This document lists the events and parameters for
User Settings
Admin Audit activity events. You can retrieve these events by
calling [Activities.list()](https://developers.google.com/workspace/admin/reports/v1/reference/activities/list)
with `applicationName=admin`.

## User Settings


Events of this type are returned with `type=USER_SETTINGS`.

### 2-step Verification Scratch Codes Deletion

Event details Event name `DELETE_2SV_SCRATCH_CODES` Parameters `USER_EMAIL` `string`


The user's primary email address.
Sample request `GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/admin?eventName=DELETE_2SV_SCRATCH_CODES&maxResults=10&access_token=YOUR_ACCESS_TOKEN` Admin Console message format `2-step verification scratch codes of the user {USER_EMAIL} deleted`

### 2-step Verification Scratch Codes Generate

Event details Event name `GENERATE_2SV_SCRATCH_CODES` Parameters `USER_EMAIL` `string`


The user's primary email address.
Sample request `GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/admin?eventName=GENERATE_2SV_SCRATCH_CODES&maxResults=10&access_token=YOUR_ACCESS_TOKEN` Admin Console message format `New 2-step verification scratch codes generated for the user {USER_EMAIL}`

### 3-legged OAuth Device Tokens Revoke

Event details Event name `REVOKE_3LO_DEVICE_TOKENS` Parameters `DEVICE_ID` `string`


The device's ID.
`DEVICE_TYPE` `string`


The device's type.
`USER_EMAIL` `string`


The user's primary email address.
Sample request `GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/admin?eventName=REVOKE_3LO_DEVICE_TOKENS&maxResults=10&access_token=YOUR_ACCESS_TOKEN` Admin Console message format `3-legged OAuth tokens issued by user {USER_EMAIL} for the device type {DEVICE_TYPE} and id {DEVICE_ID} were revoked`

### 3-legged OAuth Token Revoke

Event details Event name `REVOKE_3LO_TOKEN` Parameters `APP_ID` `string`


The application ID whose access is managed by the token.
`USER_EMAIL` `string`


The user's primary email address.
Sample request `GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/admin?eventName=REVOKE_3LO_TOKEN&maxResults=10&access_token=YOUR_ACCESS_TOKEN` Admin Console message format `3-legged OAuth tokens issued by user {USER_EMAIL} for application {APP_ID} were revoked`

### Accept User Invite

Event details Event name `ACCEPT_USER_INVITATION` Parameters `USER_EMAIL` `string`


The user's primary email address.
Sample request `GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/admin?eventName=ACCEPT_USER_INVITATION&maxResults=10&access_token=YOUR_ACCESS_TOKEN` Admin Console message format `User invitation accepted for user: {USER_EMAIL}`

### Add Recovery Email

Event details Event name `ADD_RECOVERY_EMAIL` Parameters `USER_EMAIL` `string`


The user's primary email address.
Sample request `GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/admin?eventName=ADD_RECOVERY_EMAIL&maxResults=10&access_token=YOUR_ACCESS_TOKEN` Admin Console message format `Recovery email added for {USER_EMAIL}`

### Add Recovery Phone

Event details Event name `ADD_RECOVERY_PHONE` Parameters `USER_EMAIL` `string`


The user's primary email address.
Sample request `GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/admin?eventName=ADD_RECOVERY_PHONE&maxResults=10&access_token=YOUR_ACCESS_TOKEN` Admin Console message format `Recovery phone added for {USER_EMAIL}`

### Admin Privileges Grant

Event details Event name `GRANT_ADMIN_PRIVILEGE` Parameters `USER_EMAIL` `string`


The user's primary email address.
Sample request `GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/admin?eventName=GRANT_ADMIN_PRIVILEGE&maxResults=10&access_token=YOUR_ACCESS_TOKEN` Admin Console message format `Admin privileges granted to {USER_EMAIL}`

### Admin Privileges Revoke

Event details Event name `REVOKE_ADMIN_PRIVILEGE` Parameters `USER_EMAIL` `string`


The user's primary email address.
Sample request `GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/admin?eventName=REVOKE_ADMIN_PRIVILEGE&maxResults=10&access_token=YOUR_ACCESS_TOKEN` Admin Console message format `Admin privileges revoked from {USER_EMAIL}`

### Application Specific Password Revoke

Event details Event name `REVOKE_ASP` Parameters `ASP_ID` `string`


The application specific password ID.
`USER_EMAIL` `string`


The user's primary email address.
Sample request `GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/admin?eventName=REVOKE_ASP&maxResults=10&access_token=YOUR_ACCESS_TOKEN` Admin Console message format `Application specific password with Id {ASP_ID} issued by user {USER_EMAIL} revoked`

### Automatic Contact Share Change

Event details Event name `TOGGLE_AUTOMATIC_CONTACT_SHARING` Parameters `NEW_VALUE` `string`


The setting value, either `true` or `false`.
`USER_EMAIL` `string`


The user's primary email address.
Sample request `GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/admin?eventName=TOGGLE_AUTOMATIC_CONTACT_SHARING&maxResults=10&access_token=YOUR_ACCESS_TOKEN` Admin Console message format `Automatic contact sharing for {USER_EMAIL} changed to {NEW_VALUE}`

### Bulk Upload

Event details Event name `BULK_UPLOAD` Parameters `BULK_UPLOAD_FAIL_USERS_NUMBER` `string`


The number of users who did not successfully upload to the domain.
`BULK_UPLOAD_TOTAL_USERS_NUMBER` `string`


The number of total users being uploaded.
`DOMAIN_NAME` `string`


The primary domain name where users are being moved.
Sample request `GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/admin?eventName=BULK_UPLOAD&maxResults=10&access_token=YOUR_ACCESS_TOKEN` Admin Console message format `{BULK_UPLOAD_TOTAL_USERS_NUMBER} users selected for upload to your organization. {BULK_UPLOAD_FAIL_USERS_NUMBER} out of {BULK_UPLOAD_TOTAL_USERS_NUMBER} users were not uploaded.`

### Bulk Upload Notification

Event details Event name `BULK_UPLOAD_NOTIFICATION_SENT` Parameters `DOMAIN_NAME` `string`


The primary domain name where users were uploaded.
`USER_EMAIL` `string`


The primary email address of user who was sent notification of bulk upload event.
Sample request `GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/admin?eventName=BULK_UPLOAD_NOTIFICATION_SENT&maxResults=10&access_token=YOUR_ACCESS_TOKEN` Admin Console message format `Notification of bulk users upload sent to {USER_EMAIL}`

### Cancel User Invite

Event details Event name `CANCEL_USER_INVITE` Parameters `DOMAIN_NAME` `string`


The primary domain name.
`USER_EMAIL` `string`


The primary email address of the user whose invitation is being cancelled.
Sample request `GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/admin?eventName=CANCEL_USER_INVITE&maxResults=10&access_token=YOUR_ACCESS_TOKEN` Admin Console message format `Invite to {USER_EMAIL} cancelled`

### Change Custom Attribute

Event details Event name `CHANGE_USER_CUSTOM_FIELD` Parameters `NEW_VALUE` `string`


The new `SETTING_NAME` value that was set during this event.
`OLD_VALUE` `string`


The previous `SETTING_NAME` value that was replaced during this event.
`USER_CUSTOM_FIELD` `string`


The name of the user's custom field.
`USER_EMAIL` `string`


The user's primary email address.
Sample request `GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/admin?eventName=CHANGE_USER_CUSTOM_FIELD&maxResults=10&access_token=YOUR_ACCESS_TOKEN` Admin Console message format `{USER_CUSTOM_FIELD} changed for {USER_EMAIL} from {OLD_VALUE} to {NEW_VALUE}`

### Change External Id

Event details Event name `CHANGE_USER_EXTERNAL_ID` Parameters `NEW_VALUE` `string`


The new `SETTING_NAME` value that was set during this event.
`OLD_VALUE` `string`


The previous `SETTING_NAME` value that was replaced during this event.
`USER_EMAIL` `string`


The user's primary email address.
Sample request `GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/admin?eventName=CHANGE_USER_EXTERNAL_ID&maxResults=10&access_token=YOUR_ACCESS_TOKEN` Admin Console message format `External Ids changed for {USER_EMAIL} from {OLD_VALUE} to {NEW_VALUE}`

### Change Gender

Change here is a verb. The genders will be customizable, so this should be broader than male vs female.
Event details Event name `CHANGE_USER_GENDER` Parameters `NEW_VALUE` `string`


The new `SETTING_NAME` value that was set during this event.
`OLD_VALUE` `string`


The previous `SETTING_NAME` value that was replaced during this event.
`USER_EMAIL` `string`


The user's primary email address.
Sample request `GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/admin?eventName=CHANGE_USER_GENDER&maxResults=10&access_token=YOUR_ACCESS_TOKEN` Admin Console message format `Gender changed for {USER_EMAIL} from {OLD_VALUE} to {NEW_VALUE}`

### Change IM

Event details Event name `CHANGE_USER_IM` Parameters `NEW_VALUE` `string`


The new `SETTING_NAME` value that was set during this event.
`OLD_VALUE` `string`


The previous `SETTING_NAME` value that was replaced during this event.
`USER_EMAIL` `string`


The user's primary email address.
Sample request `GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/admin?eventName=CHANGE_USER_IM&maxResults=10&access_token=YOUR_ACCESS_TOKEN` Admin Console message format `IMs changed for {USER_EMAIL} from {OLD_VALUE} to {NEW_VALUE}`

### Change IP Whitelist

Event details Event name `ENABLE_USER_IP_WHITELIST` Parameters `NEW_VALUE` `string`


The new `SETTING_NAME` value that was set during this event.
`OLD_VALUE` `string`


The previous `SETTING_NAME` value that was replaced during this event.
`USER_EMAIL` `string`


The user's primary email address.
Sample request `GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/admin?eventName=ENABLE_USER_IP_WHITELIST&maxResults=10&access_token=YOUR_ACCESS_TOKEN` Admin Console message format `IP whitelist changed for {USER_EMAIL} from {OLD_VALUE} to {NEW_VALUE}`

### Change Keyword

Keywords are used on user profiles to help identify a user in searches. Example: find person with name 'Larry' and school 'Stanford'. 'Change' is a verb.
Event details Event name `CHANGE_USER_KEYWORD` Parameters `NEW_VALUE` `string`


The new `SETTING_NAME` value that was set during this event.
`OLD_VALUE` `string`


The previous `SETTING_NAME` value that was replaced during this event.
`USER_EMAIL` `string`


The user's primary email address.
Sample request `GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/admin?eventName=CHANGE_USER_KEYWORD&maxResults=10&access_token=YOUR_ACCESS_TOKEN` Admin Console message format `Keywords changed for {USER_EMAIL} from {OLD_VALUE} to {NEW_VALUE}`

### Change Language

Can be a predefined set of more common languages provided by Google or a custom language. 'Change' here is a verb.
Event details Event name `CHANGE_USER_LANGUAGE` Parameters `NEW_VALUE` `string`


The new `SETTING_NAME` value that was set during this event.
`OLD_VALUE` `string`


The previous `SETTING_NAME` value that was replaced during this event.
`USER_EMAIL` `string`


The user's primary email address.
Sample request `GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/admin?eventName=CHANGE_USER_LANGUAGE&maxResults=10&access_token=YOUR_ACCESS_TOKEN` Admin Console message format `Languages changed for {USER_EMAIL} from {OLD_VALUE} to {NEW_VALUE}`

### Change Location

Location is different from address in the following ways: (1) Location can be fuzzy. Example: Near Seattle. (2) Hovercards and other short user summaries display location, not address. 'Change' is a verb.
Event details Event name `CHANGE_USER_LOCATION` Parameters `NEW_VALUE` `string`


The new `SETTING_NAME` value that was set during this event.
`OLD_VALUE` `string`


The previous `SETTING_NAME` value that was replaced during this event.
`USER_EMAIL` `string`


The user's primary email address.
Sample request `GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/admin?eventName=CHANGE_USER_LOCATION&maxResults=10&access_token=YOUR_ACCESS_TOKEN` Admin Console message format `Locations changed for {USER_EMAIL} from {OLD_VALUE} to {NEW_VALUE}`

### Change Organization

Event details Event name `CHANGE_USER_ORGANIZATION` Parameters `NEW_VALUE` `string`


The new `SETTING_NAME` value that was set during this event.
`OLD_VALUE` `string`


The previous `SETTING_NAME` value that was replaced during this event.
`USER_EMAIL` `string`


The user's primary email address.
Sample request `GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/admin?eventName=CHANGE_USER_ORGANIZATION&maxResults=10&access_token=YOUR_ACCESS_TOKEN` Admin Console message format `Organizations changed for {USER_EMAIL} from {OLD_VALUE} to {NEW_VALUE}`

### Change Phone Numbers

Event details Event name `CHANGE_USER_PHONE_NUMBER` Parameters `NEW_VALUE` `string`


The new `SETTING_NAME` value that was set during this event.
`OLD_VALUE` `string`


The previous `SETTING_NAME` value that was replaced during this event.
`USER_EMAIL` `string`


The user's primary email address.
Sample request `GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/admin?eventName=CHANGE_USER_PHONE_NUMBER&maxResults=10&access_token=YOUR_ACCESS_TOKEN` Admin Console message format `Phone Numbers changed for {USER_EMAIL} from {OLD_VALUE} to {NEW_VALUE}`

### Change Recovery Email

Event details Event name `CHANGE_RECOVERY_EMAIL` Parameters `USER_EMAIL` `string`


The user's primary email address.
Sample request `GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/admin?eventName=CHANGE_RECOVERY_EMAIL&maxResults=10&access_token=YOUR_ACCESS_TOKEN` Admin Console message format `Recovery email changed for {USER_EMAIL}`

### Change Recovery Phone

Event details Event name `CHANGE_RECOVERY_PHONE` Parameters `USER_EMAIL` `string`


The user's primary email address.
Sample request `GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/admin?eventName=CHANGE_RECOVERY_PHONE&maxResults=10&access_token=YOUR_ACCESS_TOKEN` Admin Console message format `Recovery phone changed for {USER_EMAIL}`

### Change Relation

Event details Event name `CHANGE_USER_RELATION` Parameters `NEW_VALUE` `string`


The new `SETTING_NAME` value that was set during this event.
`OLD_VALUE` `string`


The previous `SETTING_NAME` value that was replaced during this event.
`USER_EMAIL` `string`


The user's primary email address.
Sample request `GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/admin?eventName=CHANGE_USER_RELATION&maxResults=10&access_token=YOUR_ACCESS_TOKEN` Admin Console message format `Relations changed for {USER_EMAIL} from {OLD_VALUE} to {NEW_VALUE}`

### Change User Address

Event details Event name `CHANGE_USER_ADDRESS` Parameters `NEW_VALUE` `string`


The new `SETTING_NAME` value that was set during this event.
`OLD_VALUE` `string`


The previous `SETTING_NAME` value that was replaced during this event.
`USER_EMAIL` `string`


The user's primary email address.
Sample request `GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/admin?eventName=CHANGE_USER_ADDRESS&maxResults=10&access_token=YOUR_ACCESS_TOKEN` Admin Console message format `Addresses changed for {USER_EMAIL} from {OLD_VALUE} to {NEW_VALUE}`

### Create an email monitor

Event details Event name `CREATE_EMAIL_MONITOR` Parameters `BEGIN_DATE_TIME` `string`


The start date and time for the email monitor.
`EMAIL_MONITOR_DEST_EMAIL` `string`


The destination address of the email monitor.
`EMAIL_MONITOR_LEVEL_CHAT` `string`


The chat email monitor level.
`EMAIL_MONITOR_LEVEL_DRAFT_EMAIL` `string`


The draft email monitor level.
`EMAIL_MONITOR_LEVEL_INCOMING_EMAIL` `string`


The incoming email monitor level.
`EMAIL_MONITOR_LEVEL_OUTGOING_EMAIL` `string`


The outgoing email monitor level.
`END_DATE_TIME` `string`


The end date and time for the email monitor.
`USER_EMAIL` `string`


The user's primary email address.
Sample request `GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/admin?eventName=CREATE_EMAIL_MONITOR&maxResults=10&access_token=YOUR_ACCESS_TOKEN` Admin Console message format `Created an email monitor for {USER_EMAIL} to {EMAIL_MONITOR_DEST_EMAIL} that will expire on {END_DATE_TIME}`

### Data transfer request created

Event details Event name `CREATE_DATA_TRANSFER_REQUEST` Parameters `APPLICATION_NAME` `string`


A comma-separated application names for which data transfer is requested.
`DESTINATION_USER_EMAIL` `string`


The new owner's primary user email to whom to transfer user data to.
`USER_EMAIL` `string`


The user's primary email address.
Sample request `GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/admin?eventName=CREATE_DATA_TRANSFER_REQUEST&maxResults=10&access_token=YOUR_ACCESS_TOKEN` Admin Console message format `Data transfer request created from {USER_EMAIL} to {DESTINATION_USER_EMAIL} for apps {APPLICATION_NAME}`

### Delegated Admin Privileges Grant

Event details Event name `GRANT_DELEGATED_ADMIN_PRIVILEGES` Parameters `NEW_VALUE` `string`


The new delegated admin privilege.
`USER_EMAIL` `string`


The user's primary email address.
Sample request `GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/admin?eventName=GRANT_DELEGATED_ADMIN_PRIVILEGES&maxResults=10&access_token=YOUR_ACCESS_TOKEN` Admin Console message format `{USER_EMAIL} assigned {NEW_VALUE} admin privileges`

### Delete account information dump

Event details Event name `DELETE_ACCOUNT_INFO_DUMP` Parameters `REQUEST_ID` `string`


The request ID.
`USER_EMAIL` `string`


The user's primary email address.
Sample request `GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/admin?eventName=DELETE_ACCOUNT_INFO_DUMP&maxResults=10&access_token=YOUR_ACCESS_TOKEN` Admin Console message format `Deleted account and login information dump for {USER_EMAIL} and request ID {REQUEST_ID}`

### Delete an email monitor

Event details Event name `DELETE_EMAIL_MONITOR` Parameters `EMAIL_MONITOR_DEST_EMAIL` `string`


The destination address of the email monitor.
`USER_EMAIL` `string`


The user's primary email address.
Sample request `GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/admin?eventName=DELETE_EMAIL_MONITOR&maxResults=10&access_token=YOUR_ACCESS_TOKEN` Admin Console message format `Deleted an email monitor for {USER_EMAIL} to {EMAIL_MONITOR_DEST_EMAIL}`

### Delete mailbox dump

Event details Event name `DELETE_MAILBOX_DUMP` Parameters `REQUEST_ID` `string`


The request ID.
`USER_EMAIL` `string`


The user's primary email address.
Sample request `GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/admin?eventName=DELETE_MAILBOX_DUMP&maxResults=10&access_token=YOUR_ACCESS_TOKEN` Admin Console message format `Deleted mailbox dump for {USER_EMAIL} and request ID {REQUEST_ID}`

### Delete Profile Photo

Event details Event name `DELETE_PROFILE_PHOTO` Parameters `USER_EMAIL` `string`


The user's primary email address.
Sample request `GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/admin?eventName=DELETE_PROFILE_PHOTO&maxResults=10&access_token=YOUR_ACCESS_TOKEN` Admin Console message format `Profile photo of {USER_EMAIL} has been deleted`

### Display Name Added

Event details Event name `ADD_DISPLAY_NAME` Parameters `USER_DISPLAY_NAME` `string`


User display name.
`USER_EMAIL` `string`


The user's primary email address.
Sample request `GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/admin?eventName=ADD_DISPLAY_NAME&maxResults=10&access_token=YOUR_ACCESS_TOKEN` Admin Console message format `{USER_DISPLAY_NAME} added as a display name of {USER_EMAIL}`

### Display Name Change

Event details Event name `CHANGE_DISPLAY_NAME` Parameters `NEW_VALUE` `string`


The new `SETTING_NAME` value that was set during this event.
`OLD_VALUE` `string`


The previous `SETTING_NAME` value that was replaced during this event.
`USER_EMAIL` `string`


The user's primary email address.
Sample request `GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/admin?eventName=CHANGE_DISPLAY_NAME&maxResults=10&access_token=YOUR_ACCESS_TOKEN` Admin Console message format `Display name of {USER_EMAIL} changed from {OLD_VALUE} to {NEW_VALUE}`

### Display Name Removed

Event details Event name `REMOVE_DISPLAY_NAME` Parameters `USER_DISPLAY_NAME` `string`


User display name.
`USER_EMAIL` `string`


The user's primary email address.
Sample request `GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/admin?eventName=REMOVE_DISPLAY_NAME&maxResults=10&access_token=YOUR_ACCESS_TOKEN` Admin Console message format `{USER_DISPLAY_NAME} removed as a display name of {USER_EMAIL}`

### First Name Change

Event details Event name `CHANGE_FIRST_NAME` Parameters `NEW_VALUE` `string`


The user's new first name.
`OLD_VALUE` `string`


The user's previous first name.
`USER_EMAIL` `string`


The user's primary email address.
Sample request `GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/admin?eventName=CHANGE_FIRST_NAME&maxResults=10&access_token=YOUR_ACCESS_TOKEN` Admin Console message format `First name of {USER_EMAIL} changed from {OLD_VALUE} to {NEW_VALUE}`

### Gmail Account Reset

Event details Event name `GMAIL_RESET_USER` Parameters `GMAIL_RESET_REASON` `string`


Gmail's reason for resetting the account.
`USER_EMAIL` `string`


The user's primary email address.
Sample request `GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/admin?eventName=GMAIL_RESET_USER&maxResults=10&access_token=YOUR_ACCESS_TOKEN` Admin Console message format `Gmail account of {USER_EMAIL} reset`

### Last Name Change

Event details Event name `CHANGE_LAST_NAME` Parameters `NEW_VALUE` `string`


The user's new last name.
`OLD_VALUE` `string`


The user's previous last name.
`USER_EMAIL` `string`


The user's primary email address.
Sample request `GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/admin?eventName=CHANGE_LAST_NAME&maxResults=10&access_token=YOUR_ACCESS_TOKEN` Admin Console message format `Last name of {USER_EMAIL} changed from {OLD_VALUE} to {NEW_VALUE}`

### Mail Routing Destination Creation

Event details Event name `MAIL_ROUTING_DESTINATION_ADDED` Parameters `NEW_VALUE` `string`


The new routing destination.
`USER_EMAIL` `string`


The user's primary email address.
Sample request `GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/admin?eventName=MAIL_ROUTING_DESTINATION_ADDED&maxResults=10&access_token=YOUR_ACCESS_TOKEN` Admin Console message format `User {USER_EMAIL} has received the following individual mail routing destination: {NEW_VALUE}`

### Mail Routing Destination Deletion

Event details Event name `MAIL_ROUTING_DESTINATION_REMOVED` Parameters `OLD_VALUE` `string`


The previous routing destination.
`USER_EMAIL` `string`


The user's primary email address.
Sample request `GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/admin?eventName=MAIL_ROUTING_DESTINATION_REMOVED&maxResults=10&access_token=YOUR_ACCESS_TOKEN` Admin Console message format `User {USER_EMAIL} has had the following individual mail routing destination removed: {OLD_VALUE}`

### Nickname Creation

Event details Event name `ADD_NICKNAME` Parameters `USER_EMAIL` `string`


The primary user email.
`USER_NICKNAME` `string`


The user's nickname, also known as alternate email or alias. For Admin console information, see the [administration help center](http://www.google.com/support/a/bin/answer.py?answer=33327).
Sample request `GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/admin?eventName=ADD_NICKNAME&maxResults=10&access_token=YOUR_ACCESS_TOKEN` Admin Console message format `{USER_NICKNAME} created as a nickname of {USER_EMAIL}`

### Nickname Deletion

Event details Event name `REMOVE_NICKNAME` Parameters `USER_EMAIL` `string`


The user's primary email address.
`USER_NICKNAME` `string`


The user's previous nickname.
Sample request `GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/admin?eventName=REMOVE_NICKNAME&maxResults=10&access_token=YOUR_ACCESS_TOKEN` Admin Console message format `{USER_NICKNAME} deleted as a nickname of {USER_EMAIL}`

### Passkey revoked

Event details Event name `PASSKEY_REVOKED` Parameters `enrollment_type` `string`


Describers whether the passkey was enrolled by user or created automatically.
Possible values:

- `automatically_created`  
  Passkey enrolled automatically on android device.
- `user_created`  
  Passkey enrolled by end user.
`passkey_added_from` `string`


Location from where the passkey was added.
`passkey_added_on_timestamp` `integer`


Timestamp when the passkey was added.
`passkey_last_used_from` `string`


Location from where was the passkey last used.
`passkey_last_used_timestamp` `integer`


Timestamp when the passkey was last used.
`platform_or_device` `string`


Platform or device used for creating the passkey.
Possible values:

- `apple_icloud_keychain`  
  Passkey created using apple icloud keychain.
- `bitwarden`  
  Passkey created using bitwarden.
- `chrome_on_mac`  
  Passkey created using chrome on mac.
- `chrome_os`  
  Passkey created using chrome os.
- `dashlane`  
  Passkey created using dashlane.
- `edge_on_mac`  
  Passkey created using Edge on Mac.
- `generic_passkey`  
  Passkey type generic passkey description.
- `generic_usb_key`  
  Passkey created using FIDO2 security key.
- `generic_usb_up_key`  
  Passkey created using security key.
- `google_account_passkey_on_android`  
  Passkey created using android device.
- `google_password_manager`  
  Passkey created using google password manager.
- `keeper`  
  Passkey created using keeper.
- `nordpass`  
  Passkey created using nordpass.
- `one_password`  
  Passkey created using 1Password.
- `samsung_pass`  
  Passkey created using Samsung pass.
- `titan_key`  
  Passkey created using titan security key.
- `windows_hello`  
  Passkey created using windows hello.
- `yubikey`  
  Passkey created using yubico security key.
`supports_passwordless` `boolean`


Whether the passkey can be used to skip password.
`USER_EMAIL` `string`


The user's primary email address.
Sample request `GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/admin?eventName=PASSKEY_REVOKED&maxResults=10&access_token=YOUR_ACCESS_TOKEN` Admin Console message format `A passkey enrolled for user {USER_EMAIL} was revoked`

### Password Change

Event details Event name `CHANGE_PASSWORD` Parameters `USER_EMAIL` `string`


The user's primary email address.
Sample request `GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/admin?eventName=CHANGE_PASSWORD&maxResults=10&access_token=YOUR_ACCESS_TOKEN` Admin Console message format `Password changed for {USER_EMAIL}`

### Password Change on Next Login

Event details Event name `CHANGE_PASSWORD_ON_NEXT_LOGIN` Parameters `NEW_VALUE` `string`


Indicates whether the user must change their password on their next login; can be `true` or `false`.
`OLD_VALUE` `string`


The previous setting value; can be `true` or `false`.
`USER_EMAIL` `string`


The user's primary email address.
Sample request `GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/admin?eventName=CHANGE_PASSWORD_ON_NEXT_LOGIN&maxResults=10&access_token=YOUR_ACCESS_TOKEN` Admin Console message format `Password change requirement for {USER_EMAIL} on next login changed from {OLD_VALUE} to {NEW_VALUE}`

### Pending Invites List Download

| Event details ||
|---|---|
| Event name | `DOWNLOAD_PENDING_INVITES_LIST` |
| Sample request | `GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/admin?eventName=DOWNLOAD_PENDING_INVITES_LIST&maxResults=10&access_token=YOUR_ACCESS_TOKEN` |
| Admin Console message format | `Pending Invites List was downloaded as a CSV file` |

### Public Key Certificate Status Updated

Event details Event name `UPDATE_PUBLIC_KEY_CERTIFICATE_STATUS` Parameters `PUBLIC_KEY_CERTIFICATE_STATUS` `string`


Public key certificate status.
`USER_EMAIL` `string`


The user's primary email address.
`USER_IMPACTED_EMAIL` `string`


User impacted email.
Sample request `GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/admin?eventName=UPDATE_PUBLIC_KEY_CERTIFICATE_STATUS&maxResults=10&access_token=YOUR_ACCESS_TOKEN` Admin Console message format `Public key certificate status updated to {PUBLIC_KEY_CERTIFICATE_STATUS} for email {USER_IMPACTED_EMAIL} of user {USER_EMAIL}`

### Public Key Certificate Updated

Event details Event name `UPDATE_PUBLIC_KEY_CERTIFICATE` Parameters `USER_EMAIL` `string`


The user's primary email address.
`USER_IMPACTED_EMAIL` `string`


User impacted email.
Sample request `GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/admin?eventName=UPDATE_PUBLIC_KEY_CERTIFICATE&maxResults=10&access_token=YOUR_ACCESS_TOKEN` Admin Console message format `Public key certificate updated for {USER_DISPLAY_NAME} email {USER_EMAIL}`

### Remove Recovery Email

Event details Event name `REMOVE_RECOVERY_EMAIL` Parameters `USER_EMAIL` `string`


The user's primary email address.
Sample request `GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/admin?eventName=REMOVE_RECOVERY_EMAIL&maxResults=10&access_token=YOUR_ACCESS_TOKEN` Admin Console message format `Recovery email removed for {USER_EMAIL}`

### Remove Recovery Phone

Event details Event name `REMOVE_RECOVERY_PHONE` Parameters `USER_EMAIL` `string`


The user's primary email address.
Sample request `GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/admin?eventName=REMOVE_RECOVERY_PHONE&maxResults=10&access_token=YOUR_ACCESS_TOKEN` Admin Console message format `Recovery phone removed for {USER_EMAIL}`

### Request account information

Event details Event name `REQUEST_ACCOUNT_INFO` Parameters `USER_EMAIL` `string`


The user's primary email address.
Sample request `GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/admin?eventName=REQUEST_ACCOUNT_INFO&maxResults=10&access_token=YOUR_ACCESS_TOKEN` Admin Console message format `Requested account and login information for {USER_EMAIL}`

### Request mailbox dump

Event details Event name `REQUEST_MAILBOX_DUMP` Parameters `BEGIN_DATE_TIME` `string`


The start date and time for the email monitor.
`EMAIL_EXPORT_INCLUDE_DELETED` `string`


Indicates if deleted emails are included in the export.
`EMAIL_EXPORT_PACKAGE_CONTENT` `string`


The contents of the mailbox package.
`END_DATE_TIME` `string`


The end date and time for the email monitor.
`SEARCH_QUERY_FOR_DUMP` `string`


The search query used for the dump.
`USER_EMAIL` `string`


The user's primary email address.
Sample request `GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/admin?eventName=REQUEST_MAILBOX_DUMP&maxResults=10&access_token=YOUR_ACCESS_TOKEN` Admin Console message format `Requested mailbox dump for {USER_EMAIL}`

### Resend User Invite

Event details Event name `RESEND_USER_INVITE` Parameters `DOMAIN_NAME` `string`


The primary domain name.
`USER_EMAIL` `string`


The user's primary email address.
Sample request `GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/admin?eventName=RESEND_USER_INVITE&maxResults=10&access_token=YOUR_ACCESS_TOKEN` Admin Console message format `Invite email to {USER_EMAIL} resent`

### Reset Cookies and Forced Relogin

Event details Event name `RESET_SIGNIN_COOKIES` Parameters `USER_EMAIL` `string`


The user's primary email address.
Sample request `GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/admin?eventName=RESET_SIGNIN_COOKIES&maxResults=10&access_token=YOUR_ACCESS_TOKEN` Admin Console message format `Cookies reset for {USER_EMAIL} and forced re-login`

### Security Key Registered For User

Event details Event name `SECURITY_KEY_REGISTERED_FOR_USER` Parameters `USER_EMAIL` `string`


The user's primary email address.
Sample request `GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/admin?eventName=SECURITY_KEY_REGISTERED_FOR_USER&maxResults=10&access_token=YOUR_ACCESS_TOKEN` Admin Console message format `Security key registered for {USER_EMAIL}`

### Security Key Revoke

Event details Event name `REVOKE_SECURITY_KEY` Parameters `enrollment_type` `string`


Describers whether the passkey was enrolled by user or created automatically.
Possible values:

- `automatically_created`  
  Passkey enrolled automatically on android device.
- `user_created`  
  Passkey enrolled by end user.
`passkey_added_from` `string`


Location from where the passkey was added.
`passkey_added_on_timestamp` `integer`


Timestamp when the passkey was added.
`passkey_last_used_from` `string`


Location from where was the passkey last used.
`passkey_last_used_timestamp` `integer`


Timestamp when the passkey was last used.
`platform_or_device` `string`


Platform or device used for creating the passkey.
Possible values:

- `apple_icloud_keychain`  
  Passkey created using apple icloud keychain.
- `bitwarden`  
  Passkey created using bitwarden.
- `chrome_on_mac`  
  Passkey created using chrome on mac.
- `chrome_os`  
  Passkey created using chrome os.
- `dashlane`  
  Passkey created using dashlane.
- `edge_on_mac`  
  Passkey created using Edge on Mac.
- `generic_passkey`  
  Passkey type generic passkey description.
- `generic_usb_key`  
  Passkey created using FIDO2 security key.
- `generic_usb_up_key`  
  Passkey created using security key.
- `google_account_passkey_on_android`  
  Passkey created using android device.
- `google_password_manager`  
  Passkey created using google password manager.
- `keeper`  
  Passkey created using keeper.
- `nordpass`  
  Passkey created using nordpass.
- `one_password`  
  Passkey created using 1Password.
- `samsung_pass`  
  Passkey created using Samsung pass.
- `titan_key`  
  Passkey created using titan security key.
- `windows_hello`  
  Passkey created using windows hello.
- `yubikey`  
  Passkey created using yubico security key.
`supports_passwordless` `boolean`


Whether the passkey can be used to skip password.
`USER_EMAIL` `string`


The user's primary email address.
Sample request `GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/admin?eventName=REVOKE_SECURITY_KEY&maxResults=10&access_token=YOUR_ACCESS_TOKEN` Admin Console message format `A security key enrolled for user {USER_EMAIL} for 2-step verification was revoked`

### Send User Invite

Event details Event name `USER_INVITE` Parameters `DOMAIN_NAME` `string`


The primary domain name.
`USER_EMAIL` `string`


The user's primary email address.
Sample request `GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/admin?eventName=USER_INVITE&maxResults=10&access_token=YOUR_ACCESS_TOKEN` Admin Console message format `{USER_EMAIL} invited to join your organization`

### Temporary Password Viewed

Event details Event name `VIEW_TEMP_PASSWORD` Parameters `DOMAIN_NAME` `string`


The primary domain name.
`USER_EMAIL` `string`


The user's primary email address.
Sample request `GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/admin?eventName=VIEW_TEMP_PASSWORD&maxResults=10&access_token=YOUR_ACCESS_TOKEN` Admin Console message format `Temporary password for user {USER_EMAIL} viewed by the admin`

### Turn off 2-step verification

Event details Event name `TURN_OFF_2_STEP_VERIFICATION` Parameters `USER_EMAIL` `string`


The user's primary email address.
Sample request `GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/admin?eventName=TURN_OFF_2_STEP_VERIFICATION&maxResults=10&access_token=YOUR_ACCESS_TOKEN` Admin Console message format `2-step verification has been turned off for the user {USER_EMAIL}`

### Unblock User Session

Event details Event name `UNBLOCK_USER_SESSION` Parameters `USER_EMAIL` `string`


The user's primary email address.
Sample request `GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/admin?eventName=UNBLOCK_USER_SESSION&maxResults=10&access_token=YOUR_ACCESS_TOKEN` Admin Console message format `User {USER_EMAIL} unblocked by temporarily disabling login challenge`

### Unmanaged Users Bulk Upload

Event details Event name `UNMANAGED_USERS_BULK_UPLOAD` Parameters `BULK_UPLOAD_FAIL_USERS_NUMBER` `string`


Bulk Upload Failed Users Number.
`BULK_UPLOAD_TOTAL_USERS_NUMBER` `string`


Bulk Upload Total Users Number.
Sample request `GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/admin?eventName=UNMANAGED_USERS_BULK_UPLOAD&maxResults=10&access_token=YOUR_ACCESS_TOKEN` Admin Console message format `A total of {BULK_UPLOAD_TOTAL_USERS_NUMBER} unmanaged users selected for upload. {BULK_UPLOAD_FAIL_USERS_NUMBER} out of {BULK_UPLOAD_TOTAL_USERS_NUMBER} users failed to be uploaded.`

### Unmanaged Users List Download

| Event details ||
|---|---|
| Event name | `DOWNLOAD_UNMANAGED_USERS_LIST` |
| Sample request | `GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/admin?eventName=DOWNLOAD_UNMANAGED_USERS_LIST&maxResults=10&access_token=YOUR_ACCESS_TOKEN` |
| Admin Console message format | `Unmanaged Users list was downloaded as a CSV file` |

### Update Profile Photo

Event details Event name `UPDATE_PROFILE_PHOTO` Parameters `USER_EMAIL` `string`


The user's primary email address.
Sample request `GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/admin?eventName=UPDATE_PROFILE_PHOTO&maxResults=10&access_token=YOUR_ACCESS_TOKEN` Admin Console message format `Profile photo of {USER_EMAIL} has been updated`

### User Advanced Protection Unenroll

Event details Event name `UNENROLL_USER_FROM_TITANIUM` Parameters `USER_EMAIL` `string`


The user's primary email address.
Sample request `GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/admin?eventName=UNENROLL_USER_FROM_TITANIUM&maxResults=10&access_token=YOUR_ACCESS_TOKEN` Admin Console message format `User {USER_EMAIL} unenrolled from Advanced Protection`

### User Archival

Event details Event name `ARCHIVE_USER` Parameters `USER_EMAIL` `string`


The user's primary email address.
Sample request `GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/admin?eventName=ARCHIVE_USER&maxResults=10&access_token=YOUR_ACCESS_TOKEN` Admin Console message format `{USER_EMAIL} archived`

### User BirthDate Change

Event details Event name `UPDATE_BIRTHDATE` Parameters `BIRTHDATE` `string`


The date of the user's birthday.
`USER_EMAIL` `string`


The user's primary email address.
Sample request `GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/admin?eventName=UPDATE_BIRTHDATE&maxResults=10&access_token=YOUR_ACCESS_TOKEN` Admin Console message format `The birth date for {USER_EMAIL} changed to {BIRTHDATE}`

### User created passkey revoked

Event details Event name `USER_CREATED_PASSKEY_REVOKE` Parameters `USER_EMAIL` `string`


The user's primary email address.
Sample request `GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/admin?eventName=USER_CREATED_PASSKEY_REVOKE&maxResults=10&access_token=YOUR_ACCESS_TOKEN` Admin Console message format `A user created passkey enrolled for user {USER_EMAIL} was revoked`

### User Creation

Event details Event name `CREATE_USER` Parameters `USER_EMAIL` `string`


The new user's primary user email.
Sample request `GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/admin?eventName=CREATE_USER&maxResults=10&access_token=YOUR_ACCESS_TOKEN` Admin Console message format `{USER_EMAIL} created`

### User Deletion

Event details Event name `DELETE_USER` Parameters `USER_EMAIL` `string`


The deleted user's primary user email.
Sample request `GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/admin?eventName=DELETE_USER&maxResults=10&access_token=YOUR_ACCESS_TOKEN` Admin Console message format `{USER_EMAIL} deleted`

### User Downgrade From Google+

Event details Event name `DOWNGRADE_USER_FROM_GPLUS` Parameters `USER_EMAIL` `string`


The user's primary email address.
Sample request `GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/admin?eventName=DOWNGRADE_USER_FROM_GPLUS&maxResults=10&access_token=YOUR_ACCESS_TOKEN` Admin Console message format `{USER_EMAIL} was downgraded from Google+`

### User Enrolled In 2-Step Verification

Event details Event name `USER_ENROLLED_IN_TWO_STEP_VERIFICATION` Parameters `USER_EMAIL` `string`


The user's primary email address.
Sample request `GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/admin?eventName=USER_ENROLLED_IN_TWO_STEP_VERIFICATION&maxResults=10&access_token=YOUR_ACCESS_TOKEN` Admin Console message format `{USER_EMAIL} enrolled in 2-step verification`

### User List Download

| Event details ||
|---|---|
| Event name | `DOWNLOAD_USERLIST_CSV` |
| Sample request | `GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/admin?eventName=DOWNLOAD_USERLIST_CSV&maxResults=10&access_token=YOUR_ACCESS_TOKEN` |
| Admin Console message format | `User list was downloaded as a CSV file` |

### User List Download

Event details Event name `DOWNLOAD_USERLIST` Parameters `FORMAT` `string`


Format.
Sample request `GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/admin?eventName=DOWNLOAD_USERLIST&maxResults=10&access_token=YOUR_ACCESS_TOKEN` Admin Console message format `User list was downloaded in {FORMAT}`

### User OrgUnit Change

Event details Event name `MOVE_USER_TO_ORG_UNIT` Parameters `NEW_VALUE` `string`


The user's new organizational unit.
`ORG_UNIT_NAME` `string`


The organizational unit (OU) name (path).
`USER_EMAIL` `string`


The user's primary email address.
Sample request `GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/admin?eventName=MOVE_USER_TO_ORG_UNIT&maxResults=10&access_token=YOUR_ACCESS_TOKEN` Admin Console message format `{USER_EMAIL} moved from {ORG_UNIT_NAME} to {NEW_VALUE}`

### User Put In 2-Step Verification Grace Period

Event details Event name `USER_PUT_IN_TWO_STEP_VERIFICATION_GRACE_PERIOD` Parameters `NEW_VALUE` `string`


The new `SETTING_NAME` value that was set during this event.
`USER_EMAIL` `string`


The user's primary email address.
Sample request `GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/admin?eventName=USER_PUT_IN_TWO_STEP_VERIFICATION_GRACE_PERIOD&maxResults=10&access_token=YOUR_ACCESS_TOKEN` Admin Console message format `2-step verification grace period has been enabled on {USER_EMAIL} till {NEW_VALUE}`

### User Rename

Event details Event name `RENAME_USER` Parameters `NEW_VALUE` `string`


The user's new name.
`USER_EMAIL` `string`


The user's primary email address.
Sample request `GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/admin?eventName=RENAME_USER&maxResults=10&access_token=YOUR_ACCESS_TOKEN` Admin Console message format `{USER_EMAIL} renamed to {NEW_VALUE}`

### User Strong Auth Unenroll

Event details Event name `UNENROLL_USER_FROM_STRONG_AUTH` Parameters `USER_EMAIL` `string`


The user's primary email address.
Sample request `GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/admin?eventName=UNENROLL_USER_FROM_STRONG_AUTH&maxResults=10&access_token=YOUR_ACCESS_TOKEN` Admin Console message format `User {USER_EMAIL} unenrolled from Strong Auth`

### User Suspension

Event details Event name `SUSPEND_USER` Parameters `USER_EMAIL` `string`


The user's primary email address.
Sample request `GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/admin?eventName=SUSPEND_USER&maxResults=10&access_token=YOUR_ACCESS_TOKEN` Admin Console message format `{USER_EMAIL} suspended`

### User Unarchival

Event details Event name `UNARCHIVE_USER` Parameters `USER_EMAIL` `string`


The user's primary email address.
Sample request `GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/admin?eventName=UNARCHIVE_USER&maxResults=10&access_token=YOUR_ACCESS_TOKEN` Admin Console message format `{USER_EMAIL} unarchived`

### User Undeletion

Event details Event name `UNDELETE_USER` Parameters `USER_EMAIL` `string`


The user's primary email address.
Sample request `GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/admin?eventName=UNDELETE_USER&maxResults=10&access_token=YOUR_ACCESS_TOKEN` Admin Console message format `{USER_EMAIL} undeleted`

### User Unsuspension

Event details Event name `UNSUSPEND_USER` Parameters `USER_EMAIL` `string`


The user's primary email address.
Sample request `GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/admin?eventName=UNSUSPEND_USER&maxResults=10&access_token=YOUR_ACCESS_TOKEN` Admin Console message format `{USER_EMAIL} unsuspended`

### User Upgrade To Google+

Event details Event name `UPGRADE_USER_TO_GPLUS` Parameters `USER_EMAIL` `string`


The user's primary email address.
Sample request `GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/admin?eventName=UPGRADE_USER_TO_GPLUS&maxResults=10&access_token=YOUR_ACCESS_TOKEN` Admin Console message format `{USER_EMAIL} was upgraded to Google+`

### Users Bulk Upload

Event details Event name `USERS_BULK_UPLOAD` Parameters `BULK_UPLOAD_FAIL_USERS_NUMBER` `string`


The number of failures when attempting to bulk upload users.
`BULK_UPLOAD_TOTAL_USERS_NUMBER` `string`


The total number of bulk uploaded users.
Sample request `GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/admin?eventName=USERS_BULK_UPLOAD&maxResults=10&access_token=YOUR_ACCESS_TOKEN` Admin Console message format `A total of {BULK_UPLOAD_TOTAL_USERS_NUMBER} users selected for upload. {BULK_UPLOAD_FAIL_USERS_NUMBER} out of {BULK_UPLOAD_TOTAL_USERS_NUMBER} users failed to be uploaded.`

### Users Bulk Upload Notification

Event details Event name `USERS_BULK_UPLOAD_NOTIFICATION_SENT` Parameters `USER_EMAIL` `string`


The user's primary email address.
Sample request `GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/admin?eventName=USERS_BULK_UPLOAD_NOTIFICATION_SENT&maxResults=10&access_token=YOUR_ACCESS_TOKEN` Admin Console message format `Notification of bulk users upload sent to {USER_EMAIL}`