Admin Audit Activity Events - User Settings
This document lists the events and parameters for
User Settings
Admin Audit activity events. You can retrieve these events by
calling Activities.list()
with applicationName=admin.
User Settings
Events of this type are returned with type=USER_SETTINGS.
2-step Verification Scratch Codes Deletion
| Event details |
| Event name |
DELETE_2SV_SCRATCH_CODES |
| Parameters |
USER_EMAIL |
string
The user's primary email address.
|
|
| Sample request |
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/admin?eventName=DELETE_2SV_SCRATCH_CODES&maxResults=10&access_token=YOUR_ACCESS_TOKEN
|
| Admin Console message format |
2-step verification scratch codes of the user {USER_EMAIL} deleted
|
2-step Verification Scratch Codes Generate
| Event details |
| Event name |
GENERATE_2SV_SCRATCH_CODES |
| Parameters |
USER_EMAIL |
string
The user's primary email address.
|
|
| Sample request |
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/admin?eventName=GENERATE_2SV_SCRATCH_CODES&maxResults=10&access_token=YOUR_ACCESS_TOKEN
|
| Admin Console message format |
New 2-step verification scratch codes generated for the user {USER_EMAIL}
|
3-legged OAuth Device Tokens Revoke
| Event details |
| Event name |
REVOKE_3LO_DEVICE_TOKENS |
| Parameters |
DEVICE_ID |
string
The device's ID.
|
DEVICE_TYPE |
string
The device's type.
|
USER_EMAIL |
string
The user's primary email address.
|
|
| Sample request |
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/admin?eventName=REVOKE_3LO_DEVICE_TOKENS&maxResults=10&access_token=YOUR_ACCESS_TOKEN
|
| Admin Console message format |
3-legged OAuth tokens issued by user {USER_EMAIL} for the device type {DEVICE_TYPE} and id {DEVICE_ID} were revoked
|
3-legged OAuth Token Revoke
| Event details |
| Event name |
REVOKE_3LO_TOKEN |
| Parameters |
APP_ID |
string
The application ID whose access is managed by the token.
|
USER_EMAIL |
string
The user's primary email address.
|
|
| Sample request |
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/admin?eventName=REVOKE_3LO_TOKEN&maxResults=10&access_token=YOUR_ACCESS_TOKEN
|
| Admin Console message format |
3-legged OAuth tokens issued by user {USER_EMAIL} for application {APP_ID} were revoked
|
Accept User Invite
| Event details |
| Event name |
ACCEPT_USER_INVITATION |
| Parameters |
USER_EMAIL |
string
The user's primary email address.
|
|
| Sample request |
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/admin?eventName=ACCEPT_USER_INVITATION&maxResults=10&access_token=YOUR_ACCESS_TOKEN
|
| Admin Console message format |
User invitation accepted for user: {USER_EMAIL}
|
Add Recovery Email
| Event details |
| Event name |
ADD_RECOVERY_EMAIL |
| Parameters |
USER_EMAIL |
string
The user's primary email address.
|
|
| Sample request |
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/admin?eventName=ADD_RECOVERY_EMAIL&maxResults=10&access_token=YOUR_ACCESS_TOKEN
|
| Admin Console message format |
Recovery email added for {USER_EMAIL}
|
Add Recovery Phone
| Event details |
| Event name |
ADD_RECOVERY_PHONE |
| Parameters |
USER_EMAIL |
string
The user's primary email address.
|
|
| Sample request |
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/admin?eventName=ADD_RECOVERY_PHONE&maxResults=10&access_token=YOUR_ACCESS_TOKEN
|
| Admin Console message format |
Recovery phone added for {USER_EMAIL}
|
Admin Privileges Grant
| Event details |
| Event name |
GRANT_ADMIN_PRIVILEGE |
| Parameters |
USER_EMAIL |
string
The user's primary email address.
|
|
| Sample request |
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/admin?eventName=GRANT_ADMIN_PRIVILEGE&maxResults=10&access_token=YOUR_ACCESS_TOKEN
|
| Admin Console message format |
Admin privileges granted to {USER_EMAIL}
|
Admin Privileges Revoke
| Event details |
| Event name |
REVOKE_ADMIN_PRIVILEGE |
| Parameters |
USER_EMAIL |
string
The user's primary email address.
|
|
| Sample request |
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/admin?eventName=REVOKE_ADMIN_PRIVILEGE&maxResults=10&access_token=YOUR_ACCESS_TOKEN
|
| Admin Console message format |
Admin privileges revoked from {USER_EMAIL}
|
Application Specific Password Revoke
| Event details |
| Event name |
REVOKE_ASP |
| Parameters |
ASP_ID |
string
The application specific password ID.
|
USER_EMAIL |
string
The user's primary email address.
|
|
| Sample request |
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/admin?eventName=REVOKE_ASP&maxResults=10&access_token=YOUR_ACCESS_TOKEN
|
| Admin Console message format |
Application specific password with Id {ASP_ID} issued by user {USER_EMAIL} revoked
|
| Event details |
| Event name |
TOGGLE_AUTOMATIC_CONTACT_SHARING |
| Parameters |
NEW_VALUE |
string
The setting value, either true or false.
|
USER_EMAIL |
string
The user's primary email address.
|
|
| Sample request |
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/admin?eventName=TOGGLE_AUTOMATIC_CONTACT_SHARING&maxResults=10&access_token=YOUR_ACCESS_TOKEN
|
| Admin Console message format |
Automatic contact sharing for {USER_EMAIL} changed to {NEW_VALUE}
|
Bulk Upload
| Event details |
| Event name |
BULK_UPLOAD |
| Parameters |
BULK_UPLOAD_FAIL_USERS_NUMBER |
string
The number of users who did not successfully upload to the domain.
|
BULK_UPLOAD_TOTAL_USERS_NUMBER |
string
The number of total users being uploaded.
|
DOMAIN_NAME |
string
The primary domain name where users are being moved.
|
|
| Sample request |
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/admin?eventName=BULK_UPLOAD&maxResults=10&access_token=YOUR_ACCESS_TOKEN
|
| Admin Console message format |
{BULK_UPLOAD_TOTAL_USERS_NUMBER} users selected for upload to your organization. {BULK_UPLOAD_FAIL_USERS_NUMBER} out of {BULK_UPLOAD_TOTAL_USERS_NUMBER} users were not uploaded.
|
Bulk Upload Notification
| Event details |
| Event name |
BULK_UPLOAD_NOTIFICATION_SENT |
| Parameters |
DOMAIN_NAME |
string
The primary domain name where users were uploaded.
|
USER_EMAIL |
string
The primary email address of user who was sent notification of bulk upload event.
|
|
| Sample request |
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/admin?eventName=BULK_UPLOAD_NOTIFICATION_SENT&maxResults=10&access_token=YOUR_ACCESS_TOKEN
|
| Admin Console message format |
Notification of bulk users upload sent to {USER_EMAIL}
|
Cancel User Invite
| Event details |
| Event name |
CANCEL_USER_INVITE |
| Parameters |
DOMAIN_NAME |
string
The primary domain name.
|
USER_EMAIL |
string
The primary email address of the user whose invitation is being cancelled.
|
|
| Sample request |
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/admin?eventName=CANCEL_USER_INVITE&maxResults=10&access_token=YOUR_ACCESS_TOKEN
|
| Admin Console message format |
Invite to {USER_EMAIL} cancelled
|
Change Custom Attribute
| Event details |
| Event name |
CHANGE_USER_CUSTOM_FIELD |
| Parameters |
NEW_VALUE |
string
The new SETTING_NAME value that was set during this event.
|
OLD_VALUE |
string
The previous SETTING_NAME value that was replaced during this event.
|
USER_CUSTOM_FIELD |
string
The name of the user's custom field.
|
USER_EMAIL |
string
The user's primary email address.
|
|
| Sample request |
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/admin?eventName=CHANGE_USER_CUSTOM_FIELD&maxResults=10&access_token=YOUR_ACCESS_TOKEN
|
| Admin Console message format |
{USER_CUSTOM_FIELD} changed for {USER_EMAIL} from {OLD_VALUE} to {NEW_VALUE}
|
Change External Id
| Event details |
| Event name |
CHANGE_USER_EXTERNAL_ID |
| Parameters |
NEW_VALUE |
string
The new SETTING_NAME value that was set during this event.
|
OLD_VALUE |
string
The previous SETTING_NAME value that was replaced during this event.
|
USER_EMAIL |
string
The user's primary email address.
|
|
| Sample request |
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/admin?eventName=CHANGE_USER_EXTERNAL_ID&maxResults=10&access_token=YOUR_ACCESS_TOKEN
|
| Admin Console message format |
External Ids changed for {USER_EMAIL} from {OLD_VALUE} to {NEW_VALUE}
|
Change Gender
Change here is a verb. The genders will be customizable, so this should be broader than male vs female.
| Event details |
| Event name |
CHANGE_USER_GENDER |
| Parameters |
NEW_VALUE |
string
The new SETTING_NAME value that was set during this event.
|
OLD_VALUE |
string
The previous SETTING_NAME value that was replaced during this event.
|
USER_EMAIL |
string
The user's primary email address.
|
|
| Sample request |
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/admin?eventName=CHANGE_USER_GENDER&maxResults=10&access_token=YOUR_ACCESS_TOKEN
|
| Admin Console message format |
Gender changed for {USER_EMAIL} from {OLD_VALUE} to {NEW_VALUE}
|
Change IM
| Event details |
| Event name |
CHANGE_USER_IM |
| Parameters |
NEW_VALUE |
string
The new SETTING_NAME value that was set during this event.
|
OLD_VALUE |
string
The previous SETTING_NAME value that was replaced during this event.
|
USER_EMAIL |
string
The user's primary email address.
|
|
| Sample request |
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/admin?eventName=CHANGE_USER_IM&maxResults=10&access_token=YOUR_ACCESS_TOKEN
|
| Admin Console message format |
IMs changed for {USER_EMAIL} from {OLD_VALUE} to {NEW_VALUE}
|
Change IP Whitelist
| Event details |
| Event name |
ENABLE_USER_IP_WHITELIST |
| Parameters |
NEW_VALUE |
string
The new SETTING_NAME value that was set during this event.
|
OLD_VALUE |
string
The previous SETTING_NAME value that was replaced during this event.
|
USER_EMAIL |
string
The user's primary email address.
|
|
| Sample request |
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/admin?eventName=ENABLE_USER_IP_WHITELIST&maxResults=10&access_token=YOUR_ACCESS_TOKEN
|
| Admin Console message format |
IP whitelist changed for {USER_EMAIL} from {OLD_VALUE} to {NEW_VALUE}
|
Change Keyword
Keywords are used on user profiles to help identify a user in searches. Example: find person with name 'Larry' and school 'Stanford'. 'Change' is a verb.
| Event details |
| Event name |
CHANGE_USER_KEYWORD |
| Parameters |
NEW_VALUE |
string
The new SETTING_NAME value that was set during this event.
|
OLD_VALUE |
string
The previous SETTING_NAME value that was replaced during this event.
|
USER_EMAIL |
string
The user's primary email address.
|
|
| Sample request |
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/admin?eventName=CHANGE_USER_KEYWORD&maxResults=10&access_token=YOUR_ACCESS_TOKEN
|
| Admin Console message format |
Keywords changed for {USER_EMAIL} from {OLD_VALUE} to {NEW_VALUE}
|
Change Language
Can be a predefined set of more common languages provided by Google or a custom language. 'Change' here is a verb.
| Event details |
| Event name |
CHANGE_USER_LANGUAGE |
| Parameters |
NEW_VALUE |
string
The new SETTING_NAME value that was set during this event.
|
OLD_VALUE |
string
The previous SETTING_NAME value that was replaced during this event.
|
USER_EMAIL |
string
The user's primary email address.
|
|
| Sample request |
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/admin?eventName=CHANGE_USER_LANGUAGE&maxResults=10&access_token=YOUR_ACCESS_TOKEN
|
| Admin Console message format |
Languages changed for {USER_EMAIL} from {OLD_VALUE} to {NEW_VALUE}
|
Change Location
Location is different from address in the following ways: (1) Location can be fuzzy. Example: Near Seattle. (2) Hovercards and other short user summaries display location, not address. 'Change' is a verb.
| Event details |
| Event name |
CHANGE_USER_LOCATION |
| Parameters |
NEW_VALUE |
string
The new SETTING_NAME value that was set during this event.
|
OLD_VALUE |
string
The previous SETTING_NAME value that was replaced during this event.
|
USER_EMAIL |
string
The user's primary email address.
|
|
| Sample request |
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/admin?eventName=CHANGE_USER_LOCATION&maxResults=10&access_token=YOUR_ACCESS_TOKEN
|
| Admin Console message format |
Locations changed for {USER_EMAIL} from {OLD_VALUE} to {NEW_VALUE}
|
Change Organization
| Event details |
| Event name |
CHANGE_USER_ORGANIZATION |
| Parameters |
NEW_VALUE |
string
The new SETTING_NAME value that was set during this event.
|
OLD_VALUE |
string
The previous SETTING_NAME value that was replaced during this event.
|
USER_EMAIL |
string
The user's primary email address.
|
|
| Sample request |
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/admin?eventName=CHANGE_USER_ORGANIZATION&maxResults=10&access_token=YOUR_ACCESS_TOKEN
|
| Admin Console message format |
Organizations changed for {USER_EMAIL} from {OLD_VALUE} to {NEW_VALUE}
|
Change Phone Numbers
| Event details |
| Event name |
CHANGE_USER_PHONE_NUMBER |
| Parameters |
NEW_VALUE |
string
The new SETTING_NAME value that was set during this event.
|
OLD_VALUE |
string
The previous SETTING_NAME value that was replaced during this event.
|
USER_EMAIL |
string
The user's primary email address.
|
|
| Sample request |
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/admin?eventName=CHANGE_USER_PHONE_NUMBER&maxResults=10&access_token=YOUR_ACCESS_TOKEN
|
| Admin Console message format |
Phone Numbers changed for {USER_EMAIL} from {OLD_VALUE} to {NEW_VALUE}
|
Change Recovery Email
| Event details |
| Event name |
CHANGE_RECOVERY_EMAIL |
| Parameters |
USER_EMAIL |
string
The user's primary email address.
|
|
| Sample request |
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/admin?eventName=CHANGE_RECOVERY_EMAIL&maxResults=10&access_token=YOUR_ACCESS_TOKEN
|
| Admin Console message format |
Recovery email changed for {USER_EMAIL}
|
Change Recovery Phone
| Event details |
| Event name |
CHANGE_RECOVERY_PHONE |
| Parameters |
USER_EMAIL |
string
The user's primary email address.
|
|
| Sample request |
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/admin?eventName=CHANGE_RECOVERY_PHONE&maxResults=10&access_token=YOUR_ACCESS_TOKEN
|
| Admin Console message format |
Recovery phone changed for {USER_EMAIL}
|
Change Relation
| Event details |
| Event name |
CHANGE_USER_RELATION |
| Parameters |
NEW_VALUE |
string
The new SETTING_NAME value that was set during this event.
|
OLD_VALUE |
string
The previous SETTING_NAME value that was replaced during this event.
|
USER_EMAIL |
string
The user's primary email address.
|
|
| Sample request |
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/admin?eventName=CHANGE_USER_RELATION&maxResults=10&access_token=YOUR_ACCESS_TOKEN
|
| Admin Console message format |
Relations changed for {USER_EMAIL} from {OLD_VALUE} to {NEW_VALUE}
|
Change User Address
| Event details |
| Event name |
CHANGE_USER_ADDRESS |
| Parameters |
NEW_VALUE |
string
The new SETTING_NAME value that was set during this event.
|
OLD_VALUE |
string
The previous SETTING_NAME value that was replaced during this event.
|
USER_EMAIL |
string
The user's primary email address.
|
|
| Sample request |
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/admin?eventName=CHANGE_USER_ADDRESS&maxResults=10&access_token=YOUR_ACCESS_TOKEN
|
| Admin Console message format |
Addresses changed for {USER_EMAIL} from {OLD_VALUE} to {NEW_VALUE}
|
Create an email monitor
| Event details |
| Event name |
CREATE_EMAIL_MONITOR |
| Parameters |
BEGIN_DATE_TIME |
string
The start date and time for the email monitor.
|
EMAIL_MONITOR_DEST_EMAIL |
string
The destination address of the email monitor.
|
EMAIL_MONITOR_LEVEL_CHAT |
string
The chat email monitor level.
|
EMAIL_MONITOR_LEVEL_DRAFT_EMAIL |
string
The draft email monitor level.
|
EMAIL_MONITOR_LEVEL_INCOMING_EMAIL |
string
The incoming email monitor level.
|
EMAIL_MONITOR_LEVEL_OUTGOING_EMAIL |
string
The outgoing email monitor level.
|
END_DATE_TIME |
string
The end date and time for the email monitor.
|
USER_EMAIL |
string
The user's primary email address.
|
|
| Sample request |
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/admin?eventName=CREATE_EMAIL_MONITOR&maxResults=10&access_token=YOUR_ACCESS_TOKEN
|
| Admin Console message format |
Created an email monitor for {USER_EMAIL} to {EMAIL_MONITOR_DEST_EMAIL} that will expire on {END_DATE_TIME}
|
Data transfer request created
| Event details |
| Event name |
CREATE_DATA_TRANSFER_REQUEST |
| Parameters |
APPLICATION_NAME |
string
A comma-separated application names for which data transfer is requested.
|
DESTINATION_USER_EMAIL |
string
The new owner's primary user email to whom to transfer user data to.
|
USER_EMAIL |
string
The user's primary email address.
|
|
| Sample request |
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/admin?eventName=CREATE_DATA_TRANSFER_REQUEST&maxResults=10&access_token=YOUR_ACCESS_TOKEN
|
| Admin Console message format |
Data transfer request created from {USER_EMAIL} to {DESTINATION_USER_EMAIL} for apps {APPLICATION_NAME}
|
Delegated Admin Privileges Grant
| Event details |
| Event name |
GRANT_DELEGATED_ADMIN_PRIVILEGES |
| Parameters |
NEW_VALUE |
string
The new delegated admin privilege.
|
USER_EMAIL |
string
The user's primary email address.
|
|
| Sample request |
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/admin?eventName=GRANT_DELEGATED_ADMIN_PRIVILEGES&maxResults=10&access_token=YOUR_ACCESS_TOKEN
|
| Admin Console message format |
{USER_EMAIL} assigned {NEW_VALUE} admin privileges
|
Delete account information dump
| Event details |
| Event name |
DELETE_ACCOUNT_INFO_DUMP |
| Parameters |
REQUEST_ID |
string
The request ID.
|
USER_EMAIL |
string
The user's primary email address.
|
|
| Sample request |
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/admin?eventName=DELETE_ACCOUNT_INFO_DUMP&maxResults=10&access_token=YOUR_ACCESS_TOKEN
|
| Admin Console message format |
Deleted account and login information dump for {USER_EMAIL} and request ID {REQUEST_ID}
|
Delete an email monitor
| Event details |
| Event name |
DELETE_EMAIL_MONITOR |
| Parameters |
EMAIL_MONITOR_DEST_EMAIL |
string
The destination address of the email monitor.
|
USER_EMAIL |
string
The user's primary email address.
|
|
| Sample request |
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/admin?eventName=DELETE_EMAIL_MONITOR&maxResults=10&access_token=YOUR_ACCESS_TOKEN
|
| Admin Console message format |
Deleted an email monitor for {USER_EMAIL} to {EMAIL_MONITOR_DEST_EMAIL}
|
Delete mailbox dump
| Event details |
| Event name |
DELETE_MAILBOX_DUMP |
| Parameters |
REQUEST_ID |
string
The request ID.
|
USER_EMAIL |
string
The user's primary email address.
|
|
| Sample request |
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/admin?eventName=DELETE_MAILBOX_DUMP&maxResults=10&access_token=YOUR_ACCESS_TOKEN
|
| Admin Console message format |
Deleted mailbox dump for {USER_EMAIL} and request ID {REQUEST_ID}
|
Delete Profile Photo
| Event details |
| Event name |
DELETE_PROFILE_PHOTO |
| Parameters |
USER_EMAIL |
string
The user's primary email address.
|
|
| Sample request |
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/admin?eventName=DELETE_PROFILE_PHOTO&maxResults=10&access_token=YOUR_ACCESS_TOKEN
|
| Admin Console message format |
Profile photo of {USER_EMAIL} has been deleted
|
Display Name Added
| Event details |
| Event name |
ADD_DISPLAY_NAME |
| Parameters |
USER_DISPLAY_NAME |
string
User display name.
|
USER_EMAIL |
string
The user's primary email address.
|
|
| Sample request |
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/admin?eventName=ADD_DISPLAY_NAME&maxResults=10&access_token=YOUR_ACCESS_TOKEN
|
| Admin Console message format |
{USER_DISPLAY_NAME} added as a display name of {USER_EMAIL}
|
Display Name Change
| Event details |
| Event name |
CHANGE_DISPLAY_NAME |
| Parameters |
NEW_VALUE |
string
The new SETTING_NAME value that was set during this event.
|
OLD_VALUE |
string
The previous SETTING_NAME value that was replaced during this event.
|
USER_EMAIL |
string
The user's primary email address.
|
|
| Sample request |
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/admin?eventName=CHANGE_DISPLAY_NAME&maxResults=10&access_token=YOUR_ACCESS_TOKEN
|
| Admin Console message format |
Display name of {USER_EMAIL} changed from {OLD_VALUE} to {NEW_VALUE}
|
Display Name Removed
| Event details |
| Event name |
REMOVE_DISPLAY_NAME |
| Parameters |
USER_DISPLAY_NAME |
string
User display name.
|
USER_EMAIL |
string
The user's primary email address.
|
|
| Sample request |
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/admin?eventName=REMOVE_DISPLAY_NAME&maxResults=10&access_token=YOUR_ACCESS_TOKEN
|
| Admin Console message format |
{USER_DISPLAY_NAME} removed as a display name of {USER_EMAIL}
|
First Name Change
| Event details |
| Event name |
CHANGE_FIRST_NAME |
| Parameters |
NEW_VALUE |
string
The user's new first name.
|
OLD_VALUE |
string
The user's previous first name.
|
USER_EMAIL |
string
The user's primary email address.
|
|
| Sample request |
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/admin?eventName=CHANGE_FIRST_NAME&maxResults=10&access_token=YOUR_ACCESS_TOKEN
|
| Admin Console message format |
First name of {USER_EMAIL} changed from {OLD_VALUE} to {NEW_VALUE}
|
Gmail Account Reset
| Event details |
| Event name |
GMAIL_RESET_USER |
| Parameters |
GMAIL_RESET_REASON |
string
Gmail's reason for resetting the account.
|
USER_EMAIL |
string
The user's primary email address.
|
|
| Sample request |
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/admin?eventName=GMAIL_RESET_USER&maxResults=10&access_token=YOUR_ACCESS_TOKEN
|
| Admin Console message format |
Gmail account of {USER_EMAIL} reset
|
Last Name Change
| Event details |
| Event name |
CHANGE_LAST_NAME |
| Parameters |
NEW_VALUE |
string
The user's new last name.
|
OLD_VALUE |
string
The user's previous last name.
|
USER_EMAIL |
string
The user's primary email address.
|
|
| Sample request |
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/admin?eventName=CHANGE_LAST_NAME&maxResults=10&access_token=YOUR_ACCESS_TOKEN
|
| Admin Console message format |
Last name of {USER_EMAIL} changed from {OLD_VALUE} to {NEW_VALUE}
|
Mail Routing Destination Creation
| Event details |
| Event name |
MAIL_ROUTING_DESTINATION_ADDED |
| Parameters |
NEW_VALUE |
string
The new routing destination.
|
USER_EMAIL |
string
The user's primary email address.
|
|
| Sample request |
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/admin?eventName=MAIL_ROUTING_DESTINATION_ADDED&maxResults=10&access_token=YOUR_ACCESS_TOKEN
|
| Admin Console message format |
User {USER_EMAIL} has received the following individual mail routing destination: {NEW_VALUE}
|
Mail Routing Destination Deletion
| Event details |
| Event name |
MAIL_ROUTING_DESTINATION_REMOVED |
| Parameters |
OLD_VALUE |
string
The previous routing destination.
|
USER_EMAIL |
string
The user's primary email address.
|
|
| Sample request |
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/admin?eventName=MAIL_ROUTING_DESTINATION_REMOVED&maxResults=10&access_token=YOUR_ACCESS_TOKEN
|
| Admin Console message format |
User {USER_EMAIL} has had the following individual mail routing destination removed: {OLD_VALUE}
|
Nickname Creation
| Event details |
| Event name |
ADD_NICKNAME |
| Parameters |
USER_EMAIL |
string
The primary user email.
|
USER_NICKNAME |
string
The user's nickname. For Admin console information, see the administration help center.
|
|
| Sample request |
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/admin?eventName=ADD_NICKNAME&maxResults=10&access_token=YOUR_ACCESS_TOKEN
|
| Admin Console message format |
{USER_NICKNAME} created as a nickname of {USER_EMAIL}
|
Nickname Deletion
| Event details |
| Event name |
REMOVE_NICKNAME |
| Parameters |
USER_EMAIL |
string
The user's primary email address.
|
USER_NICKNAME |
string
The user's previous nickname.
|
|
| Sample request |
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/admin?eventName=REMOVE_NICKNAME&maxResults=10&access_token=YOUR_ACCESS_TOKEN
|
| Admin Console message format |
{USER_NICKNAME} deleted as a nickname of {USER_EMAIL}
|
Passkey revoked
| Event details |
| Event name |
PASSKEY_REVOKED |
| Parameters |
enrollment_type |
string
Describers whether the passkey was enrolled by user or created automatically.
Possible values:
automatically_created
Passkey enrolled automatically on android device.user_created
Passkey enrolled by end user.
|
passkey_added_from |
string
Location from where the passkey was added.
|
passkey_added_on_timestamp |
integer
Timestamp when the passkey was added.
|
passkey_last_used_from |
string
Location from where was the passkey last used.
|
passkey_last_used_timestamp |
integer
Timestamp when the passkey was last used.
|
platform_or_device |
string
Platform or device used for creating the passkey.
Possible values:
apple_icloud_keychain
Passkey created using apple icloud keychain.bitwarden
Passkey created using bitwarden.chrome_on_mac
Passkey created using chrome on mac.chrome_os
Passkey created using chrome os.dashlane
Passkey created using dashlane.edge_on_mac
Passkey created using Edge on Mac.generic_passkey
Passkey type generic passkey description.generic_usb_key
Passkey created using FIDO2 security key.generic_usb_up_key
Passkey created using security key.google_account_passkey_on_android
Passkey created using android device.google_password_manager
Passkey created using google password manager.keeper
Passkey created using keeper.nordpass
Passkey created using nordpass.one_password
Passkey created using 1Password.samsung_pass
Passkey created using Samsung pass.titan_key
Passkey created using titan security key.windows_hello
Passkey created using windows hello.yubikey
Passkey created using yubico security key.
|
supports_passwordless |
boolean
Whether the passkey can be used to skip password.
|
USER_EMAIL |
string
The user's primary email address.
|
|
| Sample request |
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/admin?eventName=PASSKEY_REVOKED&maxResults=10&access_token=YOUR_ACCESS_TOKEN
|
| Admin Console message format |
A passkey enrolled for user {USER_EMAIL} was revoked
|
Password Change
| Event details |
| Event name |
CHANGE_PASSWORD |
| Parameters |
USER_EMAIL |
string
The user's primary email address.
|
|
| Sample request |
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/admin?eventName=CHANGE_PASSWORD&maxResults=10&access_token=YOUR_ACCESS_TOKEN
|
| Admin Console message format |
Password changed for {USER_EMAIL}
|
Password Change on Next Login
| Event details |
| Event name |
CHANGE_PASSWORD_ON_NEXT_LOGIN |
| Parameters |
NEW_VALUE |
string
Indicates whether the user must change their password on their next login; can be true or false.
|
OLD_VALUE |
string
The previous setting value; can be true or false.
|
USER_EMAIL |
string
The user's primary email address.
|
|
| Sample request |
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/admin?eventName=CHANGE_PASSWORD_ON_NEXT_LOGIN&maxResults=10&access_token=YOUR_ACCESS_TOKEN
|
| Admin Console message format |
Password change requirement for {USER_EMAIL} on next login changed from {OLD_VALUE} to {NEW_VALUE}
|
Pending Invites List Download
| Event details |
| Event name |
DOWNLOAD_PENDING_INVITES_LIST |
| Sample request |
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/admin?eventName=DOWNLOAD_PENDING_INVITES_LIST&maxResults=10&access_token=YOUR_ACCESS_TOKEN
|
| Admin Console message format |
Pending Invites List was downloaded as a CSV file
|
Public Key Certificate Status Updated
| Event details |
| Event name |
UPDATE_PUBLIC_KEY_CERTIFICATE_STATUS |
| Parameters |
PUBLIC_KEY_CERTIFICATE_STATUS |
string
Public key certificate status.
|
USER_EMAIL |
string
The user's primary email address.
|
USER_IMPACTED_EMAIL |
string
User impacted email.
|
|
| Sample request |
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/admin?eventName=UPDATE_PUBLIC_KEY_CERTIFICATE_STATUS&maxResults=10&access_token=YOUR_ACCESS_TOKEN
|
| Admin Console message format |
Public key certificate status updated to {PUBLIC_KEY_CERTIFICATE_STATUS} for email {USER_IMPACTED_EMAIL} of user {USER_EMAIL}
|
Public Key Certificate Updated
| Event details |
| Event name |
UPDATE_PUBLIC_KEY_CERTIFICATE |
| Parameters |
USER_EMAIL |
string
The user's primary email address.
|
USER_IMPACTED_EMAIL |
string
User impacted email.
|
|
| Sample request |
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/admin?eventName=UPDATE_PUBLIC_KEY_CERTIFICATE&maxResults=10&access_token=YOUR_ACCESS_TOKEN
|
| Admin Console message format |
Public key certificate updated for {USER_DISPLAY_NAME} email {USER_EMAIL}
|
Remove Recovery Email
| Event details |
| Event name |
REMOVE_RECOVERY_EMAIL |
| Parameters |
USER_EMAIL |
string
The user's primary email address.
|
|
| Sample request |
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/admin?eventName=REMOVE_RECOVERY_EMAIL&maxResults=10&access_token=YOUR_ACCESS_TOKEN
|
| Admin Console message format |
Recovery email removed for {USER_EMAIL}
|
Remove Recovery Phone
| Event details |
| Event name |
REMOVE_RECOVERY_PHONE |
| Parameters |
USER_EMAIL |
string
The user's primary email address.
|
|
| Sample request |
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/admin?eventName=REMOVE_RECOVERY_PHONE&maxResults=10&access_token=YOUR_ACCESS_TOKEN
|
| Admin Console message format |
Recovery phone removed for {USER_EMAIL}
|
Request account information
| Event details |
| Event name |
REQUEST_ACCOUNT_INFO |
| Parameters |
USER_EMAIL |
string
The user's primary email address.
|
|
| Sample request |
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/admin?eventName=REQUEST_ACCOUNT_INFO&maxResults=10&access_token=YOUR_ACCESS_TOKEN
|
| Admin Console message format |
Requested account and login information for {USER_EMAIL}
|
Request mailbox dump
| Event details |
| Event name |
REQUEST_MAILBOX_DUMP |
| Parameters |
BEGIN_DATE_TIME |
string
The start date and time for the email monitor.
|
EMAIL_EXPORT_INCLUDE_DELETED |
string
Indicates if deleted emails are included in the export.
|
EMAIL_EXPORT_PACKAGE_CONTENT |
string
The contents of the mailbox package.
|
END_DATE_TIME |
string
The end date and time for the email monitor.
|
SEARCH_QUERY_FOR_DUMP |
string
The search query used for the dump.
|
USER_EMAIL |
string
The user's primary email address.
|
|
| Sample request |
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/admin?eventName=REQUEST_MAILBOX_DUMP&maxResults=10&access_token=YOUR_ACCESS_TOKEN
|
| Admin Console message format |
Requested mailbox dump for {USER_EMAIL}
|
Resend User Invite
| Event details |
| Event name |
RESEND_USER_INVITE |
| Parameters |
DOMAIN_NAME |
string
The primary domain name.
|
USER_EMAIL |
string
The user's primary email address.
|
|
| Sample request |
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/admin?eventName=RESEND_USER_INVITE&maxResults=10&access_token=YOUR_ACCESS_TOKEN
|
| Admin Console message format |
Invite email to {USER_EMAIL} resent
|
Reset Cookies and Forced Relogin
| Event details |
| Event name |
RESET_SIGNIN_COOKIES |
| Parameters |
USER_EMAIL |
string
The user's primary email address.
|
|
| Sample request |
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/admin?eventName=RESET_SIGNIN_COOKIES&maxResults=10&access_token=YOUR_ACCESS_TOKEN
|
| Admin Console message format |
Cookies reset for {USER_EMAIL} and forced re-login
|
Security Key Registered For User
| Event details |
| Event name |
SECURITY_KEY_REGISTERED_FOR_USER |
| Parameters |
USER_EMAIL |
string
The user's primary email address.
|
|
| Sample request |
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/admin?eventName=SECURITY_KEY_REGISTERED_FOR_USER&maxResults=10&access_token=YOUR_ACCESS_TOKEN
|
| Admin Console message format |
Security key registered for {USER_EMAIL}
|
Security Key Revoke
| Event details |
| Event name |
REVOKE_SECURITY_KEY |
| Parameters |
enrollment_type |
string
Describers whether the passkey was enrolled by user or created automatically.
Possible values:
automatically_created
Passkey enrolled automatically on android device.user_created
Passkey enrolled by end user.
|
passkey_added_from |
string
Location from where the passkey was added.
|
passkey_added_on_timestamp |
integer
Timestamp when the passkey was added.
|
passkey_last_used_from |
string
Location from where was the passkey last used.
|
passkey_last_used_timestamp |
integer
Timestamp when the passkey was last used.
|
platform_or_device |
string
Platform or device used for creating the passkey.
Possible values:
apple_icloud_keychain
Passkey created using apple icloud keychain.bitwarden
Passkey created using bitwarden.chrome_on_mac
Passkey created using chrome on mac.chrome_os
Passkey created using chrome os.dashlane
Passkey created using dashlane.edge_on_mac
Passkey created using Edge on Mac.generic_passkey
Passkey type generic passkey description.generic_usb_key
Passkey created using FIDO2 security key.generic_usb_up_key
Passkey created using security key.google_account_passkey_on_android
Passkey created using android device.google_password_manager
Passkey created using google password manager.keeper
Passkey created using keeper.nordpass
Passkey created using nordpass.one_password
Passkey created using 1Password.samsung_pass
Passkey created using Samsung pass.titan_key
Passkey created using titan security key.windows_hello
Passkey created using windows hello.yubikey
Passkey created using yubico security key.
|
supports_passwordless |
boolean
Whether the passkey can be used to skip password.
|
USER_EMAIL |
string
The user's primary email address.
|
|
| Sample request |
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/admin?eventName=REVOKE_SECURITY_KEY&maxResults=10&access_token=YOUR_ACCESS_TOKEN
|
| Admin Console message format |
A security key enrolled for user {USER_EMAIL} for 2-step verification was revoked
|
Send User Invite
| Event details |
| Event name |
USER_INVITE |
| Parameters |
DOMAIN_NAME |
string
The primary domain name.
|
USER_EMAIL |
string
The user's primary email address.
|
|
| Sample request |
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/admin?eventName=USER_INVITE&maxResults=10&access_token=YOUR_ACCESS_TOKEN
|
| Admin Console message format |
{USER_EMAIL} invited to join your organization
|
Temporary Password Viewed
| Event details |
| Event name |
VIEW_TEMP_PASSWORD |
| Parameters |
DOMAIN_NAME |
string
The primary domain name.
|
USER_EMAIL |
string
The user's primary email address.
|
|
| Sample request |
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/admin?eventName=VIEW_TEMP_PASSWORD&maxResults=10&access_token=YOUR_ACCESS_TOKEN
|
| Admin Console message format |
Temporary password for user {USER_EMAIL} viewed by the admin
|
Turn off 2-step verification
| Event details |
| Event name |
TURN_OFF_2_STEP_VERIFICATION |
| Parameters |
USER_EMAIL |
string
The user's primary email address.
|
|
| Sample request |
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/admin?eventName=TURN_OFF_2_STEP_VERIFICATION&maxResults=10&access_token=YOUR_ACCESS_TOKEN
|
| Admin Console message format |
2-step verification has been turned off for the user {USER_EMAIL}
|
Unblock User Session
| Event details |
| Event name |
UNBLOCK_USER_SESSION |
| Parameters |
USER_EMAIL |
string
The user's primary email address.
|
|
| Sample request |
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/admin?eventName=UNBLOCK_USER_SESSION&maxResults=10&access_token=YOUR_ACCESS_TOKEN
|
| Admin Console message format |
User {USER_EMAIL} unblocked by temporarily disabling login challenge
|
Unmanaged Users Bulk Upload
| Event details |
| Event name |
UNMANAGED_USERS_BULK_UPLOAD |
| Parameters |
BULK_UPLOAD_FAIL_USERS_NUMBER |
string
Bulk Upload Failed Users Number.
|
BULK_UPLOAD_TOTAL_USERS_NUMBER |
string
Bulk Upload Total Users Number.
|
|
| Sample request |
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/admin?eventName=UNMANAGED_USERS_BULK_UPLOAD&maxResults=10&access_token=YOUR_ACCESS_TOKEN
|
| Admin Console message format |
A total of {BULK_UPLOAD_TOTAL_USERS_NUMBER} unmanaged users selected for upload. {BULK_UPLOAD_FAIL_USERS_NUMBER} out of {BULK_UPLOAD_TOTAL_USERS_NUMBER} users failed to be uploaded.
|
Unmanaged Users List Download
| Event details |
| Event name |
DOWNLOAD_UNMANAGED_USERS_LIST |
| Sample request |
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/admin?eventName=DOWNLOAD_UNMANAGED_USERS_LIST&maxResults=10&access_token=YOUR_ACCESS_TOKEN
|
| Admin Console message format |
Unmanaged Users list was downloaded as a CSV file
|
Update Profile Photo
| Event details |
| Event name |
UPDATE_PROFILE_PHOTO |
| Parameters |
USER_EMAIL |
string
The user's primary email address.
|
|
| Sample request |
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/admin?eventName=UPDATE_PROFILE_PHOTO&maxResults=10&access_token=YOUR_ACCESS_TOKEN
|
| Admin Console message format |
Profile photo of {USER_EMAIL} has been updated
|
User Advanced Protection Unenroll
| Event details |
| Event name |
UNENROLL_USER_FROM_TITANIUM |
| Parameters |
USER_EMAIL |
string
The user's primary email address.
|
|
| Sample request |
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/admin?eventName=UNENROLL_USER_FROM_TITANIUM&maxResults=10&access_token=YOUR_ACCESS_TOKEN
|
| Admin Console message format |
User {USER_EMAIL} unenrolled from Advanced Protection
|
User Archival
| Event details |
| Event name |
ARCHIVE_USER |
| Parameters |
USER_EMAIL |
string
The user's primary email address.
|
|
| Sample request |
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/admin?eventName=ARCHIVE_USER&maxResults=10&access_token=YOUR_ACCESS_TOKEN
|
| Admin Console message format |
{USER_EMAIL} archived
|
User BirthDate Change
| Event details |
| Event name |
UPDATE_BIRTHDATE |
| Parameters |
BIRTHDATE |
string
The date of the user's birthday.
|
USER_EMAIL |
string
The user's primary email address.
|
|
| Sample request |
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/admin?eventName=UPDATE_BIRTHDATE&maxResults=10&access_token=YOUR_ACCESS_TOKEN
|
| Admin Console message format |
The birth date for {USER_EMAIL} changed to {BIRTHDATE}
|
User created passkey revoked
| Event details |
| Event name |
USER_CREATED_PASSKEY_REVOKE |
| Parameters |
USER_EMAIL |
string
The user's primary email address.
|
|
| Sample request |
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/admin?eventName=USER_CREATED_PASSKEY_REVOKE&maxResults=10&access_token=YOUR_ACCESS_TOKEN
|
| Admin Console message format |
A user created passkey enrolled for user {USER_EMAIL} was revoked
|
User Creation
| Event details |
| Event name |
CREATE_USER |
| Parameters |
USER_EMAIL |
string
The new user's primary user email.
|
|
| Sample request |
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/admin?eventName=CREATE_USER&maxResults=10&access_token=YOUR_ACCESS_TOKEN
|
| Admin Console message format |
{USER_EMAIL} created
|
User Deletion
| Event details |
| Event name |
DELETE_USER |
| Parameters |
USER_EMAIL |
string
The deleted user's primary user email.
|
|
| Sample request |
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/admin?eventName=DELETE_USER&maxResults=10&access_token=YOUR_ACCESS_TOKEN
|
| Admin Console message format |
{USER_EMAIL} deleted
|
User Downgrade From Google+
| Event details |
| Event name |
DOWNGRADE_USER_FROM_GPLUS |
| Parameters |
USER_EMAIL |
string
The user's primary email address.
|
|
| Sample request |
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/admin?eventName=DOWNGRADE_USER_FROM_GPLUS&maxResults=10&access_token=YOUR_ACCESS_TOKEN
|
| Admin Console message format |
{USER_EMAIL} was downgraded from Google+
|
User Enrolled In 2-Step Verification
| Event details |
| Event name |
USER_ENROLLED_IN_TWO_STEP_VERIFICATION |
| Parameters |
USER_EMAIL |
string
The user's primary email address.
|
|
| Sample request |
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/admin?eventName=USER_ENROLLED_IN_TWO_STEP_VERIFICATION&maxResults=10&access_token=YOUR_ACCESS_TOKEN
|
| Admin Console message format |
{USER_EMAIL} enrolled in 2-step verification
|
User List Download
| Event details |
| Event name |
DOWNLOAD_USERLIST_CSV |
| Sample request |
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/admin?eventName=DOWNLOAD_USERLIST_CSV&maxResults=10&access_token=YOUR_ACCESS_TOKEN
|
| Admin Console message format |
User list was downloaded as a CSV file
|
User List Download
| Event details |
| Event name |
DOWNLOAD_USERLIST |
| Parameters |
|
| Sample request |
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/admin?eventName=DOWNLOAD_USERLIST&maxResults=10&access_token=YOUR_ACCESS_TOKEN
|
| Admin Console message format |
User list was downloaded in {FORMAT}
|
User OrgUnit Change
| Event details |
| Event name |
MOVE_USER_TO_ORG_UNIT |
| Parameters |
NEW_VALUE |
string
The user's new organizational unit.
|
ORG_UNIT_NAME |
string
The organizational unit (OU) name (path).
|
USER_EMAIL |
string
The user's primary email address.
|
|
| Sample request |
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/admin?eventName=MOVE_USER_TO_ORG_UNIT&maxResults=10&access_token=YOUR_ACCESS_TOKEN
|
| Admin Console message format |
{USER_EMAIL} moved from {ORG_UNIT_NAME} to {NEW_VALUE}
|
User Put In 2-Step Verification Grace Period
| Event details |
| Event name |
USER_PUT_IN_TWO_STEP_VERIFICATION_GRACE_PERIOD |
| Parameters |
NEW_VALUE |
string
The new SETTING_NAME value that was set during this event.
|
USER_EMAIL |
string
The user's primary email address.
|
|
| Sample request |
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/admin?eventName=USER_PUT_IN_TWO_STEP_VERIFICATION_GRACE_PERIOD&maxResults=10&access_token=YOUR_ACCESS_TOKEN
|
| Admin Console message format |
2-step verification grace period has been enabled on {USER_EMAIL} till {NEW_VALUE}
|
User Rename
| Event details |
| Event name |
RENAME_USER |
| Parameters |
NEW_VALUE |
string
The user's new name.
|
USER_EMAIL |
string
The user's primary email address.
|
|
| Sample request |
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/admin?eventName=RENAME_USER&maxResults=10&access_token=YOUR_ACCESS_TOKEN
|
| Admin Console message format |
{USER_EMAIL} renamed to {NEW_VALUE}
|
User Strong Auth Unenroll
| Event details |
| Event name |
UNENROLL_USER_FROM_STRONG_AUTH |
| Parameters |
USER_EMAIL |
string
The user's primary email address.
|
|
| Sample request |
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/admin?eventName=UNENROLL_USER_FROM_STRONG_AUTH&maxResults=10&access_token=YOUR_ACCESS_TOKEN
|
| Admin Console message format |
User {USER_EMAIL} unenrolled from Strong Auth
|
User Suspension
| Event details |
| Event name |
SUSPEND_USER |
| Parameters |
USER_EMAIL |
string
The user's primary email address.
|
|
| Sample request |
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/admin?eventName=SUSPEND_USER&maxResults=10&access_token=YOUR_ACCESS_TOKEN
|
| Admin Console message format |
{USER_EMAIL} suspended
|
User Unarchival
| Event details |
| Event name |
UNARCHIVE_USER |
| Parameters |
USER_EMAIL |
string
The user's primary email address.
|
|
| Sample request |
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/admin?eventName=UNARCHIVE_USER&maxResults=10&access_token=YOUR_ACCESS_TOKEN
|
| Admin Console message format |
{USER_EMAIL} unarchived
|
User Undeletion
| Event details |
| Event name |
UNDELETE_USER |
| Parameters |
USER_EMAIL |
string
The user's primary email address.
|
|
| Sample request |
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/admin?eventName=UNDELETE_USER&maxResults=10&access_token=YOUR_ACCESS_TOKEN
|
| Admin Console message format |
{USER_EMAIL} undeleted
|
User Unsuspension
| Event details |
| Event name |
UNSUSPEND_USER |
| Parameters |
USER_EMAIL |
string
The user's primary email address.
|
|
| Sample request |
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/admin?eventName=UNSUSPEND_USER&maxResults=10&access_token=YOUR_ACCESS_TOKEN
|
| Admin Console message format |
{USER_EMAIL} unsuspended
|
User Upgrade To Google+
| Event details |
| Event name |
UPGRADE_USER_TO_GPLUS |
| Parameters |
USER_EMAIL |
string
The user's primary email address.
|
|
| Sample request |
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/admin?eventName=UPGRADE_USER_TO_GPLUS&maxResults=10&access_token=YOUR_ACCESS_TOKEN
|
| Admin Console message format |
{USER_EMAIL} was upgraded to Google+
|
Users Bulk Upload
| Event details |
| Event name |
USERS_BULK_UPLOAD |
| Parameters |
BULK_UPLOAD_FAIL_USERS_NUMBER |
string
The number of failures when attemping to bulk upload users.
|
BULK_UPLOAD_TOTAL_USERS_NUMBER |
string
The total number of bulk uploaded users.
|
|
| Sample request |
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/admin?eventName=USERS_BULK_UPLOAD&maxResults=10&access_token=YOUR_ACCESS_TOKEN
|
| Admin Console message format |
A total of {BULK_UPLOAD_TOTAL_USERS_NUMBER} users selected for upload. {BULK_UPLOAD_FAIL_USERS_NUMBER} out of {BULK_UPLOAD_TOTAL_USERS_NUMBER} users failed to be uploaded.
|
Users Bulk Upload Notification
| Event details |
| Event name |
USERS_BULK_UPLOAD_NOTIFICATION_SENT |
| Parameters |
USER_EMAIL |
string
The user's primary email address.
|
|
| Sample request |
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/admin?eventName=USERS_BULK_UPLOAD_NOTIFICATION_SENT&maxResults=10&access_token=YOUR_ACCESS_TOKEN
|
| Admin Console message format |
Notification of bulk users upload sent to {USER_EMAIL}
|
Except as otherwise noted, the content of this page is licensed under the Creative Commons Attribution 4.0 License, and code samples are licensed under the Apache 2.0 License. For details, see the Google Developers Site Policies. Java is a registered trademark of Oracle and/or its affiliates.
Last updated 2024-12-19 UTC.
[null,null,["Last updated 2024-12-19 UTC."],[[["The Google Admin SDK provides audit logs for a variety of user setting changes, including security settings, profile updates, and account management actions."],["Each audit log event includes an event name, parameters (like user email and new/old values), a sample API request, and the corresponding Admin Console message."],["These audit logs can be retrieved via the Activities.list() method and are categorized under the `USER_SETTINGS` event type."],["The audit logs enable administrators to monitor user activity, track administrative changes, identify potential security risks, and generate reports for compliance or analysis."],["Common use cases include auditing user profile updates, tracking 2-step verification changes, and monitoring application-specific password revocations."]]],[]]
