Captures user activity logs within a specified time frame, enabling auditing, compliance tracking, troubleshooting, security monitoring, and forensic analysis of system interactions.

Table Specific Information

Select

The Workday provider requires filtering on From_Prompt and To_Prompt in order to perform the query.

For example:

SELECT * FROM ActivityLogging WHERE From_Prompt = '01-03-2025' AND To_Prompt = '01-04-2025';

Workday Resource Information

Retrieves all user activity log entries in a specified time frame. You can filter the log entries by user and task.

The from and to parameters are required.

To tune the performance and to ensure that you retrieve the complete set of records in a time period, iteratively call the GET /activityLogging endpoint with the following recommended parameter values:

* limit=1000 (Note that the maximum value of the limit parameter has been increased from 100 to 1000.)

* offset=0 (Initially set to 0, then increment by 1000 in subsequent runs.)

* instancesReturned=1 (A lower value is more performant. The value of 1 fetches 10,000 records.)

Examples of iterative calls:
GET /activityLogging?from=2022-04-17T08:15:00Z&to=2022-04-17T09:15:00Z&limit=1000&instancesReturned=1&offset=0
GET /activityLogging?from=2022-04-17T08:15:00Z&to=2022-04-17T09:15:00Z&limit=1000&instancesReturned=1&offset=1000
GET /activityLogging?from=2022-04-17T08:15:00Z&to=2022-04-17T09:15:00Z&limit=1000&instancesReturned=1&offset=2000

For more details, see the User Activity Logging REST API Guide in the Administrator Guide.

Secured by: System Auditing

Scope: System

Columns

Name	Type	Description
ActivityAction	String	The type of action that was executed within the system. This value indicates the specific operation performed, such as login, logout, data retrieval, or modification.
DeviceType	String	The type of device used during the user sign-on that initiated the request. This value helps identify whether the action was performed from a desktop, mobile device, or other platform.
IpAddress	String	The IP address of the user from the sign-on session that was used to make the request. This value helps track user activity and enhance security monitoring.
RequestTime	Datetime	The exact date and time when the action was requested. This timestamp is used for logging, auditing, and monitoring system interactions.
SessionId	String	The unique system-generated identifier (Id) for tracking user sign-ons. This Id links activity logs to specific user sessions for accountability and security analysis.
SystemAccount	String	The system account that initiated the request. This value identifies whether the request originated from a personal user account or an automated system process.
Target_Descriptor	String	A human-readable summary of the target entity affected by the request. This summary provides context on the specific object, record, or resource that was accessed or modified.
Target_Href	String	A direct link to the target entity associated with the logged action. This link provides programmatic access to retrieve additional details about the affected resource.
Target_Id	String	The unique Id for the target entity affected by the action. This Id ensures accurate tracking of changes and interactions with system resources.
TaskDisplayName	String	The human-readable name of the action executed in the transaction. This value provides a descriptive label for the logged task.
TaskId	String	The unique Id for the task executed in the transaction. This Id links activity logs to specific tasks performed within the system.
UserActivityEntryCount	Decimal	The total number of user activity instances recorded for the specified filter parameters. This count helps in generating system usage reports and monitoring user interactions.
UserAgent	String	The client browser and operating system details from the user sign-on used to make this request. This value helps track device-specific activity and system compatibility.
From_Prompt	Date	(Required) The start date and time for filtering log entries, using the format '{YYYY}-{MM}-{DD}T{HH}:{MM}:{SS}Z'. The default timezone is UTC/GMT. This parameter determines the earliest recorded activity included in the results.
InstancesReturned_Prompt	Long	The number of user activity instances requested, calculated as this value multiplied by 10,000. For example, a value of '5' requests a maximum of 50,000 instances. The default and maximum values are '25', meaning the system can retrieve up to 250,000 instances. Adjusting this value can optimize performance.
ReturnUserActivityEntryCount_Prompt	Bool	Indicates whether to return only the total count of user activity instances for the specified parameters. A value of 'true' retrieves only the count, while a value of 'false' returns detailed activity records.
SystemAccount_Prompt	String	Filters user activity logs based on the specified system account. This value helps narrow results to actions performed by a particular account.
TaskId_Prompt	String	Filters user activity logs based on the specified task Id. This value retrieves logs related to a specific task execution.
To_Prompt	Date	(Required) The end date and time for filtering log entries, using the format '{YYYY}-{MM}-{DD}T{HH}:{MM}:{SS}Z'. The default timezone is UTC/GMT. This parameter determines the latest recorded activity included in the results.