{"title":"Audit Log Object Reference","slug":"audit-log-object-reference","url":"https://support.storeconnect.com/articles/audit-log-object-reference","url_markdown":"https://support.storeconnect.com/articles/audit-log-object-reference.md","subtitle":null,"summary":"The Audit Log object, an append-only record of one security-related action such as a login, logout, password reset, invitation, or payment attempt. StoreConnect writes these automatically from Salesforce, the online store, and POS. Use this reference when querying or reporting on audit history.","type":"Developer_Documentation","video_url":"","keywords":"salesforce, object reference, Audit Log, s_c__Audit_Log__c, api","last_modified":"2026-08-27T23:41:32+0000","body_markdown":"## Overview\n\nAn immutable, append-only record of a single security-related action in StoreConnect, such as a login, logout, password reset, invitation, email or password change, or payment attempt. Audit Logs are written automatically, either recorded in Salesforce or synced from your online store and POS. Each one is classified by **Category** and **Severity** from the Audit Event catalog, and retained on a configurable per-event-type schedule. Records are create-only by design: they are never edited or deleted by users.\n\n| Property | Value |\n|----------|-------|\n| **API Name** | `s_c__Audit_Log__c` |\n| **Label** | Audit Log |\n| **Plural Label** | Audit Logs |\n| **Type** | Custom Object |\n\n## Fields\n\n| Field Label | API Name | Type | Required | Description |\n|-------------|----------|------|----------|-------------|\n| Account | `s_c__Account_Id__c` | Lookup ([Account](account-object-reference)) | No | Lookup to the Account the event concerns. One of several optional relationship fields; more than one may be set on a single record. |\n| Actor Contact | `s_c__Actor_Contact_Id__c` | Lookup ([Contact](contact-object-reference)) | No | Lookup to the Contact that performed the action, when applicable. May be blank for User- or System-initiated events, or if the Contact was later deleted — see Actor Label and Actor Email for the durable snapshot. |\n| Actor Email | `s_c__Actor_Email__c` | Text(255) | No | A point-in-time snapshot of the actor's email, stored as plain text so the record stays accurate even if the actor's email later changes or the related record is deleted. |\n| Actor Label | `s_c__Actor_Label__c` | Text(255) | No | A point-in-time snapshot of the actor's display name, stored as plain text so the historical record survives later renaming or deletion of the related Contact or User. For System actors, names the process. |\n| Actor Type | `s_c__Actor_Type__c` | Picklist | No | Identifies the nature of the actor — a Contact (storefront or POS customer/staff), a Salesforce User (admin), or System (an automated process with no human actor). |\n| Actor User | `s_c__Actor_User_Id__c` | Lookup ([User](user-object-reference)) | No | Lookup to the Salesforce User that performed the action, typically for admin-initiated events. May be blank for Contact- or System-initiated events, or if the User was later deactivated or deleted. |\n| Cart | `s_c__Cart_Id__c` | Lookup ([s_c__Cart__c](cart-object-reference)) | No | Lookup to the Cart the event concerns — for example a failed payment attempt during checkout before an order exists. One of several optional relationship fields. |\n| Category | `s_c__Category__c` | Picklist | No | The event's functional category (Authentication, Password, Invitation, Account Changes, Payments, POS, Custom), resolved from the Audit Event catalog when the record is written. Used for per-store category filtering and for reporting. |\n| Channel | `s_c__Channel__c` | Picklist | No | The channel the action occurred on — web (storefront), pos (point of sale), admin (Salesforce console), api, or system (automated). Helps distinguish shopper actions from staff and admin actions. |\n| Contact | `s_c__Contact_Id__c` | Lookup ([Contact](contact-object-reference)) | No | Lookup to the Contact the event concerns — often the subject of the action, such as the invited or password-reset Contact. Distinct from Actor Contact, which is who performed the action. |\n| Custom Event Name | `s_c__Custom_Event_Name__c` | Text(255) | No | Holds the specific name of a client-defined custom event (for example one emitted from a Liquid theme) when Event Type is 'custom'. Blank for standard StoreConnect events. |\n| Details | `s_c__Details__c` | LongTextArea(32768) | No | JSON payload with extra context for the event, such as old and new email or gateway response codes. Not used for passwords, tokens, card data or session secrets. |\n| Event Link | `s_c__Event_Link__c` | Url | No | Link to this event in the source system (e.g. the fraud provider's dashboard or a payment gateway console). |\n| Event Type | `s_c__Event_Type__c` | Picklist | No | The key identifying what happened. Drives the Category, Severity and retention period applied via the Audit Event catalog. Intentionally an unrestricted picklist so new event types from your online store are recorded without error; unrecognized values are classified as custom. |\n| IP Address | `s_c__Ip_Address__c` | Text(45) | No | The IP address the action came from, when available, to support security investigation. |\n| Message | `s_c__Message__c` | Text(255) | No | A brief, human-readable summary of the event for quick scanning in list views and on the record. Detailed or structured context belongs in Details. |\n| Occurred At Precise | `s_c__Occurred_At_Precise__c` | Text(40) | No | The exact time of the event as an ISO-8601 UTC text value (microseconds for events from your online store or POS; milliseconds for events recorded in Salesforce). Salesforce date/time fields only store whole seconds, so this field is deliberately duplicated from Occurred At to order events that happen within the same second; use Occurred At for date filtering and reporting. |\n| Occurred At | `s_c__Occurred_At__c` | DateTime | No | The date and time the event actually happened, recorded where it occurred. Prefer this over Created Date, which shows when the record reached Salesforce and can lag behind. |\n| Order | `s_c__Order_Id__c` | Lookup ([Order](order-object-reference)) | No | Lookup to the Order the event concerns (for example a payment attempted against an order). One of several optional relationship fields. |\n| Outcome | `s_c__Outcome__c` | Picklist | No | The result of the attempted action. success/failure/pending cover authentication, account and payment events; monitored, enforced, flagged, failed_open and failed_closed are risk-screening verdicts; updated is a provider webhook revising an earlier decision. Drives reporting rollups such as failed-login, failed-payment and fraud-review views. |\n| Outlet | `s_c__Outlet_Id__c` | Lookup ([s_c__Outlet__c](outlet-object-reference)) | No | The outlet (POS location) this event concerns — for example a register login or logout at a specific outlet location. One of several optional relationship fields. |\n| Payment | `s_c__Payment_Id__c` | Lookup ([s_c__Payment__c](payment-object-reference)) | No | Lookup to the Payment the event concerns (for example payment attempted, succeeded, or failed). One of several optional relationship fields. |\n| Register | `s_c__Register_Id__c` | Lookup ([s_c__Register__c](register-object-reference)) | No | The POS register this event concerns — for example a register login or logout event at a specific terminal. One of several optional relationship fields. |\n| Register Shift | `s_c__Register_Shift_Id__c` | Lookup ([s_c__Register_Shift__c](register-shift-object-reference)) | No | The POS register shift this event concerns — for example a shift opening or a shift close with its banking reconciliation. One of several optional relationship fields. |\n| Severity | `s_c__Severity__c` | Picklist | No | The event's severity (INFO \u003c NOTICE \u003c WARNING \u003c CRITICAL), resolved from the Audit Event catalog. Compared against the Store's Audit Log Level threshold to decide whether the event is recorded. |\n| Store | `s_c__Store_Id__c` | Lookup ([s_c__Store__c](store-object-reference)) | No | Lookup to the Store the event concerns. Also the partition used for per-store log-level and category gating, the retention floor, and store-scoped reporting. |\n| User Agent | `s_c__User_Agent__c` | LongTextArea(2048) | No | The user-agent string of the originating request, when available, to help identify the device or client involved in a security event. |\n| StoreConnect External ID | `s_c__sC_Id__c` | Text(36) | No | StoreConnect External ID, do not modify in Salesforce |\n\n## Relationships\n\n| Field | Type | Related Object | Relationship Name |\n|-------|------|----------------|-------------------|\n| `s_c__Account_Id__c` | Lookup | [Account](account-object-reference) | Audit_Logs_Account |\n| `s_c__Actor_Contact_Id__c` | Lookup | [Contact](contact-object-reference) | Audit_Logs_Actor_Contact |\n| `s_c__Actor_User_Id__c` | Lookup | [User](user-object-reference) | Audit_Logs_Actor_User |\n| `s_c__Cart_Id__c` | Lookup | [s_c__Cart__c](cart-object-reference) | Audit_Logs_Cart |\n| `s_c__Contact_Id__c` | Lookup | [Contact](contact-object-reference) | Audit_Logs_Contact |\n| `s_c__Order_Id__c` | Lookup | [Order](order-object-reference) | Audit_Logs_Order |\n| `s_c__Outlet_Id__c` | Lookup | [s_c__Outlet__c](outlet-object-reference) | Audit_Logs_Outlet |\n| `s_c__Payment_Id__c` | Lookup | [s_c__Payment__c](payment-object-reference) | Audit_Logs_Payment |\n| `s_c__Register_Id__c` | Lookup | [s_c__Register__c](register-object-reference) | Audit_Logs_Register |\n| `s_c__Register_Shift_Id__c` | Lookup | [s_c__Register_Shift__c](register-shift-object-reference) | Audit_Logs_Register_Shift |\n| `s_c__Store_Id__c` | Lookup | [s_c__Store__c](store-object-reference) | Audit_Logs_Store |"}