User Accounts Audit Activity Events

This document lists the events and parameters for various types of User Accounts Audit activity events. You can retrieve these events by calling Activities.list() with applicationName=user_accounts.

2-step verification enrollment changed

Events of this type are returned with type=2sv_change.

2-step verification disable

Event details
Event name 2sv_disable
Sample request
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/user_accounts?eventName=2sv_disable&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format
{actor} has disabled 2-step verification

2-step verification enroll

Event details
Event name 2sv_enroll
Sample request
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/user_accounts?eventName=2sv_enroll&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format
{actor} has enrolled for 2-step verification

Account password changed

Events of this type are returned with type=password_change.

Account password change

Event details
Event name password_edit
Sample request
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/user_accounts?eventName=password_edit&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format
{actor} has changed Account password

Account recovery info changed

Account recovery information changed. Events of this type are returned with type=recovery_info_change.

Account recovery email change

Event details
Event name recovery_email_edit
Sample request
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/user_accounts?eventName=recovery_email_edit&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format
{actor} has changed Account recovery email

Account recovery phone change

Event details
Event name recovery_phone_edit
Sample request
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/user_accounts?eventName=recovery_phone_edit&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format
{actor} has changed Account recovery phone

Account recovery secret question/answer change

Event details
Event name recovery_secret_qa_edit
Sample request
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/user_accounts?eventName=recovery_secret_qa_edit&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format
{actor} has changed Account recovery secret question/answer

Advanced Protection enrollment changed

Events of this type are returned with type=titanium_change.

Advanced Protection enroll

Event details
Event name titanium_enroll
Sample request
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/user_accounts?eventName=titanium_enroll&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format
{actor} has enrolled for Advanced Protection

Advanced Protection unenroll

Event details
Event name titanium_unenroll
Sample request
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/user_accounts?eventName=titanium_unenroll&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format
{actor} has disabled Advanced Protection

Email forwarding settings changed

Events of this type are returned with type=email_forwarding_change.

Out of domain email forwarding enabled

Event details
Event name email_forwarding_out_of_domain
Sample request
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/user_accounts?eventName=email_forwarding_out_of_domain&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format
{actor} has enabled out of domain email forwarding to {email_forwarding_destination_address}.