# Vault Audit Activity Events

This document lists the events and parameters for
various types of
Vault Audit activity events. You can retrieve these events by
calling [Activities.list()](https://developers.google.com/workspace/admin/reports/v1/reference/activities/list)
with `applicationName=vault`.

## Event Type: User Action


User Action Event Type.
Events of this type are returned with `type=user_action`.

### Add Collaborator Begin

The name of the Vault event: Add Collaborator Begin.

| Event details ||
|---|---|
| Event name | `add_collaborator_begin` |
| Parameters | |---|---| | `additional_details` | `string` Additional details pertaining to an audit log. | | `matter_id` | `string` The Matter ID an audit pertains to. | | `organizational_unit_name` | `string` The organizational unit name. | | `query` | `string` The user inputted query for search and exports. | | `resource_name` | `string` The resource name of the action, such as hold name or saved query name. | | `resource_url` | `string` The document URL of the document view. | | `target_user` | `string` The targeted user (such as user put on hold). | |
| Sample request | `GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/vault?eventName=add_collaborator_begin&maxResults=10&access_token=YOUR_ACCESS_TOKEN` |
| Admin Console message format | `Collaborator addition began` |

### Add Collaborator End

The name of the Vault event: Add Collaborator End.

| Event details ||
|---|---|
| Event name | `add_collaborator_end` |
| Parameters | |---|---| | `additional_details` | `string` Additional details pertaining to an audit log. | | `matter_id` | `string` The Matter ID an audit pertains to. | | `organizational_unit_name` | `string` The organizational unit name. | | `query` | `string` The user inputted query for search and exports. | | `resource_name` | `string` The resource name of the action, such as hold name or saved query name. | | `resource_url` | `string` The document URL of the document view. | | `target_user` | `string` The targeted user (such as user put on hold). | |
| Sample request | `GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/vault?eventName=add_collaborator_end&maxResults=10&access_token=YOUR_ACCESS_TOKEN` |
| Admin Console message format | `Collaborator addition ended` |

### Add Litigation Hold Begin

The name of the Vault event: Add Litigation Hold Begin.

| Event details ||
|---|---|
| Event name | `add_litigation_hold_begin` |
| Parameters | |---|---| | `additional_details` | `string` Additional details pertaining to an audit log. | | `matter_id` | `string` The Matter ID an audit pertains to. | | `organizational_unit_name` | `string` The organizational unit name. | | `query` | `string` The user inputted query for search and exports. | | `resource_name` | `string` The resource name of the action, such as hold name or saved query name. | | `resource_url` | `string` The document URL of the document view. | | `target_user` | `string` The targeted user (such as user put on hold). | |
| Sample request | `GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/vault?eventName=add_litigation_hold_begin&maxResults=10&access_token=YOUR_ACCESS_TOKEN` |
| Admin Console message format | `Litigation hold addition began` |

### Add Litigation Hold End

The name of the Vault event: Add Litigation Hold End.

| Event details ||
|---|---|
| Event name | `add_litigation_hold_end` |
| Parameters | |---|---| | `additional_details` | `string` Additional details pertaining to an audit log. | | `matter_id` | `string` The Matter ID an audit pertains to. | | `organizational_unit_name` | `string` The organizational unit name. | | `query` | `string` The user inputted query for search and exports. | | `resource_name` | `string` The resource name of the action, such as hold name or saved query name. | | `resource_url` | `string` The document URL of the document view. | | `target_user` | `string` The targeted user (such as user put on hold). | |
| Sample request | `GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/vault?eventName=add_litigation_hold_end&maxResults=10&access_token=YOUR_ACCESS_TOKEN` |
| Admin Console message format | `Litigation hold addition ended` |

### Add Preservation Rule Begin

The name of the Vault event: Add Preservation Rule Begin.

| Event details ||
|---|---|
| Event name | `add_preservation_rule_begin` |
| Parameters | |---|---| | `additional_details` | `string` Additional details pertaining to an audit log. | | `matter_id` | `string` The Matter ID an audit pertains to. | | `organizational_unit_name` | `string` The organizational unit name. | | `query` | `string` The user inputted query for search and exports. | | `resource_name` | `string` The resource name of the action, such as hold name or saved query name. | | `resource_url` | `string` The document URL of the document view. | | `target_user` | `string` The targeted user (such as user put on hold). | |
| Sample request | `GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/vault?eventName=add_preservation_rule_begin&maxResults=10&access_token=YOUR_ACCESS_TOKEN` |
| Admin Console message format | `Preservation rule addition began` |

### Add Preservation Rule End

The name of the Vault event: Add Preservation Rule End.

| Event details ||
|---|---|
| Event name | `add_preservation_rule_end` |
| Parameters | |---|---| | `additional_details` | `string` Additional details pertaining to an audit log. | | `matter_id` | `string` The Matter ID an audit pertains to. | | `organizational_unit_name` | `string` The organizational unit name. | | `query` | `string` The user inputted query for search and exports. | | `resource_name` | `string` The resource name of the action, such as hold name or saved query name. | | `resource_url` | `string` The document URL of the document view. | | `target_user` | `string` The targeted user (such as user put on hold). | |
| Sample request | `GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/vault?eventName=add_preservation_rule_end&maxResults=10&access_token=YOUR_ACCESS_TOKEN` |
| Admin Console message format | `Preservation rule addition ended` |

### Add Retention Rule Begin

The name of the Vault event: Add Retention Rule Begin.

| Event details ||
|---|---|
| Event name | `add_retention_rule_begin` |
| Parameters | |---|---| | `additional_details` | `string` Additional details pertaining to an audit log. | | `matter_id` | `string` The Matter ID an audit pertains to. | | `organizational_unit_name` | `string` The organizational unit name. | | `query` | `string` The user inputted query for search and exports. | | `resource_name` | `string` The resource name of the action, such as hold name or saved query name. | | `resource_url` | `string` The document URL of the document view. | | `target_user` | `string` The targeted user (such as user put on hold). | |
| Sample request | `GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/vault?eventName=add_retention_rule_begin&maxResults=10&access_token=YOUR_ACCESS_TOKEN` |
| Admin Console message format | `Retention rule addition began` |

### Add Retention Rule End

The name of the Vault event: Add Retention Rule End.

| Event details ||
|---|---|
| Event name | `add_retention_rule_end` |
| Parameters | |---|---| | `additional_details` | `string` Additional details pertaining to an audit log. | | `matter_id` | `string` The Matter ID an audit pertains to. | | `organizational_unit_name` | `string` The organizational unit name. | | `query` | `string` The user inputted query for search and exports. | | `resource_name` | `string` The resource name of the action, such as hold name or saved query name. | | `resource_url` | `string` The document URL of the document view. | | `target_user` | `string` The targeted user (such as user put on hold). | |
| Sample request | `GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/vault?eventName=add_retention_rule_end&maxResults=10&access_token=YOUR_ACCESS_TOKEN` |
| Admin Console message format | `Retention rule addition ended` |

### Cancel Accelerated Deletion Begin

The name of the Vault event: Cancel Accelerated Deletion Begin.

| Event details ||
|---|---|
| Event name | `cancel_accelerated_deletion_begin` |
| Parameters | |---|---| | `additional_details` | `string` Additional details pertaining to an audit log. | | `matter_id` | `string` The Matter ID an audit pertains to. | | `organizational_unit_name` | `string` The organizational unit name. | | `query` | `string` The user inputted query for search and exports. | | `resource_name` | `string` The resource name of the action, such as hold name or saved query name. | | `resource_url` | `string` The document URL of the document view. | | `target_user` | `string` The targeted user (such as user put on hold). | |
| Sample request | `GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/vault?eventName=cancel_accelerated_deletion_begin&maxResults=10&access_token=YOUR_ACCESS_TOKEN` |
| Admin Console message format | `Accelerated deletion cancellation began` |

### Cancel Accelerated Deletion End

The name of the Vault event: Cancel Accelerated Deletion End.

| Event details ||
|---|---|
| Event name | `cancel_accelerated_deletion_end` |
| Parameters | |---|---| | `additional_details` | `string` Additional details pertaining to an audit log. | | `matter_id` | `string` The Matter ID an audit pertains to. | | `organizational_unit_name` | `string` The organizational unit name. | | `query` | `string` The user inputted query for search and exports. | | `resource_name` | `string` The resource name of the action, such as hold name or saved query name. | | `resource_url` | `string` The document URL of the document view. | | `target_user` | `string` The targeted user (such as user put on hold). | |
| Sample request | `GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/vault?eventName=cancel_accelerated_deletion_end&maxResults=10&access_token=YOUR_ACCESS_TOKEN` |
| Admin Console message format | `Accelerated deletion cancellation ended` |

### Close Investigation Begin

The name of the Vault event: Close Investigation Begin.

| Event details ||
|---|---|
| Event name | `close_investigation_begin` |
| Parameters | |---|---| | `additional_details` | `string` Additional details pertaining to an audit log. | | `matter_id` | `string` The Matter ID an audit pertains to. | | `organizational_unit_name` | `string` The organizational unit name. | | `query` | `string` The user inputted query for search and exports. | | `resource_name` | `string` The resource name of the action, such as hold name or saved query name. | | `resource_url` | `string` The document URL of the document view. | | `target_user` | `string` The targeted user (such as user put on hold). | |
| Sample request | `GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/vault?eventName=close_investigation_begin&maxResults=10&access_token=YOUR_ACCESS_TOKEN` |
| Admin Console message format | `Investigation closure began` |

### Close Investigation End

The name of the Vault event: Close Investigation End.

| Event details ||
|---|---|
| Event name | `close_investigation_end` |
| Parameters | |---|---| | `additional_details` | `string` Additional details pertaining to an audit log. | | `matter_id` | `string` The Matter ID an audit pertains to. | | `organizational_unit_name` | `string` The organizational unit name. | | `query` | `string` The user inputted query for search and exports. | | `resource_name` | `string` The resource name of the action, such as hold name or saved query name. | | `resource_url` | `string` The document URL of the document view. | | `target_user` | `string` The targeted user (such as user put on hold). | |
| Sample request | `GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/vault?eventName=close_investigation_end&maxResults=10&access_token=YOUR_ACCESS_TOKEN` |
| Admin Console message format | `Investigation closure ended` |

### Convert Saved Query To Collection Begin

The name of the Vault event: Convert Saved Query To Collection Begin.

| Event details ||
|---|---|
| Event name | `convert_saved_query_to_collection_begin` |
| Parameters | |---|---| | `additional_details` | `string` Additional details pertaining to an audit log. | | `matter_id` | `string` The Matter ID an audit pertains to. | | `organizational_unit_name` | `string` The organizational unit name. | | `query` | `string` The user inputted query for search and exports. | | `resource_name` | `string` The resource name of the action, such as hold name or saved query name. | | `resource_url` | `string` The document URL of the document view. | | `target_user` | `string` The targeted user (such as user put on hold). | |
| Sample request | `GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/vault?eventName=convert_saved_query_to_collection_begin&maxResults=10&access_token=YOUR_ACCESS_TOKEN` |
| Admin Console message format | `Saved query to collection conversion began` |

### Convert Saved Query To Collection End

The name of the Vault event: Convert Saved Query To Collection End.

| Event details ||
|---|---|
| Event name | `convert_saved_query_to_collection_end` |
| Parameters | |---|---| | `additional_details` | `string` Additional details pertaining to an audit log. | | `matter_id` | `string` The Matter ID an audit pertains to. | | `organizational_unit_name` | `string` The organizational unit name. | | `query` | `string` The user inputted query for search and exports. | | `resource_name` | `string` The resource name of the action, such as hold name or saved query name. | | `resource_url` | `string` The document URL of the document view. | | `target_user` | `string` The targeted user (such as user put on hold). | |
| Sample request | `GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/vault?eventName=convert_saved_query_to_collection_end&maxResults=10&access_token=YOUR_ACCESS_TOKEN` |
| Admin Console message format | `Saved query to collection conversion ended` |

### Create Accelerated Deletion Begin

The name of the Vault event: Create Accelerated Deletion Begin.

| Event details ||
|---|---|
| Event name | `create_accelerated_deletion_begin` |
| Parameters | |---|---| | `additional_details` | `string` Additional details pertaining to an audit log. | | `matter_id` | `string` The Matter ID an audit pertains to. | | `organizational_unit_name` | `string` The organizational unit name. | | `query` | `string` The user inputted query for search and exports. | | `resource_name` | `string` The resource name of the action, such as hold name or saved query name. | | `resource_url` | `string` The document URL of the document view. | | `target_user` | `string` The targeted user (such as user put on hold). | |
| Sample request | `GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/vault?eventName=create_accelerated_deletion_begin&maxResults=10&access_token=YOUR_ACCESS_TOKEN` |
| Admin Console message format | `Accelerated deletion request creation began` |

### Create Accelerated Deletion End

The name of the Vault event: Create Accelerated Deletion End.

| Event details ||
|---|---|
| Event name | `create_accelerated_deletion_end` |
| Parameters | |---|---| | `additional_details` | `string` Additional details pertaining to an audit log. | | `matter_id` | `string` The Matter ID an audit pertains to. | | `organizational_unit_name` | `string` The organizational unit name. | | `query` | `string` The user inputted query for search and exports. | | `resource_name` | `string` The resource name of the action, such as hold name or saved query name. | | `resource_url` | `string` The document URL of the document view. | | `target_user` | `string` The targeted user (such as user put on hold). | |
| Sample request | `GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/vault?eventName=create_accelerated_deletion_end&maxResults=10&access_token=YOUR_ACCESS_TOKEN` |
| Admin Console message format | `Accelerated deletion request creation ended` |

### Create Export Begin

The name of the Vault event: Create Export Begin.

| Event details ||
|---|---|
| Event name | `create_export_begin` |
| Parameters | |---|---| | `additional_details` | `string` Additional details pertaining to an audit log. | | `matter_id` | `string` The Matter ID an audit pertains to. | | `organizational_unit_name` | `string` The organizational unit name. | | `query` | `string` The user inputted query for search and exports. | | `resource_name` | `string` The resource name of the action, such as hold name or saved query name. | | `resource_url` | `string` The document URL of the document view. | | `target_user` | `string` The targeted user (such as user put on hold). | |
| Sample request | `GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/vault?eventName=create_export_begin&maxResults=10&access_token=YOUR_ACCESS_TOKEN` |
| Admin Console message format | `Export creation began` |

### Create Export End

The name of the Vault event: Create Export End.

| Event details ||
|---|---|
| Event name | `create_export_end` |
| Parameters | |---|---| | `additional_details` | `string` Additional details pertaining to an audit log. | | `matter_id` | `string` The Matter ID an audit pertains to. | | `organizational_unit_name` | `string` The organizational unit name. | | `query` | `string` The user inputted query for search and exports. | | `resource_name` | `string` The resource name of the action, such as hold name or saved query name. | | `resource_url` | `string` The document URL of the document view. | | `target_user` | `string` The targeted user (such as user put on hold). | |
| Sample request | `GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/vault?eventName=create_export_end&maxResults=10&access_token=YOUR_ACCESS_TOKEN` |
| Admin Console message format | `Export creation ended` |

### Create Investigation Begin

The name of the Vault event: Create Investigation Begin.

| Event details ||
|---|---|
| Event name | `create_investigation_begin` |
| Parameters | |---|---| | `additional_details` | `string` Additional details pertaining to an audit log. | | `matter_id` | `string` The Matter ID an audit pertains to. | | `organizational_unit_name` | `string` The organizational unit name. | | `query` | `string` The user inputted query for search and exports. | | `resource_name` | `string` The resource name of the action, such as hold name or saved query name. | | `resource_url` | `string` The document URL of the document view. | | `target_user` | `string` The targeted user (such as user put on hold). | |
| Sample request | `GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/vault?eventName=create_investigation_begin&maxResults=10&access_token=YOUR_ACCESS_TOKEN` |
| Admin Console message format | `Investigation creation began` |

### Create Investigation End

The name of the Vault event: Create Investigation End.

| Event details ||
|---|---|
| Event name | `create_investigation_end` |
| Parameters | |---|---| | `additional_details` | `string` Additional details pertaining to an audit log. | | `matter_id` | `string` The Matter ID an audit pertains to. | | `organizational_unit_name` | `string` The organizational unit name. | | `query` | `string` The user inputted query for search and exports. | | `resource_name` | `string` The resource name of the action, such as hold name or saved query name. | | `resource_url` | `string` The document URL of the document view. | | `target_user` | `string` The targeted user (such as user put on hold). | |
| Sample request | `GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/vault?eventName=create_investigation_end&maxResults=10&access_token=YOUR_ACCESS_TOKEN` |
| Admin Console message format | `Investigation creation ended` |

### Create Saved Query Begin

The name of the Vault event: Create Saved Query Begin.

| Event details ||
|---|---|
| Event name | `create_saved_query_begin` |
| Parameters | |---|---| | `additional_details` | `string` Additional details pertaining to an audit log. | | `matter_id` | `string` The Matter ID an audit pertains to. | | `organizational_unit_name` | `string` The organizational unit name. | | `query` | `string` The user inputted query for search and exports. | | `resource_name` | `string` The resource name of the action, such as hold name or saved query name. | | `resource_url` | `string` The document URL of the document view. | | `target_user` | `string` The targeted user (such as user put on hold). | |
| Sample request | `GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/vault?eventName=create_saved_query_begin&maxResults=10&access_token=YOUR_ACCESS_TOKEN` |
| Admin Console message format | `Saved query creation began` |

### Create Saved Query End

The name of the Vault event: Create Saved Query End.

| Event details ||
|---|---|
| Event name | `create_saved_query_end` |
| Parameters | |---|---| | `additional_details` | `string` Additional details pertaining to an audit log. | | `matter_id` | `string` The Matter ID an audit pertains to. | | `organizational_unit_name` | `string` The organizational unit name. | | `query` | `string` The user inputted query for search and exports. | | `resource_name` | `string` The resource name of the action, such as hold name or saved query name. | | `resource_url` | `string` The document URL of the document view. | | `target_user` | `string` The targeted user (such as user put on hold). | |
| Sample request | `GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/vault?eventName=create_saved_query_end&maxResults=10&access_token=YOUR_ACCESS_TOKEN` |
| Admin Console message format | `Saved query creation ended` |

### Delete Export Begin

The name of the Vault event: Delete Export Begin.

| Event details ||
|---|---|
| Event name | `delete_export_begin` |
| Parameters | |---|---| | `additional_details` | `string` Additional details pertaining to an audit log. | | `matter_id` | `string` The Matter ID an audit pertains to. | | `organizational_unit_name` | `string` The organizational unit name. | | `query` | `string` The user inputted query for search and exports. | | `resource_name` | `string` The resource name of the action, such as hold name or saved query name. | | `resource_url` | `string` The document URL of the document view. | | `target_user` | `string` The targeted user (such as user put on hold). | |
| Sample request | `GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/vault?eventName=delete_export_begin&maxResults=10&access_token=YOUR_ACCESS_TOKEN` |
| Admin Console message format | `Export deletion began` |

### Delete Export End

The name of the Vault event: Delete Export End.

| Event details ||
|---|---|
| Event name | `delete_export_end` |
| Parameters | |---|---| | `additional_details` | `string` Additional details pertaining to an audit log. | | `matter_id` | `string` The Matter ID an audit pertains to. | | `organizational_unit_name` | `string` The organizational unit name. | | `query` | `string` The user inputted query for search and exports. | | `resource_name` | `string` The resource name of the action, such as hold name or saved query name. | | `resource_url` | `string` The document URL of the document view. | | `target_user` | `string` The targeted user (such as user put on hold). | |
| Sample request | `GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/vault?eventName=delete_export_end&maxResults=10&access_token=YOUR_ACCESS_TOKEN` |
| Admin Console message format | `Export deletion ended` |

### Delete Export Fail

The name of the Vault event: Delete Export Fail.

| Event details ||
|---|---|
| Event name | `delete_export_fail` |
| Parameters | |---|---| | `additional_details` | `string` Additional details pertaining to an audit log. | | `matter_id` | `string` The Matter ID an audit pertains to. | | `organizational_unit_name` | `string` The organizational unit name. | | `query` | `string` The user inputted query for search and exports. | | `resource_name` | `string` The resource name of the action, such as hold name or saved query name. | | `resource_url` | `string` The document URL of the document view. | | `target_user` | `string` The targeted user (such as user put on hold). | |
| Sample request | `GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/vault?eventName=delete_export_fail&maxResults=10&access_token=YOUR_ACCESS_TOKEN` |
| Admin Console message format | `Export deletion failed` |

### Delete Investigation Begin

The name of the Vault event: Delete Investigation Begin.

| Event details ||
|---|---|
| Event name | `delete_investigation_begin` |
| Parameters | |---|---| | `additional_details` | `string` Additional details pertaining to an audit log. | | `matter_id` | `string` The Matter ID an audit pertains to. | | `organizational_unit_name` | `string` The organizational unit name. | | `query` | `string` The user inputted query for search and exports. | | `resource_name` | `string` The resource name of the action, such as hold name or saved query name. | | `resource_url` | `string` The document URL of the document view. | | `target_user` | `string` The targeted user (such as user put on hold). | |
| Sample request | `GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/vault?eventName=delete_investigation_begin&maxResults=10&access_token=YOUR_ACCESS_TOKEN` |
| Admin Console message format | `Investigation deletion began` |

### Delete Investigation End

The name of the Vault event: Delete Investigation End.

| Event details ||
|---|---|
| Event name | `delete_investigation_end` |
| Parameters | |---|---| | `additional_details` | `string` Additional details pertaining to an audit log. | | `matter_id` | `string` The Matter ID an audit pertains to. | | `organizational_unit_name` | `string` The organizational unit name. | | `query` | `string` The user inputted query for search and exports. | | `resource_name` | `string` The resource name of the action, such as hold name or saved query name. | | `resource_url` | `string` The document URL of the document view. | | `target_user` | `string` The targeted user (such as user put on hold). | |
| Sample request | `GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/vault?eventName=delete_investigation_end&maxResults=10&access_token=YOUR_ACCESS_TOKEN` |
| Admin Console message format | `Investigation deletion ended` |

### Delete Preservation Rule Begin

The name of the Vault event: Delete Preservation Rule Begin.

| Event details ||
|---|---|
| Event name | `delete_preservation_rule_begin` |
| Parameters | |---|---| | `additional_details` | `string` Additional details pertaining to an audit log. | | `matter_id` | `string` The Matter ID an audit pertains to. | | `organizational_unit_name` | `string` The organizational unit name. | | `query` | `string` The user inputted query for search and exports. | | `resource_name` | `string` The resource name of the action, such as hold name or saved query name. | | `resource_url` | `string` The document URL of the document view. | | `target_user` | `string` The targeted user (such as user put on hold). | |
| Sample request | `GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/vault?eventName=delete_preservation_rule_begin&maxResults=10&access_token=YOUR_ACCESS_TOKEN` |
| Admin Console message format | `Preservation rule deletion began` |

### Delete Preservation Rule End

The name of the Vault event: Delete Preservation Rule End.

| Event details ||
|---|---|
| Event name | `delete_preservation_rule_end` |
| Parameters | |---|---| | `additional_details` | `string` Additional details pertaining to an audit log. | | `matter_id` | `string` The Matter ID an audit pertains to. | | `organizational_unit_name` | `string` The organizational unit name. | | `query` | `string` The user inputted query for search and exports. | | `resource_name` | `string` The resource name of the action, such as hold name or saved query name. | | `resource_url` | `string` The document URL of the document view. | | `target_user` | `string` The targeted user (such as user put on hold). | |
| Sample request | `GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/vault?eventName=delete_preservation_rule_end&maxResults=10&access_token=YOUR_ACCESS_TOKEN` |
| Admin Console message format | `Preservation rule deletion ended` |

### Delete Retention Rule Begin

The name of the Vault event: Delete Retention Rule Begin.

| Event details ||
|---|---|
| Event name | `delete_retention_rule_begin` |
| Parameters | |---|---| | `additional_details` | `string` Additional details pertaining to an audit log. | | `matter_id` | `string` The Matter ID an audit pertains to. | | `organizational_unit_name` | `string` The organizational unit name. | | `query` | `string` The user inputted query for search and exports. | | `resource_name` | `string` The resource name of the action, such as hold name or saved query name. | | `resource_url` | `string` The document URL of the document view. | | `target_user` | `string` The targeted user (such as user put on hold). | |
| Sample request | `GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/vault?eventName=delete_retention_rule_begin&maxResults=10&access_token=YOUR_ACCESS_TOKEN` |
| Admin Console message format | `Retention rule deletion began` |

### Delete Retention Rule End

The name of the Vault event: Delete Retention Rule End.

| Event details ||
|---|---|
| Event name | `delete_retention_rule_end` |
| Parameters | |---|---| | `additional_details` | `string` Additional details pertaining to an audit log. | | `matter_id` | `string` The Matter ID an audit pertains to. | | `organizational_unit_name` | `string` The organizational unit name. | | `query` | `string` The user inputted query for search and exports. | | `resource_name` | `string` The resource name of the action, such as hold name or saved query name. | | `resource_url` | `string` The document URL of the document view. | | `target_user` | `string` The targeted user (such as user put on hold). | |
| Sample request | `GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/vault?eventName=delete_retention_rule_end&maxResults=10&access_token=YOUR_ACCESS_TOKEN` |
| Admin Console message format | `Retention rule deletion ended` |

### Delete Saved Query Begin

The name of the Vault event: Delete Saved Query Begin.

| Event details ||
|---|---|
| Event name | `delete_saved_query_begin` |
| Parameters | |---|---| | `additional_details` | `string` Additional details pertaining to an audit log. | | `matter_id` | `string` The Matter ID an audit pertains to. | | `organizational_unit_name` | `string` The organizational unit name. | | `query` | `string` The user inputted query for search and exports. | | `resource_name` | `string` The resource name of the action, such as hold name or saved query name. | | `resource_url` | `string` The document URL of the document view. | | `target_user` | `string` The targeted user (such as user put on hold). | |
| Sample request | `GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/vault?eventName=delete_saved_query_begin&maxResults=10&access_token=YOUR_ACCESS_TOKEN` |
| Admin Console message format | `Saved query deletion began` |

### Delete Saved Query End

The name of the Vault event: Delete Saved Query End.

| Event details ||
|---|---|
| Event name | `delete_saved_query_end` |
| Parameters | |---|---| | `additional_details` | `string` Additional details pertaining to an audit log. | | `matter_id` | `string` The Matter ID an audit pertains to. | | `organizational_unit_name` | `string` The organizational unit name. | | `query` | `string` The user inputted query for search and exports. | | `resource_name` | `string` The resource name of the action, such as hold name or saved query name. | | `resource_url` | `string` The document URL of the document view. | | `target_user` | `string` The targeted user (such as user put on hold). | |
| Sample request | `GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/vault?eventName=delete_saved_query_end&maxResults=10&access_token=YOUR_ACCESS_TOKEN` |
| Admin Console message format | `Saved query deletion ended` |

### Deletion Search

The name of the Vault event: Deletion Search.

| Event details ||
|---|---|
| Event name | `deletion_search` |
| Parameters | |---|---| | `additional_details` | `string` Additional details pertaining to an audit log. | | `matter_id` | `string` The Matter ID an audit pertains to. | | `organizational_unit_name` | `string` The organizational unit name. | | `query` | `string` The user inputted query for search and exports. | | `resource_name` | `string` The resource name of the action, such as hold name or saved query name. | | `resource_url` | `string` The document URL of the document view. | | `target_user` | `string` The targeted user (such as user put on hold). | |
| Sample request | `GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/vault?eventName=deletion_search&maxResults=10&access_token=YOUR_ACCESS_TOKEN` |
| Admin Console message format | `User performed a deletion search` |

### Download Count Per Account CSV

The name of the Vault event: Download Count Per Account CSV.

| Event details ||
|---|---|
| Event name | `download_count_per_account_csv` |
| Parameters | |---|---| | `additional_details` | `string` Additional details pertaining to an audit log. | | `matter_id` | `string` The Matter ID an audit pertains to. | | `organizational_unit_name` | `string` The organizational unit name. | | `query` | `string` The user inputted query for search and exports. | | `resource_name` | `string` The resource name of the action, such as hold name or saved query name. | | `resource_url` | `string` The document URL of the document view. | | `target_user` | `string` The targeted user (such as user put on hold). | |
| Sample request | `GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/vault?eventName=download_count_per_account_csv&maxResults=10&access_token=YOUR_ACCESS_TOKEN` |
| Admin Console message format | `User downloaded count CSV results` |

### Download Cross Matter Litigation Hold Report

The name of the Vault event: Download Cross Matter Litigation Hold Report.

| Event details ||
|---|---|
| Event name | `download_cross_matter_litigation_hold_report` |
| Parameters | |---|---| | `additional_details` | `string` Additional details pertaining to an audit log. | | `matter_id` | `string` The Matter ID an audit pertains to. | | `organizational_unit_name` | `string` The organizational unit name. | | `query` | `string` The user inputted query for search and exports. | | `resource_name` | `string` The resource name of the action, such as hold name or saved query name. | | `resource_url` | `string` The document URL of the document view. | | `target_user` | `string` The targeted user (such as user put on hold). | |
| Sample request | `GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/vault?eventName=download_cross_matter_litigation_hold_report&maxResults=10&access_token=YOUR_ACCESS_TOKEN` |
| Admin Console message format | `User downloaded cross matter litigation hold report` |

### Download Per Matter Litigation Hold Report

The name of the Vault event: Download Per Matter Litigation Hold Report.

| Event details ||
|---|---|
| Event name | `download_per_matter_litigation_hold_report` |
| Parameters | |---|---| | `additional_details` | `string` Additional details pertaining to an audit log. | | `matter_id` | `string` The Matter ID an audit pertains to. | | `organizational_unit_name` | `string` The organizational unit name. | | `query` | `string` The user inputted query for search and exports. | | `resource_name` | `string` The resource name of the action, such as hold name or saved query name. | | `resource_url` | `string` The document URL of the document view. | | `target_user` | `string` The targeted user (such as user put on hold). | |
| Sample request | `GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/vault?eventName=download_per_matter_litigation_hold_report&maxResults=10&access_token=YOUR_ACCESS_TOKEN` |
| Admin Console message format | `User downloaded per matter litigation hold report` |

### Export

The name of the Vault event: Export.

| Event details ||
|---|---|
| Event name | `export` |
| Parameters | |---|---| | `additional_details` | `string` Additional details pertaining to an audit log. | | `matter_id` | `string` The Matter ID an audit pertains to. | | `organizational_unit_name` | `string` The organizational unit name. | | `query` | `string` The user inputted query for search and exports. | | `resource_name` | `string` The resource name of the action, such as hold name or saved query name. | | `resource_url` | `string` The document URL of the document view. | | `target_user` | `string` The targeted user (such as user put on hold). | |
| Sample request | `GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/vault?eventName=export&maxResults=10&access_token=YOUR_ACCESS_TOKEN` |
| Admin Console message format | `User performed an export` |

### Export File Download

The name of the Vault event: Export File Download.

| Event details ||
|---|---|
| Event name | `export_file_download` |
| Parameters | |---|---| | `additional_details` | `string` Additional details pertaining to an audit log. | | `matter_id` | `string` The Matter ID an audit pertains to. | | `organizational_unit_name` | `string` The organizational unit name. | | `query` | `string` The user inputted query for search and exports. | | `resource_name` | `string` The resource name of the action, such as hold name or saved query name. | | `resource_url` | `string` The document URL of the document view. | | `target_user` | `string` The targeted user (such as user put on hold). | |
| Sample request | `GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/vault?eventName=export_file_download&maxResults=10&access_token=YOUR_ACCESS_TOKEN` |
| Admin Console message format | `User downloaded an export file` |

### Get Count Operation

The name of the Vault event: Get Count Operation.

| Event details ||
|---|---|
| Event name | `get_count_operation` |
| Parameters | |---|---| | `additional_details` | `string` Additional details pertaining to an audit log. | | `matter_id` | `string` The Matter ID an audit pertains to. | | `organizational_unit_name` | `string` The organizational unit name. | | `query` | `string` The user inputted query for search and exports. | | `resource_name` | `string` The resource name of the action, such as hold name or saved query name. | | `resource_url` | `string` The document URL of the document view. | | `target_user` | `string` The targeted user (such as user put on hold). | |
| Sample request | `GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/vault?eventName=get_count_operation&maxResults=10&access_token=YOUR_ACCESS_TOKEN` |
| Admin Console message format | `User viewed search count` |

### Legacy Export Download

The name of the Vault event: Legacy Export Download.

| Event details ||
|---|---|
| Event name | `legacy_export_download` |
| Parameters | |---|---| | `additional_details` | `string` Additional details pertaining to an audit log. | | `matter_id` | `string` The Matter ID an audit pertains to. | | `organizational_unit_name` | `string` The organizational unit name. | | `query` | `string` The user inputted query for search and exports. | | `resource_name` | `string` The resource name of the action, such as hold name or saved query name. | | `resource_url` | `string` The document URL of the document view. | | `target_user` | `string` The targeted user (such as user put on hold). | |
| Sample request | `GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/vault?eventName=legacy_export_download&maxResults=10&access_token=YOUR_ACCESS_TOKEN` |
| Admin Console message format | `User downloaded a legacy export` |

### Modify Default Retention Period Begin

The name of the Vault event: Modify Default Retention Period Begin.

| Event details ||
|---|---|
| Event name | `modify_default_retention_period_begin` |
| Parameters | |---|---| | `additional_details` | `string` Additional details pertaining to an audit log. | | `matter_id` | `string` The Matter ID an audit pertains to. | | `organizational_unit_name` | `string` The organizational unit name. | | `query` | `string` The user inputted query for search and exports. | | `resource_name` | `string` The resource name of the action, such as hold name or saved query name. | | `resource_url` | `string` The document URL of the document view. | | `target_user` | `string` The targeted user (such as user put on hold). | |
| Sample request | `GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/vault?eventName=modify_default_retention_period_begin&maxResults=10&access_token=YOUR_ACCESS_TOKEN` |
| Admin Console message format | `Default retention period modification began` |

### Modify Default Retention Period End

The name of the Vault event: Modify Default Retention Period End.

| Event details ||
|---|---|
| Event name | `modify_default_retention_period_end` |
| Parameters | |---|---| | `additional_details` | `string` Additional details pertaining to an audit log. | | `matter_id` | `string` The Matter ID an audit pertains to. | | `organizational_unit_name` | `string` The organizational unit name. | | `query` | `string` The user inputted query for search and exports. | | `resource_name` | `string` The resource name of the action, such as hold name or saved query name. | | `resource_url` | `string` The document URL of the document view. | | `target_user` | `string` The targeted user (such as user put on hold). | |
| Sample request | `GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/vault?eventName=modify_default_retention_period_end&maxResults=10&access_token=YOUR_ACCESS_TOKEN` |
| Admin Console message format | `Default retention period modification ended` |

### Obsolete API Exports List

The name of the Vault event: Obsolete API Exports List.

| Event details ||
|---|---|
| Event name | `obsolete_api_exports_list` |
| Parameters | |---|---| | `additional_details` | `string` Additional details pertaining to an audit log. | | `matter_id` | `string` The Matter ID an audit pertains to. | | `organizational_unit_name` | `string` The organizational unit name. | | `query` | `string` The user inputted query for search and exports. | | `resource_name` | `string` The resource name of the action, such as hold name or saved query name. | | `resource_url` | `string` The document URL of the document view. | | `target_user` | `string` The targeted user (such as user put on hold). | |
| Sample request | `GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/vault?eventName=obsolete_api_exports_list&maxResults=10&access_token=YOUR_ACCESS_TOKEN` |
| Admin Console message format | `Exports listed through the API` |

### Obsolete API Holds Insert

The name of the Vault event: Obsolete API Holds Insert.

| Event details ||
|---|---|
| Event name | `obsolete_api_holds_insert` |
| Parameters | |---|---| | `additional_details` | `string` Additional details pertaining to an audit log. | | `matter_id` | `string` The Matter ID an audit pertains to. | | `organizational_unit_name` | `string` The organizational unit name. | | `query` | `string` The user inputted query for search and exports. | | `resource_name` | `string` The resource name of the action, such as hold name or saved query name. | | `resource_url` | `string` The document URL of the document view. | | `target_user` | `string` The targeted user (such as user put on hold). | |
| Sample request | `GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/vault?eventName=obsolete_api_holds_insert&maxResults=10&access_token=YOUR_ACCESS_TOKEN` |
| Admin Console message format | `Holds inserted through the API` |

### Obsolete API Holds List

The name of the Vault event: Obsolete API Holds List.

| Event details ||
|---|---|
| Event name | `obsolete_api_holds_list` |
| Parameters | |---|---| | `additional_details` | `string` Additional details pertaining to an audit log. | | `matter_id` | `string` The Matter ID an audit pertains to. | | `organizational_unit_name` | `string` The organizational unit name. | | `query` | `string` The user inputted query for search and exports. | | `resource_name` | `string` The resource name of the action, such as hold name or saved query name. | | `resource_url` | `string` The document URL of the document view. | | `target_user` | `string` The targeted user (such as user put on hold). | |
| Sample request | `GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/vault?eventName=obsolete_api_holds_list&maxResults=10&access_token=YOUR_ACCESS_TOKEN` |
| Admin Console message format | `Holds listed through the API` |

### Obsolete API Matters Delete

The name of the Vault event: Obsolete API Matters Delete.

| Event details ||
|---|---|
| Event name | `obsolete_api_matters_delete` |
| Parameters | |---|---| | `additional_details` | `string` Additional details pertaining to an audit log. | | `matter_id` | `string` The Matter ID an audit pertains to. | | `organizational_unit_name` | `string` The organizational unit name. | | `query` | `string` The user inputted query for search and exports. | | `resource_name` | `string` The resource name of the action, such as hold name or saved query name. | | `resource_url` | `string` The document URL of the document view. | | `target_user` | `string` The targeted user (such as user put on hold). | |
| Sample request | `GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/vault?eventName=obsolete_api_matters_delete&maxResults=10&access_token=YOUR_ACCESS_TOKEN` |
| Admin Console message format | `Matters deleted through the API` |

### Obsolete API Matters Get

The name of the Vault event: Obsolete API Matters Get.

| Event details ||
|---|---|
| Event name | `obsolete_api_matters_get` |
| Parameters | |---|---| | `additional_details` | `string` Additional details pertaining to an audit log. | | `matter_id` | `string` The Matter ID an audit pertains to. | | `organizational_unit_name` | `string` The organizational unit name. | | `query` | `string` The user inputted query for search and exports. | | `resource_name` | `string` The resource name of the action, such as hold name or saved query name. | | `resource_url` | `string` The document URL of the document view. | | `target_user` | `string` The targeted user (such as user put on hold). | |
| Sample request | `GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/vault?eventName=obsolete_api_matters_get&maxResults=10&access_token=YOUR_ACCESS_TOKEN` |
| Admin Console message format | `Matter details retrieved through the API` |

### Obsolete API Matters Insert

The name of the Vault event: Obsolete API Matters Insert.

| Event details ||
|---|---|
| Event name | `obsolete_api_matters_insert` |
| Parameters | |---|---| | `additional_details` | `string` Additional details pertaining to an audit log. | | `matter_id` | `string` The Matter ID an audit pertains to. | | `organizational_unit_name` | `string` The organizational unit name. | | `query` | `string` The user inputted query for search and exports. | | `resource_name` | `string` The resource name of the action, such as hold name or saved query name. | | `resource_url` | `string` The document URL of the document view. | | `target_user` | `string` The targeted user (such as user put on hold). | |
| Sample request | `GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/vault?eventName=obsolete_api_matters_insert&maxResults=10&access_token=YOUR_ACCESS_TOKEN` |
| Admin Console message format | `Matters inserted through the API` |

### Obsolete API Matters List

The name of the Vault event: Obsolete API Matters List.

| Event details ||
|---|---|
| Event name | `obsolete_api_matters_list` |
| Parameters | |---|---| | `additional_details` | `string` Additional details pertaining to an audit log. | | `matter_id` | `string` The Matter ID an audit pertains to. | | `organizational_unit_name` | `string` The organizational unit name. | | `query` | `string` The user inputted query for search and exports. | | `resource_name` | `string` The resource name of the action, such as hold name or saved query name. | | `resource_url` | `string` The document URL of the document view. | | `target_user` | `string` The targeted user (such as user put on hold). | |
| Sample request | `GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/vault?eventName=obsolete_api_matters_list&maxResults=10&access_token=YOUR_ACCESS_TOKEN` |
| Admin Console message format | `Matters listed through the API` |

### Obsolete API Matters Update

The name of the Vault event: Obsolete API Matters Update.

| Event details ||
|---|---|
| Event name | `obsolete_api_matters_update` |
| Parameters | |---|---| | `additional_details` | `string` Additional details pertaining to an audit log. | | `matter_id` | `string` The Matter ID an audit pertains to. | | `organizational_unit_name` | `string` The organizational unit name. | | `query` | `string` The user inputted query for search and exports. | | `resource_name` | `string` The resource name of the action, such as hold name or saved query name. | | `resource_url` | `string` The document URL of the document view. | | `target_user` | `string` The targeted user (such as user put on hold). | |
| Sample request | `GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/vault?eventName=obsolete_api_matters_update&maxResults=10&access_token=YOUR_ACCESS_TOKEN` |
| Admin Console message format | `A matter updated through the API` |

### Obsolete Preview Retention Rule Count

The name of the Vault event: Obsolete Preview Retention Rule Count.

| Event details ||
|---|---|
| Event name | `obsolete_preview_retention_rule_count` |
| Parameters | |---|---| | `additional_details` | `string` Additional details pertaining to an audit log. | | `matter_id` | `string` The Matter ID an audit pertains to. | | `organizational_unit_name` | `string` The organizational unit name. | | `query` | `string` The user inputted query for search and exports. | | `resource_name` | `string` The resource name of the action, such as hold name or saved query name. | | `resource_url` | `string` The document URL of the document view. | | `target_user` | `string` The targeted user (such as user put on hold). | |
| Sample request | `GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/vault?eventName=obsolete_preview_retention_rule_count&maxResults=10&access_token=YOUR_ACCESS_TOKEN` |
| Admin Console message format | `User previewed retention rule count` |

### Preview Retention Rule

The name of the Vault event: Preview Retention Rule.

| Event details ||
|---|---|
| Event name | `preview_retention_rule` |
| Parameters | |---|---| | `additional_details` | `string` Additional details pertaining to an audit log. | | `matter_id` | `string` The Matter ID an audit pertains to. | | `organizational_unit_name` | `string` The organizational unit name. | | `query` | `string` The user inputted query for search and exports. | | `resource_name` | `string` The resource name of the action, such as hold name or saved query name. | | `resource_url` | `string` The document URL of the document view. | | `target_user` | `string` The targeted user (such as user put on hold). | |
| Sample request | `GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/vault?eventName=preview_retention_rule&maxResults=10&access_token=YOUR_ACCESS_TOKEN` |
| Admin Console message format | `User previewed retention rule` |

### Remove Collaborator Begin

The name of the Vault event: Remove Collaborator Begin.

| Event details ||
|---|---|
| Event name | `remove_collaborator_begin` |
| Parameters | |---|---| | `additional_details` | `string` Additional details pertaining to an audit log. | | `matter_id` | `string` The Matter ID an audit pertains to. | | `organizational_unit_name` | `string` The organizational unit name. | | `query` | `string` The user inputted query for search and exports. | | `resource_name` | `string` The resource name of the action, such as hold name or saved query name. | | `resource_url` | `string` The document URL of the document view. | | `target_user` | `string` The targeted user (such as user put on hold). | |
| Sample request | `GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/vault?eventName=remove_collaborator_begin&maxResults=10&access_token=YOUR_ACCESS_TOKEN` |
| Admin Console message format | `Collaborator removal began` |

### Remove Collaborator End

The name of the Vault event: Remove Collaborator End.

| Event details ||
|---|---|
| Event name | `remove_collaborator_end` |
| Parameters | |---|---| | `additional_details` | `string` Additional details pertaining to an audit log. | | `matter_id` | `string` The Matter ID an audit pertains to. | | `organizational_unit_name` | `string` The organizational unit name. | | `query` | `string` The user inputted query for search and exports. | | `resource_name` | `string` The resource name of the action, such as hold name or saved query name. | | `resource_url` | `string` The document URL of the document view. | | `target_user` | `string` The targeted user (such as user put on hold). | |
| Sample request | `GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/vault?eventName=remove_collaborator_end&maxResults=10&access_token=YOUR_ACCESS_TOKEN` |
| Admin Console message format | `Collaborator removal ended` |

### Remove Litigation Hold Begin

The name of the Vault event: Remove Litigation Hold Begin.

| Event details ||
|---|---|
| Event name | `remove_litigation_hold_begin` |
| Parameters | |---|---| | `additional_details` | `string` Additional details pertaining to an audit log. | | `matter_id` | `string` The Matter ID an audit pertains to. | | `organizational_unit_name` | `string` The organizational unit name. | | `query` | `string` The user inputted query for search and exports. | | `resource_name` | `string` The resource name of the action, such as hold name or saved query name. | | `resource_url` | `string` The document URL of the document view. | | `target_user` | `string` The targeted user (such as user put on hold). | |
| Sample request | `GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/vault?eventName=remove_litigation_hold_begin&maxResults=10&access_token=YOUR_ACCESS_TOKEN` |
| Admin Console message format | `Litigation hold removal began` |

### Remove Litigation Hold End

The name of the Vault event: Remove Litigation Hold End.

| Event details ||
|---|---|
| Event name | `remove_litigation_hold_end` |
| Parameters | |---|---| | `additional_details` | `string` Additional details pertaining to an audit log. | | `matter_id` | `string` The Matter ID an audit pertains to. | | `organizational_unit_name` | `string` The organizational unit name. | | `query` | `string` The user inputted query for search and exports. | | `resource_name` | `string` The resource name of the action, such as hold name or saved query name. | | `resource_url` | `string` The document URL of the document view. | | `target_user` | `string` The targeted user (such as user put on hold). | |
| Sample request | `GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/vault?eventName=remove_litigation_hold_end&maxResults=10&access_token=YOUR_ACCESS_TOKEN` |
| Admin Console message format | `Litigation hold removal ended` |

### Reopen Investigation Begin

The name of the Vault event: Reopen Investigation Begin.

| Event details ||
|---|---|
| Event name | `reopen_investigation_begin` |
| Parameters | |---|---| | `additional_details` | `string` Additional details pertaining to an audit log. | | `matter_id` | `string` The Matter ID an audit pertains to. | | `organizational_unit_name` | `string` The organizational unit name. | | `query` | `string` The user inputted query for search and exports. | | `resource_name` | `string` The resource name of the action, such as hold name or saved query name. | | `resource_url` | `string` The document URL of the document view. | | `target_user` | `string` The targeted user (such as user put on hold). | |
| Sample request | `GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/vault?eventName=reopen_investigation_begin&maxResults=10&access_token=YOUR_ACCESS_TOKEN` |
| Admin Console message format | `Investigation reopening began` |

### Reopen Investigation End

The name of the Vault event: Reopen Investigation End.

| Event details ||
|---|---|
| Event name | `reopen_investigation_end` |
| Parameters | |---|---| | `additional_details` | `string` Additional details pertaining to an audit log. | | `matter_id` | `string` The Matter ID an audit pertains to. | | `organizational_unit_name` | `string` The organizational unit name. | | `query` | `string` The user inputted query for search and exports. | | `resource_name` | `string` The resource name of the action, such as hold name or saved query name. | | `resource_url` | `string` The document URL of the document view. | | `target_user` | `string` The targeted user (such as user put on hold). | |
| Sample request | `GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/vault?eventName=reopen_investigation_end&maxResults=10&access_token=YOUR_ACCESS_TOKEN` |
| Admin Console message format | `Investigation reopening ended` |

### Restore Investigation Begin

The name of the Vault event: Restore Investigation Begin.

| Event details ||
|---|---|
| Event name | `restore_investigation_begin` |
| Parameters | |---|---| | `additional_details` | `string` Additional details pertaining to an audit log. | | `matter_id` | `string` The Matter ID an audit pertains to. | | `organizational_unit_name` | `string` The organizational unit name. | | `query` | `string` The user inputted query for search and exports. | | `resource_name` | `string` The resource name of the action, such as hold name or saved query name. | | `resource_url` | `string` The document URL of the document view. | | `target_user` | `string` The targeted user (such as user put on hold). | |
| Sample request | `GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/vault?eventName=restore_investigation_begin&maxResults=10&access_token=YOUR_ACCESS_TOKEN` |
| Admin Console message format | `Investigation restoration began` |

### Restore Investigation End

The name of the Vault event: Restore Investigation End.

| Event details ||
|---|---|
| Event name | `restore_investigation_end` |
| Parameters | |---|---| | `additional_details` | `string` Additional details pertaining to an audit log. | | `matter_id` | `string` The Matter ID an audit pertains to. | | `organizational_unit_name` | `string` The organizational unit name. | | `query` | `string` The user inputted query for search and exports. | | `resource_name` | `string` The resource name of the action, such as hold name or saved query name. | | `resource_url` | `string` The document URL of the document view. | | `target_user` | `string` The targeted user (such as user put on hold). | |
| Sample request | `GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/vault?eventName=restore_investigation_end&maxResults=10&access_token=YOUR_ACCESS_TOKEN` |
| Admin Console message format | `Investigation restoration ended` |

### Search

The name of the Vault event: Search.

| Event details ||
|---|---|
| Event name | `search` |
| Parameters | |---|---| | `additional_details` | `string` Additional details pertaining to an audit log. | | `matter_id` | `string` The Matter ID an audit pertains to. | | `organizational_unit_name` | `string` The organizational unit name. | | `query` | `string` The user inputted query for search and exports. | | `resource_name` | `string` The resource name of the action, such as hold name or saved query name. | | `resource_url` | `string` The document URL of the document view. | | `target_user` | `string` The targeted user (such as user put on hold). | |
| Sample request | `GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/vault?eventName=search&maxResults=10&access_token=YOUR_ACCESS_TOKEN` |
| Admin Console message format | `User performed a search` |

### Search Count

The name of the Vault event: Search Count.

| Event details ||
|---|---|
| Event name | `search_count` |
| Parameters | |---|---| | `additional_details` | `string` Additional details pertaining to an audit log. | | `matter_id` | `string` The Matter ID an audit pertains to. | | `organizational_unit_name` | `string` The organizational unit name. | | `query` | `string` The user inputted query for search and exports. | | `resource_name` | `string` The resource name of the action, such as hold name or saved query name. | | `resource_url` | `string` The document URL of the document view. | | `target_user` | `string` The targeted user (such as user put on hold). | |
| Sample request | `GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/vault?eventName=search_count&maxResults=10&access_token=YOUR_ACCESS_TOKEN` |
| Admin Console message format | `User ran a count search` |

### Update Investigation Details Begin

The name of the Vault event: Update Investigation Details Begin.

| Event details ||
|---|---|
| Event name | `update_investigation_details_begin` |
| Parameters | |---|---| | `additional_details` | `string` Additional details pertaining to an audit log. | | `matter_id` | `string` The Matter ID an audit pertains to. | | `organizational_unit_name` | `string` The organizational unit name. | | `query` | `string` The user inputted query for search and exports. | | `resource_name` | `string` The resource name of the action, such as hold name or saved query name. | | `resource_url` | `string` The document URL of the document view. | | `target_user` | `string` The targeted user (such as user put on hold). | |
| Sample request | `GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/vault?eventName=update_investigation_details_begin&maxResults=10&access_token=YOUR_ACCESS_TOKEN` |
| Admin Console message format | `Investigation details update began` |

### Update Investigation Details End

The name of the Vault event: Update Investigation Details End.

| Event details ||
|---|---|
| Event name | `update_investigation_details_end` |
| Parameters | |---|---| | `additional_details` | `string` Additional details pertaining to an audit log. | | `matter_id` | `string` The Matter ID an audit pertains to. | | `organizational_unit_name` | `string` The organizational unit name. | | `query` | `string` The user inputted query for search and exports. | | `resource_name` | `string` The resource name of the action, such as hold name or saved query name. | | `resource_url` | `string` The document URL of the document view. | | `target_user` | `string` The targeted user (such as user put on hold). | |
| Sample request | `GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/vault?eventName=update_investigation_details_end&maxResults=10&access_token=YOUR_ACCESS_TOKEN` |
| Admin Console message format | `Investigation details update ended` |

### Update Preservation Rule Add Holds Begin

The name of the Vault event: Update Preservation Rule Add Holds Begin.

| Event details ||
|---|---|
| Event name | `update_preservation_rule_add_holds_begin` |
| Parameters | |---|---| | `additional_details` | `string` Additional details pertaining to an audit log. | | `matter_id` | `string` The Matter ID an audit pertains to. | | `organizational_unit_name` | `string` The organizational unit name. | | `query` | `string` The user inputted query for search and exports. | | `resource_name` | `string` The resource name of the action, such as hold name or saved query name. | | `resource_url` | `string` The document URL of the document view. | | `target_user` | `string` The targeted user (such as user put on hold). | |
| Sample request | `GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/vault?eventName=update_preservation_rule_add_holds_begin&maxResults=10&access_token=YOUR_ACCESS_TOKEN` |
| Admin Console message format | `Preservation rule addition update began` |

### Update Preservation Rule Add Holds End

The name of the Vault event: Update Preservation Rule Add Holds End.

| Event details ||
|---|---|
| Event name | `update_preservation_rule_add_holds_end` |
| Parameters | |---|---| | `additional_details` | `string` Additional details pertaining to an audit log. | | `matter_id` | `string` The Matter ID an audit pertains to. | | `organizational_unit_name` | `string` The organizational unit name. | | `query` | `string` The user inputted query for search and exports. | | `resource_name` | `string` The resource name of the action, such as hold name or saved query name. | | `resource_url` | `string` The document URL of the document view. | | `target_user` | `string` The targeted user (such as user put on hold). | |
| Sample request | `GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/vault?eventName=update_preservation_rule_add_holds_end&maxResults=10&access_token=YOUR_ACCESS_TOKEN` |
| Admin Console message format | `Preservation rule addition update ended` |

### Update Preservation Rule Query Begin

The name of the Vault event: Update Preservation Rule Query Begin.

| Event details ||
|---|---|
| Event name | `update_preservation_rule_query_begin` |
| Parameters | |---|---| | `additional_details` | `string` Additional details pertaining to an audit log. | | `matter_id` | `string` The Matter ID an audit pertains to. | | `organizational_unit_name` | `string` The organizational unit name. | | `query` | `string` The user inputted query for search and exports. | | `resource_name` | `string` The resource name of the action, such as hold name or saved query name. | | `resource_url` | `string` The document URL of the document view. | | `target_user` | `string` The targeted user (such as user put on hold). | |
| Sample request | `GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/vault?eventName=update_preservation_rule_query_begin&maxResults=10&access_token=YOUR_ACCESS_TOKEN` |
| Admin Console message format | `Preservation rule query update began` |

### Update Preservation Rule Query End

The name of the Vault event: Update Preservation Rule Query End.

| Event details ||
|---|---|
| Event name | `update_preservation_rule_query_end` |
| Parameters | |---|---| | `additional_details` | `string` Additional details pertaining to an audit log. | | `matter_id` | `string` The Matter ID an audit pertains to. | | `organizational_unit_name` | `string` The organizational unit name. | | `query` | `string` The user inputted query for search and exports. | | `resource_name` | `string` The resource name of the action, such as hold name or saved query name. | | `resource_url` | `string` The document URL of the document view. | | `target_user` | `string` The targeted user (such as user put on hold). | |
| Sample request | `GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/vault?eventName=update_preservation_rule_query_end&maxResults=10&access_token=YOUR_ACCESS_TOKEN` |
| Admin Console message format | `Preservation rule query update ended` |

### Update Preservation Rule Remove Holds Begin

The name of the Vault event: Update Preservation Rule Remove Holds Begin.

| Event details ||
|---|---|
| Event name | `update_preservation_rule_remove_holds_begin` |
| Parameters | |---|---| | `additional_details` | `string` Additional details pertaining to an audit log. | | `matter_id` | `string` The Matter ID an audit pertains to. | | `organizational_unit_name` | `string` The organizational unit name. | | `query` | `string` The user inputted query for search and exports. | | `resource_name` | `string` The resource name of the action, such as hold name or saved query name. | | `resource_url` | `string` The document URL of the document view. | | `target_user` | `string` The targeted user (such as user put on hold). | |
| Sample request | `GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/vault?eventName=update_preservation_rule_remove_holds_begin&maxResults=10&access_token=YOUR_ACCESS_TOKEN` |
| Admin Console message format | `Preservation rule removal update began` |

### Update Preservation Rule Remove Holds End

The name of the Vault event: Update Preservation Rule Remove Holds End.

| Event details ||
|---|---|
| Event name | `update_preservation_rule_remove_holds_end` |
| Parameters | |---|---| | `additional_details` | `string` Additional details pertaining to an audit log. | | `matter_id` | `string` The Matter ID an audit pertains to. | | `organizational_unit_name` | `string` The organizational unit name. | | `query` | `string` The user inputted query for search and exports. | | `resource_name` | `string` The resource name of the action, such as hold name or saved query name. | | `resource_url` | `string` The document URL of the document view. | | `target_user` | `string` The targeted user (such as user put on hold). | |
| Sample request | `GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/vault?eventName=update_preservation_rule_remove_holds_end&maxResults=10&access_token=YOUR_ACCESS_TOKEN` |
| Admin Console message format | `Preservation rule removal update ended` |

### Update Retention Rule Begin

The name of the Vault event: Update Retention Rule Begin.

| Event details ||
|---|---|
| Event name | `update_retention_rule_begin` |
| Parameters | |---|---| | `additional_details` | `string` Additional details pertaining to an audit log. | | `matter_id` | `string` The Matter ID an audit pertains to. | | `organizational_unit_name` | `string` The organizational unit name. | | `query` | `string` The user inputted query for search and exports. | | `resource_name` | `string` The resource name of the action, such as hold name or saved query name. | | `resource_url` | `string` The document URL of the document view. | | `target_user` | `string` The targeted user (such as user put on hold). | |
| Sample request | `GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/vault?eventName=update_retention_rule_begin&maxResults=10&access_token=YOUR_ACCESS_TOKEN` |
| Admin Console message format | `Retention rule update began` |

### Update Retention Rule End

The name of the Vault event: Update Retention Rule End.

| Event details ||
|---|---|
| Event name | `update_retention_rule_end` |
| Parameters | |---|---| | `additional_details` | `string` Additional details pertaining to an audit log. | | `matter_id` | `string` The Matter ID an audit pertains to. | | `organizational_unit_name` | `string` The organizational unit name. | | `query` | `string` The user inputted query for search and exports. | | `resource_name` | `string` The resource name of the action, such as hold name or saved query name. | | `resource_url` | `string` The document URL of the document view. | | `target_user` | `string` The targeted user (such as user put on hold). | |
| Sample request | `GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/vault?eventName=update_retention_rule_end&maxResults=10&access_token=YOUR_ACCESS_TOKEN` |
| Admin Console message format | `Retention rule update ended` |

### Update Retention Settings

The name of the Vault event: Update Retention Settings.

| Event details ||
|---|---|
| Event name | `update_retention_settings` |
| Parameters | |---|---| | `additional_details` | `string` Additional details pertaining to an audit log. | | `matter_id` | `string` The Matter ID an audit pertains to. | | `organizational_unit_name` | `string` The organizational unit name. | | `query` | `string` The user inputted query for search and exports. | | `resource_name` | `string` The resource name of the action, such as hold name or saved query name. | | `resource_url` | `string` The document URL of the document view. | | `target_user` | `string` The targeted user (such as user put on hold). | |
| Sample request | `GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/vault?eventName=update_retention_settings&maxResults=10&access_token=YOUR_ACCESS_TOKEN` |
| Admin Console message format | `User updated retention settings` |

### Update Saved Query Details Begin

The name of the Vault event: Update Saved Query Details Begin.

| Event details ||
|---|---|
| Event name | `update_saved_query_details_begin` |
| Parameters | |---|---| | `additional_details` | `string` Additional details pertaining to an audit log. | | `matter_id` | `string` The Matter ID an audit pertains to. | | `organizational_unit_name` | `string` The organizational unit name. | | `query` | `string` The user inputted query for search and exports. | | `resource_name` | `string` The resource name of the action, such as hold name or saved query name. | | `resource_url` | `string` The document URL of the document view. | | `target_user` | `string` The targeted user (such as user put on hold). | |
| Sample request | `GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/vault?eventName=update_saved_query_details_begin&maxResults=10&access_token=YOUR_ACCESS_TOKEN` |
| Admin Console message format | `Saved query details update began` |

### Update Saved Query Details End

The name of the Vault event: Update Saved Query Details End.

| Event details ||
|---|---|
| Event name | `update_saved_query_details_end` |
| Parameters | |---|---| | `additional_details` | `string` Additional details pertaining to an audit log. | | `matter_id` | `string` The Matter ID an audit pertains to. | | `organizational_unit_name` | `string` The organizational unit name. | | `query` | `string` The user inputted query for search and exports. | | `resource_name` | `string` The resource name of the action, such as hold name or saved query name. | | `resource_url` | `string` The document URL of the document view. | | `target_user` | `string` The targeted user (such as user put on hold). | |
| Sample request | `GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/vault?eventName=update_saved_query_details_end&maxResults=10&access_token=YOUR_ACCESS_TOKEN` |
| Admin Console message format | `Saved query details update ended` |

### View Cross Matter Litigation Hold Report

The name of the Vault event: View Cross Matter Litigation Hold Report.

| Event details ||
|---|---|
| Event name | `view_cross_matter_litigation_hold_report` |
| Parameters | |---|---| | `additional_details` | `string` Additional details pertaining to an audit log. | | `matter_id` | `string` The Matter ID an audit pertains to. | | `organizational_unit_name` | `string` The organizational unit name. | | `query` | `string` The user inputted query for search and exports. | | `resource_name` | `string` The resource name of the action, such as hold name or saved query name. | | `resource_url` | `string` The document URL of the document view. | | `target_user` | `string` The targeted user (such as user put on hold). | |
| Sample request | `GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/vault?eventName=view_cross_matter_litigation_hold_report&maxResults=10&access_token=YOUR_ACCESS_TOKEN` |
| Admin Console message format | `User viewed a cross matter litigation hold report` |

### View Custodian Litigation Hold Report

The name of the Vault event: View Custodian Litigation Hold Report.

| Event details ||
|---|---|
| Event name | `view_custodian_litigation_hold_report` |
| Parameters | |---|---| | `additional_details` | `string` Additional details pertaining to an audit log. | | `matter_id` | `string` The Matter ID an audit pertains to. | | `organizational_unit_name` | `string` The organizational unit name. | | `query` | `string` The user inputted query for search and exports. | | `resource_name` | `string` The resource name of the action, such as hold name or saved query name. | | `resource_url` | `string` The document URL of the document view. | | `target_user` | `string` The targeted user (such as user put on hold). | |
| Sample request | `GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/vault?eventName=view_custodian_litigation_hold_report&maxResults=10&access_token=YOUR_ACCESS_TOKEN` |
| Admin Console message format | `User viewed a custodian litigation hold report` |

### View Document

The name of the Vault event: View Document.

| Event details ||
|---|---|
| Event name | `view_document` |
| Parameters | |---|---| | `additional_details` | `string` Additional details pertaining to an audit log. | | `matter_id` | `string` The Matter ID an audit pertains to. | | `organizational_unit_name` | `string` The organizational unit name. | | `query` | `string` The user inputted query for search and exports. | | `resource_name` | `string` The resource name of the action, such as hold name or saved query name. | | `resource_url` | `string` The document URL of the document view. | | `target_user` | `string` The targeted user (such as user put on hold). | |
| Sample request | `GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/vault?eventName=view_document&maxResults=10&access_token=YOUR_ACCESS_TOKEN` |
| Admin Console message format | `User viewed a document` |

### View Document Information

The name of the Vault event: View Document Information.

| Event details ||
|---|---|
| Event name | `view_document_information` |
| Parameters | |---|---| | `additional_details` | `string` Additional details pertaining to an audit log. | | `matter_id` | `string` The Matter ID an audit pertains to. | | `organizational_unit_name` | `string` The organizational unit name. | | `query` | `string` The user inputted query for search and exports. | | `resource_name` | `string` The resource name of the action, such as hold name or saved query name. | | `resource_url` | `string` The document URL of the document view. | | `target_user` | `string` The targeted user (such as user put on hold). | |
| Sample request | `GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/vault?eventName=view_document_information&maxResults=10&access_token=YOUR_ACCESS_TOKEN` |
| Admin Console message format | `User viewed a document's information` |

### View External Document

The name of the Vault event: View External Document.

| Event details ||
|---|---|
| Event name | `view_external_document` |
| Parameters | |---|---| | `additional_details` | `string` Additional details pertaining to an audit log. | | `matter_id` | `string` The Matter ID an audit pertains to. | | `organizational_unit_name` | `string` The organizational unit name. | | `query` | `string` The user inputted query for search and exports. | | `resource_name` | `string` The resource name of the action, such as hold name or saved query name. | | `resource_url` | `string` The document URL of the document view. | | `target_user` | `string` The targeted user (such as user put on hold). | |
| Sample request | `GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/vault?eventName=view_external_document&maxResults=10&access_token=YOUR_ACCESS_TOKEN` |
| Admin Console message format | `User viewed an external document` |

### View Investigation

The name of the Vault event: View Investigation.

| Event details ||
|---|---|
| Event name | `view_investigation` |
| Parameters | |---|---| | `additional_details` | `string` Additional details pertaining to an audit log. | | `matter_id` | `string` The Matter ID an audit pertains to. | | `organizational_unit_name` | `string` The organizational unit name. | | `query` | `string` The user inputted query for search and exports. | | `resource_name` | `string` The resource name of the action, such as hold name or saved query name. | | `resource_url` | `string` The document URL of the document view. | | `target_user` | `string` The targeted user (such as user put on hold). | |
| Sample request | `GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/vault?eventName=view_investigation&maxResults=10&access_token=YOUR_ACCESS_TOKEN` |
| Admin Console message format | `User viewed a matter` |

### View Matter Audit Log

The name of the Vault event: View Matter Audit Log.

| Event details ||
|---|---|
| Event name | `view_matter_audit_log` |
| Parameters | |---|---| | `additional_details` | `string` Additional details pertaining to an audit log. | | `matter_id` | `string` The Matter ID an audit pertains to. | | `organizational_unit_name` | `string` The organizational unit name. | | `query` | `string` The user inputted query for search and exports. | | `resource_name` | `string` The resource name of the action, such as hold name or saved query name. | | `resource_url` | `string` The document URL of the document view. | | `target_user` | `string` The targeted user (such as user put on hold). | |
| Sample request | `GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/vault?eventName=view_matter_audit_log&maxResults=10&access_token=YOUR_ACCESS_TOKEN` |
| Admin Console message format | `User viewed a matter's log events` |

### View Per Matter Litigation Hold Report

The name of the Vault event: View Per Matter Litigation Hold Report.

| Event details ||
|---|---|
| Event name | `view_per_matter_litigation_hold_report` |
| Parameters | |---|---| | `additional_details` | `string` Additional details pertaining to an audit log. | | `matter_id` | `string` The Matter ID an audit pertains to. | | `organizational_unit_name` | `string` The organizational unit name. | | `query` | `string` The user inputted query for search and exports. | | `resource_name` | `string` The resource name of the action, such as hold name or saved query name. | | `resource_url` | `string` The document URL of the document view. | | `target_user` | `string` The targeted user (such as user put on hold). | |
| Sample request | `GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/vault?eventName=view_per_matter_litigation_hold_report&maxResults=10&access_token=YOUR_ACCESS_TOKEN` |
| Admin Console message format | `User viewed a matter litigation hold report` |

### View Retention Policy

The name of the Vault event: View Retention Policy.

| Event details ||
|---|---|
| Event name | `view_retention_policy` |
| Parameters | |---|---| | `additional_details` | `string` Additional details pertaining to an audit log. | | `matter_id` | `string` The Matter ID an audit pertains to. | | `organizational_unit_name` | `string` The organizational unit name. | | `query` | `string` The user inputted query for search and exports. | | `resource_name` | `string` The resource name of the action, such as hold name or saved query name. | | `resource_url` | `string` The document URL of the document view. | | `target_user` | `string` The targeted user (such as user put on hold). | |
| Sample request | `GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/vault?eventName=view_retention_policy&maxResults=10&access_token=YOUR_ACCESS_TOKEN` |
| Admin Console message format | `User viewed retention policy` |

### View Retention Settings

The name of the Vault event: View Retention Settings.

| Event details ||
|---|---|
| Event name | `view_retention_settings` |
| Parameters | |---|---| | `additional_details` | `string` Additional details pertaining to an audit log. | | `matter_id` | `string` The Matter ID an audit pertains to. | | `organizational_unit_name` | `string` The organizational unit name. | | `query` | `string` The user inputted query for search and exports. | | `resource_name` | `string` The resource name of the action, such as hold name or saved query name. | | `resource_url` | `string` The document URL of the document view. | | `target_user` | `string` The targeted user (such as user put on hold). | |
| Sample request | `GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/vault?eventName=view_retention_settings&maxResults=10&access_token=YOUR_ACCESS_TOKEN` |
| Admin Console message format | `User viewed retention settings` |

### View System Audit Log

The name of the Vault event: View System Audit Log.

| Event details ||
|---|---|
| Event name | `view_system_audit_log` |
| Parameters | |---|---| | `additional_details` | `string` Additional details pertaining to an audit log. | | `matter_id` | `string` The Matter ID an audit pertains to. | | `organizational_unit_name` | `string` The organizational unit name. | | `query` | `string` The user inputted query for search and exports. | | `resource_name` | `string` The resource name of the action, such as hold name or saved query name. | | `resource_url` | `string` The document URL of the document view. | | `target_user` | `string` The targeted user (such as user put on hold). | |
| Sample request | `GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/vault?eventName=view_system_audit_log&maxResults=10&access_token=YOUR_ACCESS_TOKEN` |
| Admin Console message format | `User viewed the system's log events` |