Type Description
expiresAt string Timestamp when the session expires. Not included if the creation attempt failed.
idpId string ID of the IdP, indicating how the user is authenticated.
idpName string Name of the IdP, indicating how the user is authenticated.
newSessionId string New ID of the session key. Not included if the creation attempt failed.