Activity Log Tenant Event Type Reference
This topic describes the Activity Log tenant event types and attributes. For information about site events, see Activity Log Site Event Type Reference.
Event type details
The following content describes tenant event types and attributes in Activity Log. Use the alphabetically sorted list of event types on the right, or ctrl/cmd-f to go directly to keywords you have in mind.
Note: Timestamps for events are recorded in ISO 8601 UTC.
The table contains common attributes for all Activity Log tenant events. For event-specific attributes, review the individual event tables in this topic.
| Attribute Name | Type | Description |
|---|---|---|
| eventOutcome | string |
Represents the final outcome of the operation. Possible values are:
|
| eventOutcomeReason | string | Provides additional details about the event outcome |
| eventTime | string | Timestamp when the event occurred |
| initiatingSessionId | string | ID of user's session which initiated the operation |
| initiatingUrl | string | URL associated with the request that initiated the operation, such as the URL of a REST API endpoint that was invoked. |
| initiatingUserAgent | string | User-Agent HTTP header associated with the request that initiated the operation |
| initiatingUserDisplayName | string | Display name of the user who initiated the operation |
| initiatingUserEmail | string | Email address of the user who initiated the operation |
| initiatingUserIpAddress | string | Remote client IP address of the request that initiated the operation. Either a valid IPv4 or IPv6 address. |
| initiatingUserId | string | ID of the user who initiated the operation |
| initiatingUserRole | string | Role or privilege level that allowed the initiating user to perform the operation |
| podUri | string | Uniform Resource Identifier (URI) of pod where the operation occurred |
| siteId | string | ID of site where the operation occurred |
| siteName | string | Name of site where the operation occurred |
| siteUri | string | Uniform Resource Identifier (URI) of site where the operation occurred |
| tenantId | string | ID of tenant where the operation occurred |
| tenantName | string | Name of tenant where the operation occurred |
| tenantUri | string | Uniform Resource Identifier (URI) of tenant where the operation occurred |
| traceUuid | string | Auto-generated UUID identical across all the events in a batch, such as multiple permissions changed by a single user action. |
The batch_revoke_personal_access_token event occurs when a tenant is suspended or deleted, or a user is removed.
| Attribute Name | Type | Description |
|---|---|---|
| patUserId | string | ID of the user whose PATs were revoked. Not included if PATs were revoked for the entire tenant. |
The batch_revoke_sessions event occurs when all sessions associated with a tenant or user are revoked.
| Attribute Name | Type | Description |
|---|---|---|
| sessionUserId | string | ID of the user whose sessions were revoked. Not included if sessions were revoked for the entire tenant. |
The create_or_update_oidc_config event occurs when the OIDC configuration is changed.
| Attribute Name | Type | Description |
|---|---|---|
| isSecretUpdated | bool | Indicates whether the secret has been updated. The actual secret value isn't recorded. This attribute helps admins track changes in their organization, such as those affecting system functionality or ensuring scheduled secret rotations are carried out properly. |
| newSettingsValue | string | New OIDC configuration settings |
| oldSettingsValue | string | Previous OIDC configuration settings |
| resourceId | string | Resource ID of an OIDC configuration |
The create_or_update_saml_config event occurs when the SAML configuration is changed.
| Attribute Name | Type | Description |
|---|---|---|
| newSettingsValue | string | New SAML configuration settings |
| oldSettingsValue | string | Previous SAML configuration settings |
| resourceId | string | Resource ID of a SAML configuration |
The create_personal_access_token event occurs when a personal access token (PAT) is generated.
| Attribute Name | Type | Description |
|---|---|---|
| expiresAt | string | Timestamp when the PAT expires. Not included if the creation attempt failed. |
| tokenId | string | ID of the PAT created. Not included if the creation attempt failed. |
| tokenName | string | Name of the PAT |
The create_private_connection event occurs when a private connection is created.
| Attribute Name | Type | Description |
|---|---|---|
| description | string | Description of the private connection |
| endpointServiceName | string | AWS endpoint service name of the private connection |
| name | string | Name of the private connection |
| privateConnectionId | string | ID of the created private connection |
| region | string | AWS region where the private connection is created |
The create_site event occurs when a site is created in a tenant.
| Attribute Name | Type | Description |
|---|---|---|
| This event only uses common attributes. For more information, see the Common attributes section in this topic. | ||
The create_tenant event occurs when a tenant is created.
| Attribute Name | Type | Description |
|---|---|---|
| This event only uses common attributes. For more information, see the Common attributes section in this topic. | ||
The create_user event occurs when a new user is created in a tenant.
| Attribute Name | Type | Description |
|---|---|---|
| string | Email of the user added to the tenant | |
| language | string | Language code of the user added to the tenant |
| locale | string | Locale code of the user added to the tenant |
| userId | string | Unique identifier of the user added to the tenant |
| userName | string | User name of the user added to the tenant |
The delete_oidc_config event occurs when the OIDC configuration is deleted.
| Attribute Name | Type | Description |
|---|---|---|
| idpConfigurationId | string | ID of the IdP configuration |
| idpConfigurationName | string | Name of the IdP configuration |
| resourceId | string | Resource ID of the OIDC configuration |
The delete_private_connection event occurs when a private connection is deleted in a tenant.
| Attribute Name | Type | Description |
|---|---|---|
| privateConnectionId | string | ID of the deleted private connection |
The delete_saml_config event occurs when the SAML configuration is deleted.
| Attribute Name | Type | Description |
|---|---|---|
| idpConfigurationId | string | ID of the IdP configuration |
| idpConfigurationName | string | Name of the IdP configuration |
| resourceId | string | Resource ID of the SAML configuration |
The delete_site event occurs when a site is deleted from a tenant.
| Attribute Name | Type | Description |
|---|---|---|
| This event only uses common attributes. For more information, see the Common attributes section in this topic. | ||
The delete_tenant event occurs when a tenant is deleted.
| Attribute Name | Type | Description |
|---|---|---|
| This event only uses common attributes. For more information, see the Common attributes section in this topic. | ||
The delete_user event occurs when a user is deleted from a tenant.
| Attribute Name | Type | Description |
|---|---|---|
| string | Email of the user removed | |
| userId | string | ID of the user removed |
| userName | string | User name of the user removed |
The get_sites event occurs when a list of sites under a tenant is requested.
| Attribute Name | Type | Description |
|---|---|---|
| This event only uses common attributes. For more information, see the Common attributes section in this topic. | ||
The get_user event occurs when a list of users within a tenant or site is requested.
| Attribute Name | Type | Description |
|---|---|---|
| This event only uses common attributes. For more information, see the Common attributes section in this topic. | ||
The list_personal_access_tokens event occurs when all valid personal access tokens (PATs) in Tableau Cloud Manager (TCM) are requested.
| Attribute Name | Type | Description |
|---|---|---|
| This event only uses common attributes. For more information, see the Common attributes section in this topic. | ||
The merge_tenant event occurs when a Tableau Cloud Manager tenant is merged into another tenant. This consolidation allows cloud admins to manage all sites under one tenant and benefit from unified governance.
| Attribute Name | Type | Description |
|---|---|---|
| sourceTenantId | string | ID of source tenant in the merge operation |
| sourceTenantName | string | Name of the source tenant in the merge operation |
| sourceTenantUri | string | Uniform Resource Identifier (URI) of the source tenant in the merge operation |
The migrate_site event occurs when a site is migrated to a tenant.
| Attribute Name | Type | Description |
|---|---|---|
| This event only uses common attributes. For more information, see the Common attributes section in this topic. | ||
The personal_access_token_login event occurs when a personal access token (PAT) is used to sign in to Tableau Cloud Manager.
| Attribute Name | Type | Description |
|---|---|---|
| newSessionId | string | ID of the session created by this login request. Not included if the login failed. |
| tokenId | string | ID of the PAT used to login |
| tokenName | string | Name of the PAT |
The reactivate_site event occurs when a site in a tenant is reactivated.
| Attribute Name | Type | Description |
|---|---|---|
| This event only uses common attributes. For more information, see the Common attributes section in this topic. | ||
The revoke_personal_access_token event occurs when a personal access token (PAT) is revoked in Tableau Cloud Manager.
| Attribute Name | Type | Description |
|---|---|---|
| tokenId | string | ID of the PAT revoked |
| tokenName | string | Name of the PAT |
The revoke_session event occurs when a user is logged out due to a revoked session, such as a user explicitly logging out or the session expiring.
| Attribute Name | Type | Description |
|---|---|---|
| This event only uses common attributes. For more information, see the Common attributes section in this topic. | ||
The site_limits_change event occurs when site-level license capacity limits for site roles (Creator, Explorer, or Viewer) are changed.
| Attribute Name | Type | Description |
|---|---|---|
| newCreatorCapacity | integer | New value for the Creator site role limit. Not included if the new limit is the default cloud limit. |
| newCreatorCapacityIsDefaultCloudLimit | bool | New Creator limit was set to the default cloud limit |
| newExplorerCapacity | integer | New value for the Explorer site role limit. Not included if the new limit is the default cloud limit. |
| newExplorerCapacityIsDefaultCloudLimit | bool | New Explorer limit is set to the default cloud limit |
| newViewerCapacity | integer | New value for the Viewer site role limit. Not included if the new limit is the default cloud limit. |
| newViewerCapacityIsDefaultCloudLimit | bool | New Viewer limit is set to the default cloud limit |
| oldCreatorCapacity | integer | Previous value for the Creator site role limit. Not included if the previous limit was the default cloud limit. |
| oldCreatorCapacityIsDefaultCloudLimit | bool | Previous Creator limit was set to the default cloud limit |
| oldExplorerCapacity | integer | Previous value for the Explorer site role limit. Not included if the previous limit was the default cloud limit. |
| oldExplorerCapacityIsDefaultCloudLimit | bool | Previous Explorer limit was set to the default cloud limit |
| oldViewerCapacity | integer | Previous value for the Viewer site role limit. Not included if the previous limit was the default cloud limit. |
| oldViewerCapacityIsDefaultCloudLimit | bool | Previous Viewer limit was set to the default cloud limit |
The suspend_site event occurs when a site in a tenant is suspended.
| Attribute Name | Type | Description |
|---|---|---|
| suspensionSource | string | Source for the site suspension |
The tcm_activity_log_access event occurs when Tableau Cloud Manager (TCM) Activity Log data is accessed.
| Attribute Name | Type | Description |
|---|---|---|
| eventProcessedTimeEnd | string | End time (based on the events' processed timestamp) of the data accessed. If not included, assume all available data was accessed. |
| eventProcessedTimeStart | string | Start time (based on the events' processed timestamp) of the data accessed. If not included, assume all available data was accessed. |
| eventTypeAccessed | string | Type of events accessed. If not included, assume all available data was accessed. |
The track_private_connection_usage event monitors private connection usage in a tenant, logging data every hour.
| Attribute Name | Type | Description |
|---|---|---|
| endpointId | string | The virtual private cloud (VPC) endpoint ID of the private connection |
| endpointServiceName | string | AWS endpoint service name of the private connection |
| endpointServiceRegion | string | AWS endpoint service region of the private connection |
| usageQuantity | long | The amount of data transferred through a private connection, in bytes. This value reflects usage for the hour before the log entry. |
The update_personal_access_token event occurs when a personal access token (PAT) is updated.
| Attribute Name | Type | Description |
|---|---|---|
| expiresAt | string | Timestamp when the PAT expires |
| tokenId | string | ID of the PAT created. Not included if the creation attempt failed. |
| tokenName | string | Name of the PAT |
The update_private_connection event occurs when a private connection is updated.
| Attribute Name | Type | Description |
|---|---|---|
| newDescription | string | New description of the private connection |
| newSiteIds | string | Comma-separated list of new private connection site IDs. |
| oldDescription | string | Previous description of the private connection |
| oldSiteIds | string | Comma-separated list of previous private connection site IDs. |
| privateConnectionId | string | ID of the updated private connection |
The update_session event occurs when the expiration time of a session is updated.
| Attribute Name | Type | Description |
|---|---|---|
| expiresAt | string | New expiration time of the session |
The update_tenant event occurs when the tenant name or status is updated.
| Attribute Name | Type | Description |
|---|---|---|
| newStatus | string | Tenant status after the update |
| newTenantName | string | Tenant name after the update |
| newTenantOrg62Id | string | Tenant Org62 ID after the update |
| newTenantUri | string | Tenant Uniform Resource Identifier (URI) after the update |
| oldStatus | string | Tenant status before the update |
| oldTenantOrg62Id | string | Tenant Org62 ID before the update |
The update_user event occurs when an existing user in the tenant is updated.
| Attribute Name | Type | Description |
|---|---|---|
| newEmail | string | New email of the user |
| newLanguage | string | New language code of the user |
| newLocale | string | New locale code of the user |
| oldEmail | string | Previous email of the user |
| oldLanguage | string | Previous language code of the user |
| oldLocale | string | Previous locale code of the user |
| userId | string | Unique ID of the user added |
| userName | string | User name of the user added to the tenant |
The update_user_site_role event occurs when a user’s access to a site is updated, either by adding, changing, or removing their site role.
| Attribute Name | Type | Description |
|---|---|---|
| string | Email of the user added to the tenant | |
| newIdp | string | New authentication method assigned to the site user, or null if the user is being removed from the site. |
| newRole | string | New role of the user on the site, or null if the user is being removed from the site. |
| oldIdp | string | Previous authentication method assigned to the site user, or null if the user didn't previously have a role on the site. |
| oldRole | string | Previous role of the user on the site, or null if the user didn’t previously have a role on the site. |
| userId | string | The unique identifier of the user |
| userName | string | User name of the user added to the site |
The update_user_tenant_role event occurs when a user’s access to a tenant is updated by adding, changing, or removing the cloud administrator role.
| Attribute Name | Type | Description |
|---|---|---|
| string | Email of the user added to the tenant | |
| newIdp | string | New authentication method assigned to the tenant user, or null if the user is being removed from the tenant. |
| newRole | string | New role of the user on the tenant, or null if the user is being removed from the tenant. |
| oldIdp | string | Previous authentication method assigned to the tenant user, or null if the user didn't previously have a role on the tenant. |
| oldRole | string | Previous role of the user on the tenant, or null if the user didn’t previously have a role on the tenant. |
| userId | string | The unique identifier of the user |
| userName | string | User name of the user added to the tenant |
The user_login_create_session event occurs when a user signs in to Tableau Cloud Manager (TCM) through the sign-in page or other interactive login.
| Attribute Name | Type | Description |
|---|---|---|
| expiresAt | string | Timestamp when the session expires. Not included if the creation attempt failed. |
| idpId | string | ID of the IdP, indicating how the user is authenticated. |
| idpName | string | Name of the IdP, indicating how the user is authenticated. |
| newSessionId | string | New ID of the session key. Not included if the creation attempt failed. |