UserEvents
Provides a record of user activity events in Box, such as logins, file uploads, shares, and collaborations.
Table Specific Information
User events are logs that are saved after a change in a user's account.
Select
Query all the current user's events:
SELECT * FROM UserEvents;
If you're authenticated as an administrator with user impersonation permissions, you can query user events from multiple user accounts:
SELECT * FROM UserEvents WHERE AsUserId IN (SELECT Id FROM Users);
Note: User impersonation has the following limitations:
- The authenticated user cannot be impersonated unless that user is a service account.
- If the authenticated user is a standard user account, they can only query user events associated with their account.
- User events shared with multiple users are only returned for one of the users.
Columns
| Name | Type | Description |
| Id [KEY] | String | The unique identifier of the event. |
| SourceId | String | The identifier of the source object (such as a file, folder, or user) that triggered the event. |
| SourceType | String | The type of source object that triggered the event, such as file, folder, or user. |
| CreatedById | String | The Id of the user who initiated the event. |
| CreatedByName | String | The name of the user who initiated the event. |
| CreatedByLogin | String | The login (email) of the user who initiated the event. |
| CreatedAt | Datetime | The timestamp when the event occurred. This column is only available when streaming events with a StreamType of admin_logs. |
| RecordedAt | Datetime | The timestamp when the event was logged in the system. |
| SessionId | String | The identifier for the user session associated with the event. |
| EventType | String | The type or category of the event, such as file download, item deletion, or login. |
| ClassificationName | String | The security classification name or label associated with the event, if available. |
| AdditionalDetails | String | Supplementary metadata about the event, which may include details on how it was performed or external correlation data. Available only for Enterprise Events, and not all events include this object. |
| AsUserId | String | The Id of the user to impersonate when retrieving events. Only works with Admin, Co-Admin, and Service Accounts. |
Pseudo-Columns
Pseudo column fields are used in the WHERE clause of SELECT statements and offer a more granular control over the tuples that are returned from the data source.
| Name | Type | Description |
| StreamType | String | Specifies which type of event stream to use, such as admin_logs for enterprise-level events or user for individual user activity.
The allowed values are all, changes, sync, admin_logs, admin_logs_streaming. |