This document lists the events and parameters for
User Settings
Admin Audit activity events. You can retrieve these events by
calling Activities.list()
with applicationName=admin.
User Settings
Events of this type are returned with type=USER_SETTINGS.
2-step Verification Scratch Codes Deletion
| Event details |
| Event name |
DELETE_2SV_SCRATCH_CODES |
| Parameters |
USER_EMAIL |
string
The user's primary email address.
|
|
| Sample request |
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/admin?eventName=DELETE_2SV_SCRATCH_CODES&maxResults=10&access_token=YOUR_ACCESS_TOKEN
|
| Admin Console message format |
2-step verification scratch codes of the user {USER_EMAIL} deleted
|
2-step Verification Scratch Codes Generate
| Event details |
| Event name |
GENERATE_2SV_SCRATCH_CODES |
| Parameters |
USER_EMAIL |
string
The user's primary email address.
|
|
| Sample request |
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/admin?eventName=GENERATE_2SV_SCRATCH_CODES&maxResults=10&access_token=YOUR_ACCESS_TOKEN
|
| Admin Console message format |
New 2-step verification scratch codes generated for the user {USER_EMAIL}
|
3-legged OAuth Device Tokens Revoke
| Event details |
| Event name |
REVOKE_3LO_DEVICE_TOKENS |
| Parameters |
DEVICE_ID |
string
The device's ID.
|
DEVICE_TYPE |
string
The device's type.
|
USER_EMAIL |
string
The user's primary email address.
|
|
| Sample request |
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/admin?eventName=REVOKE_3LO_DEVICE_TOKENS&maxResults=10&access_token=YOUR_ACCESS_TOKEN
|
| Admin Console message format |
3-legged OAuth tokens issued by user {USER_EMAIL} for the device type {DEVICE_TYPE} and id {DEVICE_ID} were revoked
|
3-legged OAuth Token Revoke
| Event details |
| Event name |
REVOKE_3LO_TOKEN |
| Parameters |
APP_ID |
string
The application ID whose access is managed by the token.
|
USER_EMAIL |
string
The user's primary email address.
|
|
| Sample request |
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/admin?eventName=REVOKE_3LO_TOKEN&maxResults=10&access_token=YOUR_ACCESS_TOKEN
|
| Admin Console message format |
3-legged OAuth tokens issued by user {USER_EMAIL} for application {APP_ID} were revoked
|
Accept User Invite
| Event details |
| Event name |
ACCEPT_USER_INVITATION |
| Parameters |
USER_EMAIL |
string
The user's primary email address.
|
|
| Sample request |
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/admin?eventName=ACCEPT_USER_INVITATION&maxResults=10&access_token=YOUR_ACCESS_TOKEN
|
| Admin Console message format |
User invitation accepted for user: {USER_EMAIL}
|
Add Recovery Email
| Event details |
| Event name |
ADD_RECOVERY_EMAIL |
| Parameters |
USER_EMAIL |
string
The user's primary email address.
|
|
| Sample request |
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/admin?eventName=ADD_RECOVERY_EMAIL&maxResults=10&access_token=YOUR_ACCESS_TOKEN
|
| Admin Console message format |
Recovery email added for {USER_EMAIL}
|
Add Recovery Phone
| Event details |
| Event name |
ADD_RECOVERY_PHONE |
| Parameters |
USER_EMAIL |
string
The user's primary email address.
|
|
| Sample request |
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/admin?eventName=ADD_RECOVERY_PHONE&maxResults=10&access_token=YOUR_ACCESS_TOKEN
|
| Admin Console message format |
Recovery phone added for {USER_EMAIL}
|
Admin Privileges Grant
| Event details |
| Event name |
GRANT_ADMIN_PRIVILEGE |
| Parameters |
USER_EMAIL |
string
The user's primary email address.
|
|
| Sample request |
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/admin?eventName=GRANT_ADMIN_PRIVILEGE&maxResults=10&access_token=YOUR_ACCESS_TOKEN
|
| Admin Console message format |
Admin privileges granted to {USER_EMAIL}
|
Admin Privileges Revoke
| Event details |
| Event name |
REVOKE_ADMIN_PRIVILEGE |
| Parameters |
USER_EMAIL |
string
The user's primary email address.
|
|
| Sample request |
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/admin?eventName=REVOKE_ADMIN_PRIVILEGE&maxResults=10&access_token=YOUR_ACCESS_TOKEN
|
| Admin Console message format |
Admin privileges revoked from {USER_EMAIL}
|
Application Specific Password Revoke
| Event details |
| Event name |
REVOKE_ASP |
| Parameters |
ASP_ID |
string
The application specific password ID.
|
USER_EMAIL |
string
The user's primary email address.
|
|
| Sample request |
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/admin?eventName=REVOKE_ASP&maxResults=10&access_token=YOUR_ACCESS_TOKEN
|
| Admin Console message format |
Application specific password with Id {ASP_ID} issued by user {USER_EMAIL} revoked
|
| Event details |
| Event name |
TOGGLE_AUTOMATIC_CONTACT_SHARING |
| Parameters |
NEW_VALUE |
string
The setting value, either true or false.
|
USER_EMAIL |
string
The user's primary email address.
|
|
| Sample request |
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/admin?eventName=TOGGLE_AUTOMATIC_CONTACT_SHARING&maxResults=10&access_token=YOUR_ACCESS_TOKEN
|
| Admin Console message format |
Automatic contact sharing for {USER_EMAIL} changed to {NEW_VALUE}
|
Bulk Upload
| Event details |
| Event name |
BULK_UPLOAD |
| Parameters |
BULK_UPLOAD_FAIL_USERS_NUMBER |
string
The number of users who did not successfully upload to the domain.
|
BULK_UPLOAD_TOTAL_USERS_NUMBER |
string
The number of total users being uploaded.
|
DOMAIN_NAME |
string
The primary domain name where users are being moved.
|
|
| Sample request |
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/admin?eventName=BULK_UPLOAD&maxResults=10&access_token=YOUR_ACCESS_TOKEN
|
| Admin Console message format |
{BULK_UPLOAD_TOTAL_USERS_NUMBER} users selected for upload to your organization. {BULK_UPLOAD_FAIL_USERS_NUMBER} out of {BULK_UPLOAD_TOTAL_USERS_NUMBER} users were not uploaded.
|
Bulk Upload Notification
| Event details |
| Event name |
BULK_UPLOAD_NOTIFICATION_SENT |
| Parameters |
DOMAIN_NAME |
string
The primary domain name where users were uploaded.
|
USER_EMAIL |
string
The primary email address of user who was sent notification of bulk upload event.
|
|
| Sample request |
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/admin?eventName=BULK_UPLOAD_NOTIFICATION_SENT&maxResults=10&access_token=YOUR_ACCESS_TOKEN
|
| Admin Console message format |
Notification of bulk users upload sent to {USER_EMAIL}
|
Cancel User Invite
| Event details |
| Event name |
CANCEL_USER_INVITE |
| Parameters |
DOMAIN_NAME |
string
The primary domain name.
|
USER_EMAIL |
string
The primary email address of the user whose invitation is being cancelled.
|
|
| Sample request |
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/admin?eventName=CANCEL_USER_INVITE&maxResults=10&access_token=YOUR_ACCESS_TOKEN
|
| Admin Console message format |
Invite to {USER_EMAIL} cancelled
|
Change Custom Attribute
| Event details |
| Event name |
CHANGE_USER_CUSTOM_FIELD |
| Parameters |
NEW_VALUE |
string
The new SETTING_NAME value that was set during this event.
|
OLD_VALUE |
string
The previous SETTING_NAME value that was replaced during this event.
|
USER_CUSTOM_FIELD |
string
The name of the user's custom field.
|
USER_EMAIL |
string
The user's primary email address.
|
|
| Sample request |
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/admin?eventName=CHANGE_USER_CUSTOM_FIELD&maxResults=10&access_token=YOUR_ACCESS_TOKEN
|
| Admin Console message format |
{USER_CUSTOM_FIELD} changed for {USER_EMAIL} from {OLD_VALUE} to {NEW_VALUE}
|
Change External Id
| Event details |
| Event name |
CHANGE_USER_EXTERNAL_ID |
| Parameters |
NEW_VALUE |
string
The new SETTING_NAME value that was set during this event.
|
OLD_VALUE |
string
The previous SETTING_NAME value that was replaced during this event.
|
USER_EMAIL |
string
The user's primary email address.
|
|
| Sample request |
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/admin?eventName=CHANGE_USER_EXTERNAL_ID&maxResults=10&access_token=YOUR_ACCESS_TOKEN
|
| Admin Console message format |
External Ids changed for {USER_EMAIL} from {OLD_VALUE} to {NEW_VALUE}
|
Change Gender
Change here is a verb. The genders will be customizable, so this should be broader than male vs female.
| Event details |
| Event name |
CHANGE_USER_GENDER |
| Parameters |
NEW_VALUE |
string
The new SETTING_NAME value that was set during this event.
|
OLD_VALUE |
string
The previous SETTING_NAME value that was replaced during this event.
|
USER_EMAIL |
string
The user's primary email address.
|
|
| Sample request |
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/admin?eventName=CHANGE_USER_GENDER&maxResults=10&access_token=YOUR_ACCESS_TOKEN
|
| Admin Console message format |
Gender changed for {USER_EMAIL} from {OLD_VALUE} to {NEW_VALUE}
|
Change IM
| Event details |
| Event name |
CHANGE_USER_IM |
| Parameters |
NEW_VALUE |
string
The new SETTING_NAME value that was set during this event.
|
OLD_VALUE |
string
The previous SETTING_NAME value that was replaced during this event.
|
USER_EMAIL |
string
The user's primary email address.
|
|
| Sample request |
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/admin?eventName=CHANGE_USER_IM&maxResults=10&access_token=YOUR_ACCESS_TOKEN
|
| Admin Console message format |
IMs changed for {USER_EMAIL} from {OLD_VALUE} to {NEW_VALUE}
|
Change IP Whitelist
| Event details |
| Event name |
ENABLE_USER_IP_WHITELIST |
| Parameters |
NEW_VALUE |
string
The new SETTING_NAME value that was set during this event.
|
OLD_VALUE |
string
The previous SETTING_NAME value that was replaced during this event.
|
USER_EMAIL |
string
The user's primary email address.
|
|
| Sample request |
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/admin?eventName=ENABLE_USER_IP_WHITELIST&maxResults=10&access_token=YOUR_ACCESS_TOKEN
|
| Admin Console message format |
IP whitelist changed for {USER_EMAIL} from {OLD_VALUE} to {NEW_VALUE}
|
Change Keyword
Keywords are used on user profiles to help identify a user in searches. Example: find person with name 'Larry' and school 'Stanford'. 'Change' is a verb.
| Event details |
| Event name |
CHANGE_USER_KEYWORD |
| Parameters |
NEW_VALUE |
string
The new SETTING_NAME value that was set during this event.
|
OLD_VALUE |
string
The previous SETTING_NAME value that was replaced during this event.
|
USER_EMAIL |
string
The user's primary email address.
|
|
| Sample request |
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/admin?eventName=CHANGE_USER_KEYWORD&maxResults=10&access_token=YOUR_ACCESS_TOKEN
|
| Admin Console message format |
Keywords changed for {USER_EMAIL} from {OLD_VALUE} to {NEW_VALUE}
|
Change Language
Can be a predefined set of more common languages provided by Google or a custom language. 'Change' here is a verb.
| Event details |
| Event name |
CHANGE_USER_LANGUAGE |
| Parameters |
NEW_VALUE |
string
The new SETTING_NAME value that was set during this event.
|
OLD_VALUE |
string
The previous SETTING_NAME value that was replaced during this event.
|
USER_EMAIL |
string
The user's primary email address.
|
|
| Sample request |
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/admin?eventName=CHANGE_USER_LANGUAGE&maxResults=10&access_token=YOUR_ACCESS_TOKEN
|
| Admin Console message format |
Languages changed for {USER_EMAIL} from {OLD_VALUE} to {NEW_VALUE}
|
Change Location
Location is different from address in the following ways: (1) Location can be fuzzy. Example: Near Seattle. (2) Hovercards and other short user summaries display location, not address. 'Change' is a verb.
| Event details |
| Event name |
CHANGE_USER_LOCATION |
| Parameters |
NEW_VALUE |
string
The new SETTING_NAME value that was set during this event.
|
OLD_VALUE |
string
The previous SETTING_NAME value that was replaced during this event.
|
USER_EMAIL |
string
The user's primary email address.
|
|
| Sample request |
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/admin?eventName=CHANGE_USER_LOCATION&maxResults=10&access_token=YOUR_ACCESS_TOKEN
|
| Admin Console message format |
Locations changed for {USER_EMAIL} from {OLD_VALUE} to {NEW_VALUE}
|
Change Organization
| Event details |
| Event name |
CHANGE_USER_ORGANIZATION |
| Parameters |
NEW_VALUE |
string
The new SETTING_NAME value that was set during this event.
|
OLD_VALUE |
string
The previous SETTING_NAME value that was replaced during this event.
|
USER_EMAIL |
string
The user's primary email address.
|
|
| Sample request |
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/admin?eventName=CHANGE_USER_ORGANIZATION&maxResults=10&access_token=YOUR_ACCESS_TOKEN
|
| Admin Console message format |
Organizations changed for {USER_EMAIL} from {OLD_VALUE} to {NEW_VALUE}
|
Change Phone Numbers
| Event details |
| Event name |
CHANGE_USER_PHONE_NUMBER |
| Parameters |
NEW_VALUE |
string
The new SETTING_NAME value that was set during this event.
|
OLD_VALUE |
string
The previous SETTING_NAME value that was replaced during this event.
|
USER_EMAIL |
string
The user's primary email address.
|
|
| Sample request |
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/admin?eventName=CHANGE_USER_PHONE_NUMBER&maxResults=10&access_token=YOUR_ACCESS_TOKEN
|
| Admin Console message format |
Phone Numbers changed for {USER_EMAIL} from {OLD_VALUE} to {NEW_VALUE}
|
Change Recovery Email
| Event details |
| Event name |
CHANGE_RECOVERY_EMAIL |
| Parameters |
USER_EMAIL |
string
The user's primary email address.
|
|
| Sample request |
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/admin?eventName=CHANGE_RECOVERY_EMAIL&maxResults=10&access_token=YOUR_ACCESS_TOKEN
|
| Admin Console message format |
Recovery email changed for {USER_EMAIL}
|
Change Recovery Phone
| Event details |
| Event name |
CHANGE_RECOVERY_PHONE |
| Parameters |
USER_EMAIL |
string
The user's primary email address.
|
|
| Sample request |
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/admin?eventName=CHANGE_RECOVERY_PHONE&maxResults=10&access_token=YOUR_ACCESS_TOKEN
|
| Admin Console message format |
Recovery phone changed for {USER_EMAIL}
|
Change Relation
| Event details |
| Event name |
CHANGE_USER_RELATION |
| Parameters |
NEW_VALUE |
string
The new SETTING_NAME value that was set during this event.
|
OLD_VALUE |
string
The previous SETTING_NAME value that was replaced during this event.
|
USER_EMAIL |
string
The user's primary email address.
|
|
| Sample request |
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/admin?eventName=CHANGE_USER_RELATION&maxResults=10&access_token=YOUR_ACCESS_TOKEN
|
| Admin Console message format |
Relations changed for {USER_EMAIL} from {OLD_VALUE} to {NEW_VALUE}
|
Change User Address
| Event details |
| Event name |
CHANGE_USER_ADDRESS |
| Parameters |
NEW_VALUE |
string
The new SETTING_NAME value that was set during this event.
|
OLD_VALUE |
string
The previous SETTING_NAME value that was replaced during this event.
|
USER_EMAIL |
string
The user's primary email address.
|
|
| Sample request |
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/admin?eventName=CHANGE_USER_ADDRESS&maxResults=10&access_token=YOUR_ACCESS_TOKEN
|
| Admin Console message format |
Addresses changed for {USER_EMAIL} from {OLD_VALUE} to {NEW_VALUE}
|
Create an email monitor
| Event details |
| Event name |
CREATE_EMAIL_MONITOR |
| Parameters |
BEGIN_DATE_TIME |
string
The start date and time for the email monitor.
|
EMAIL_MONITOR_DEST_EMAIL |
string
The destination address of the email monitor.
|
EMAIL_MONITOR_LEVEL_CHAT |
string
The chat email monitor level.
|
EMAIL_MONITOR_LEVEL_DRAFT_EMAIL |
string
The draft email monitor level.
|
EMAIL_MONITOR_LEVEL_INCOMING_EMAIL |
string
The incoming email monitor level.
|
EMAIL_MONITOR_LEVEL_OUTGOING_EMAIL |
string
The outgoing email monitor level.
|
END_DATE_TIME |
string
The end date and time for the email monitor.
|
USER_EMAIL |
string
The user's primary email address.
|
|
| Sample request |
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/admin?eventName=CREATE_EMAIL_MONITOR&maxResults=10&access_token=YOUR_ACCESS_TOKEN
|
| Admin Console message format |
Created an email monitor for {USER_EMAIL} to {EMAIL_MONITOR_DEST_EMAIL} that will expire on {END_DATE_TIME}
|
Data transfer request created
| Event details |
| Event name |
CREATE_DATA_TRANSFER_REQUEST |
| Parameters |
APPLICATION_NAME |
string
A comma-separated application names for which data transfer is requested.
|
DESTINATION_USER_EMAIL |
string
The new owner's primary user email to whom to transfer user data to.
|
USER_EMAIL |
string
The user's primary email address.
|
|
| Sample request |
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/admin?eventName=CREATE_DATA_TRANSFER_REQUEST&maxResults=10&access_token=YOUR_ACCESS_TOKEN
|
| Admin Console message format |
Data transfer request created from {USER_EMAIL} to {DESTINATION_USER_EMAIL} for apps {APPLICATION_NAME}
|
Delegated Admin Privileges Grant
| Event details |
| Event name |
GRANT_DELEGATED_ADMIN_PRIVILEGES |
| Parameters |
NEW_VALUE |
string
The new delegated admin privilege.
|
USER_EMAIL |
string
The user's primary email address.
|
|
| Sample request |
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/admin?eventName=GRANT_DELEGATED_ADMIN_PRIVILEGES&maxResults=10&access_token=YOUR_ACCESS_TOKEN
|
| Admin Console message format |
{USER_EMAIL} assigned {NEW_VALUE} admin privileges
|
Delete account information dump
| Event details |
| Event name |
DELETE_ACCOUNT_INFO_DUMP |
| Parameters |
REQUEST_ID |
string
The request ID.
|
USER_EMAIL |
string
The user's primary email address.
|
|
| Sample request |
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/admin?eventName=DELETE_ACCOUNT_INFO_DUMP&maxResults=10&access_token=YOUR_ACCESS_TOKEN
|
| Admin Console message format |
Deleted account and login information dump for {USER_EMAIL} and request ID {REQUEST_ID}
|
Delete an email monitor
| Event details |
| Event name |
DELETE_EMAIL_MONITOR |
| Parameters |
EMAIL_MONITOR_DEST_EMAIL |
string
The destination address of the email monitor.
|
USER_EMAIL |
string
The user's primary email address.
|
|
| Sample request |
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/admin?eventName=DELETE_EMAIL_MONITOR&maxResults=10&access_token=YOUR_ACCESS_TOKEN
|
| Admin Console message format |
Deleted an email monitor for {USER_EMAIL} to {EMAIL_MONITOR_DEST_EMAIL}
|
Delete mailbox dump
| Event details |
| Event name |
DELETE_MAILBOX_DUMP |
| Parameters |
REQUEST_ID |
string
The request ID.
|
USER_EMAIL |
string
The user's primary email address.
|
|
| Sample request |
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/admin?eventName=DELETE_MAILBOX_DUMP&maxResults=10&access_token=YOUR_ACCESS_TOKEN
|
| Admin Console message format |
Deleted mailbox dump for {USER_EMAIL} and request ID {REQUEST_ID}
|
Delete Profile Photo
| Event details |
| Event name |
DELETE_PROFILE_PHOTO |
| Parameters |
USER_EMAIL |
string
The user's primary email address.
|
|
| Sample request |
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/admin?eventName=DELETE_PROFILE_PHOTO&maxResults=10&access_token=YOUR_ACCESS_TOKEN
|
| Admin Console message format |
Profile photo of {USER_EMAIL} has been deleted
|
Display Name Added
| Event details |
| Event name |
ADD_DISPLAY_NAME |
| Parameters |
USER_DISPLAY_NAME |
string
User display name.
|
USER_EMAIL |
string
The user's primary email address.
|
|
| Sample request |
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/admin?eventName=ADD_DISPLAY_NAME&maxResults=10&access_token=YOUR_ACCESS_TOKEN
|
| Admin Console message format |
{USER_DISPLAY_NAME} added as a display name of {USER_EMAIL}
|
Display Name Change
| Event details |
| Event name |
CHANGE_DISPLAY_NAME |
| Parameters |
NEW_VALUE |
string
The new SETTING_NAME value that was set during this event.
|
OLD_VALUE |
string
The previous SETTING_NAME value that was replaced during this event.
|
USER_EMAIL |
string
The user's primary email address.
|
|
| Sample request |
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/admin?eventName=CHANGE_DISPLAY_NAME&maxResults=10&access_token=YOUR_ACCESS_TOKEN
|
| Admin Console message format |
Display name of {USER_EMAIL} changed from {OLD_VALUE} to {NEW_VALUE}
|
Display Name Removed
| Event details |
| Event name |
REMOVE_DISPLAY_NAME |
| Parameters |
USER_DISPLAY_NAME |
string
User display name.
|
USER_EMAIL |
string
The user's primary email address.
|
|
| Sample request |
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/admin?eventName=REMOVE_DISPLAY_NAME&maxResults=10&access_token=YOUR_ACCESS_TOKEN
|
| Admin Console message format |
{USER_DISPLAY_NAME} removed as a display name of {USER_EMAIL}
|
First Name Change
| Event details |
| Event name |
CHANGE_FIRST_NAME |
| Parameters |
NEW_VALUE |
string
The user's new first name.
|
OLD_VALUE |
string
The user's previous first name.
|
USER_EMAIL |
string
The user's primary email address.
|
|
| Sample request |
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/admin?eventName=CHANGE_FIRST_NAME&maxResults=10&access_token=YOUR_ACCESS_TOKEN
|
| Admin Console message format |
First name of {USER_EMAIL} changed from {OLD_VALUE} to {NEW_VALUE}
|
Gmail Account Reset
| Event details |
| Event name |
GMAIL_RESET_USER |
| Parameters |
GMAIL_RESET_REASON |
string
Gmail's reason for resetting the account.
|
USER_EMAIL |
string
The user's primary email address.
|
|
| Sample request |
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/admin?eventName=GMAIL_RESET_USER&maxResults=10&access_token=YOUR_ACCESS_TOKEN
|
| Admin Console message format |
Gmail account of {USER_EMAIL} reset
|
Last Name Change
| Event details |
| Event name |
CHANGE_LAST_NAME |
| Parameters |
NEW_VALUE |
string
The user's new last name.
|
OLD_VALUE |
string
The user's previous last name.
|
USER_EMAIL |
string
The user's primary email address.
|
|
| Sample request |
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/admin?eventName=CHANGE_LAST_NAME&maxResults=10&access_token=YOUR_ACCESS_TOKEN
|
| Admin Console message format |
Last name of {USER_EMAIL} changed from {OLD_VALUE} to {NEW_VALUE}
|
Mail Routing Destination Creation
| Event details |
| Event name |
MAIL_ROUTING_DESTINATION_ADDED |
| Parameters |
NEW_VALUE |
string
The new routing destination.
|
USER_EMAIL |
string
The user's primary email address.
|
|
| Sample request |
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/admin?eventName=MAIL_ROUTING_DESTINATION_ADDED&maxResults=10&access_token=YOUR_ACCESS_TOKEN
|
| Admin Console message format |
User {USER_EMAIL} has received the following individual mail routing destination: {NEW_VALUE}
|
Mail Routing Destination Deletion
| Event details |
| Event name |
MAIL_ROUTING_DESTINATION_REMOVED |
| Parameters |
OLD_VALUE |
string
The previous routing destination.
|
USER_EMAIL |
string
The user's primary email address.
|
|
| Sample request |
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/admin?eventName=MAIL_ROUTING_DESTINATION_REMOVED&maxResults=10&access_token=YOUR_ACCESS_TOKEN
|
| Admin Console message format |
User {USER_EMAIL} has had the following individual mail routing destination removed: {OLD_VALUE}
|
Nickname Creation
| Event details |
| Event name |
ADD_NICKNAME |
| Parameters |
USER_EMAIL |
string
The primary user email.
|
USER_NICKNAME |
string
The user's nickname. For Admin console information, see the administration help center.
|
|
| Sample request |
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/admin?eventName=ADD_NICKNAME&maxResults=10&access_token=YOUR_ACCESS_TOKEN
|
| Admin Console message format |
{USER_NICKNAME} created as a nickname of {USER_EMAIL}
|
Nickname Deletion
| Event details |
| Event name |
REMOVE_NICKNAME |
| Parameters |
USER_EMAIL |
string
The user's primary email address.
|
USER_NICKNAME |
string
The user's previous nickname.
|
|
| Sample request |
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/admin?eventName=REMOVE_NICKNAME&maxResults=10&access_token=YOUR_ACCESS_TOKEN
|
| Admin Console message format |
{USER_NICKNAME} deleted as a nickname of {USER_EMAIL}
|
Password Change
| Event details |
| Event name |
CHANGE_PASSWORD |
| Parameters |
USER_EMAIL |
string
The user's primary email address.
|
|
| Sample request |
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/admin?eventName=CHANGE_PASSWORD&maxResults=10&access_token=YOUR_ACCESS_TOKEN
|
| Admin Console message format |
Password changed for {USER_EMAIL}
|
Password Change on Next Login
| Event details |
| Event name |
CHANGE_PASSWORD_ON_NEXT_LOGIN |
| Parameters |
NEW_VALUE |
string
Indicates whether the user must change their password on their next login; can be true or false.
|
OLD_VALUE |
string
The previous setting value; can be true or false.
|
USER_EMAIL |
string
The user's primary email address.
|
|
| Sample request |
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/admin?eventName=CHANGE_PASSWORD_ON_NEXT_LOGIN&maxResults=10&access_token=YOUR_ACCESS_TOKEN
|
| Admin Console message format |
Password change requirement for {USER_EMAIL} on next login changed from {OLD_VALUE} to {NEW_VALUE}
|
Pending Invites List Download
| Event details |
| Event name |
DOWNLOAD_PENDING_INVITES_LIST |
| Sample request |
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/admin?eventName=DOWNLOAD_PENDING_INVITES_LIST&maxResults=10&access_token=YOUR_ACCESS_TOKEN
|
| Admin Console message format |
Pending Invites List was downloaded as a CSV file
|
Remove Recovery Email
| Event details |
| Event name |
REMOVE_RECOVERY_EMAIL |
| Parameters |
USER_EMAIL |
string
The user's primary email address.
|
|
| Sample request |
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/admin?eventName=REMOVE_RECOVERY_EMAIL&maxResults=10&access_token=YOUR_ACCESS_TOKEN
|
| Admin Console message format |
Recovery email removed for {USER_EMAIL}
|
Remove Recovery Phone
| Event details |
| Event name |
REMOVE_RECOVERY_PHONE |
| Parameters |
USER_EMAIL |
string
The user's primary email address.
|
|
| Sample request |
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/admin?eventName=REMOVE_RECOVERY_PHONE&maxResults=10&access_token=YOUR_ACCESS_TOKEN
|
| Admin Console message format |
Recovery phone removed for {USER_EMAIL}
|
Request account information
| Event details |
| Event name |
REQUEST_ACCOUNT_INFO |
| Parameters |
USER_EMAIL |
string
The user's primary email address.
|
|
| Sample request |
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/admin?eventName=REQUEST_ACCOUNT_INFO&maxResults=10&access_token=YOUR_ACCESS_TOKEN
|
| Admin Console message format |
Requested account and login information for {USER_EMAIL}
|
Request mailbox dump
| Event details |
| Event name |
REQUEST_MAILBOX_DUMP |
| Parameters |
BEGIN_DATE_TIME |
string
The start date and time for the email monitor.
|
EMAIL_EXPORT_INCLUDE_DELETED |
string
Indicates if deleted emails are included in the export.
|
EMAIL_EXPORT_PACKAGE_CONTENT |
string
The contents of the mailbox package.
|
END_DATE_TIME |
string
The end date and time for the email monitor.
|
SEARCH_QUERY_FOR_DUMP |
string
The search query used for the dump.
|
USER_EMAIL |
string
The user's primary email address.
|
|
| Sample request |
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/admin?eventName=REQUEST_MAILBOX_DUMP&maxResults=10&access_token=YOUR_ACCESS_TOKEN
|
| Admin Console message format |
Requested mailbox dump for {USER_EMAIL}
|
Resend User Invite
| Event details |
| Event name |
RESEND_USER_INVITE |
| Parameters |
DOMAIN_NAME |
string
The primary domain name.
|
USER_EMAIL |
string
The user's primary email address.
|
|
| Sample request |
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/admin?eventName=RESEND_USER_INVITE&maxResults=10&access_token=YOUR_ACCESS_TOKEN
|
| Admin Console message format |
Invite email to {USER_EMAIL} resent
|
Reset Cookies and Forced Relogin
| Event details |
| Event name |
RESET_SIGNIN_COOKIES |
| Parameters |
USER_EMAIL |
string
The user's primary email address.
|
|
| Sample request |
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/admin?eventName=RESET_SIGNIN_COOKIES&maxResults=10&access_token=YOUR_ACCESS_TOKEN
|
| Admin Console message format |
Cookies reset for {USER_EMAIL} and forced re-login
|
Security Key Registered For User
| Event details |
| Event name |
SECURITY_KEY_REGISTERED_FOR_USER |
| Parameters |
USER_EMAIL |
string
The user's primary email address.
|
|
| Sample request |
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/admin?eventName=SECURITY_KEY_REGISTERED_FOR_USER&maxResults=10&access_token=YOUR_ACCESS_TOKEN
|
| Admin Console message format |
Security key registered for {USER_EMAIL}
|
Security Key Revoke
| Event details |
| Event name |
REVOKE_SECURITY_KEY |
| Parameters |
USER_EMAIL |
string
The user's primary email address.
|
|
| Sample request |
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/admin?eventName=REVOKE_SECURITY_KEY&maxResults=10&access_token=YOUR_ACCESS_TOKEN
|
| Admin Console message format |
A security key enrolled for user {USER_EMAIL} for 2-step verification was revoked
|
Send User Invite
| Event details |
| Event name |
USER_INVITE |
| Parameters |
DOMAIN_NAME |
string
The primary domain name.
|
USER_EMAIL |
string
The user's primary email address.
|
|
| Sample request |
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/admin?eventName=USER_INVITE&maxResults=10&access_token=YOUR_ACCESS_TOKEN
|
| Admin Console message format |
{USER_EMAIL} invited to join your organization
|
Temporary Password Viewed
| Event details |
| Event name |
VIEW_TEMP_PASSWORD |
| Parameters |
DOMAIN_NAME |
string
The primary domain name.
|
USER_EMAIL |
string
The user's primary email address.
|
|
| Sample request |
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/admin?eventName=VIEW_TEMP_PASSWORD&maxResults=10&access_token=YOUR_ACCESS_TOKEN
|
| Admin Console message format |
Temporary password for user {USER_EMAIL} viewed by the admin
|
Turn off 2-step verification
| Event details |
| Event name |
TURN_OFF_2_STEP_VERIFICATION |
| Parameters |
USER_EMAIL |
string
The user's primary email address.
|
|
| Sample request |
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/admin?eventName=TURN_OFF_2_STEP_VERIFICATION&maxResults=10&access_token=YOUR_ACCESS_TOKEN
|
| Admin Console message format |
2-step verification has been turned off for the user {USER_EMAIL}
|
Unblock User Session
| Event details |
| Event name |
UNBLOCK_USER_SESSION |
| Parameters |
USER_EMAIL |
string
The user's primary email address.
|
|
| Sample request |
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/admin?eventName=UNBLOCK_USER_SESSION&maxResults=10&access_token=YOUR_ACCESS_TOKEN
|
| Admin Console message format |
User {USER_EMAIL} unblocked by temporarily disabling login challenge
|
Unmanaged Users Bulk Upload
| Event details |
| Event name |
UNMANAGED_USERS_BULK_UPLOAD |
| Parameters |
BULK_UPLOAD_FAIL_USERS_NUMBER |
string
Bulk Upload Failed Users Number.
|
BULK_UPLOAD_TOTAL_USERS_NUMBER |
string
Bulk Upload Total Users Number.
|
|
| Sample request |
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/admin?eventName=UNMANAGED_USERS_BULK_UPLOAD&maxResults=10&access_token=YOUR_ACCESS_TOKEN
|
| Admin Console message format |
A total of {BULK_UPLOAD_TOTAL_USERS_NUMBER} unmanaged users selected for upload. {BULK_UPLOAD_FAIL_USERS_NUMBER} out of {BULK_UPLOAD_TOTAL_USERS_NUMBER} users failed to be uploaded.
|
Unmanaged Users List Download
| Event details |
| Event name |
DOWNLOAD_UNMANAGED_USERS_LIST |
| Sample request |
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/admin?eventName=DOWNLOAD_UNMANAGED_USERS_LIST&maxResults=10&access_token=YOUR_ACCESS_TOKEN
|
| Admin Console message format |
Unmanaged Users list was downloaded as a CSV file
|
Update Profile Photo
| Event details |
| Event name |
UPDATE_PROFILE_PHOTO |
| Parameters |
USER_EMAIL |
string
The user's primary email address.
|
|
| Sample request |
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/admin?eventName=UPDATE_PROFILE_PHOTO&maxResults=10&access_token=YOUR_ACCESS_TOKEN
|
| Admin Console message format |
Profile photo of {USER_EMAIL} has been updated
|
User Advanced Protection Unenroll
| Event details |
| Event name |
UNENROLL_USER_FROM_TITANIUM |
| Parameters |
USER_EMAIL |
string
The user's primary email address.
|
|
| Sample request |
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/admin?eventName=UNENROLL_USER_FROM_TITANIUM&maxResults=10&access_token=YOUR_ACCESS_TOKEN
|
| Admin Console message format |
User {USER_EMAIL} unenrolled from Advanced Protection
|
User Archival
| Event details |
| Event name |
ARCHIVE_USER |
| Parameters |
USER_EMAIL |
string
The user's primary email address.
|
|
| Sample request |
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/admin?eventName=ARCHIVE_USER&maxResults=10&access_token=YOUR_ACCESS_TOKEN
|
| Admin Console message format |
{USER_EMAIL} archived
|
User BirthDate Change
| Event details |
| Event name |
UPDATE_BIRTHDATE |
| Parameters |
BIRTHDATE |
string
The date of the user's birthday.
|
USER_EMAIL |
string
The user's primary email address.
|
|
| Sample request |
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/admin?eventName=UPDATE_BIRTHDATE&maxResults=10&access_token=YOUR_ACCESS_TOKEN
|
| Admin Console message format |
The birth date for {USER_EMAIL} changed to {BIRTHDATE}
|
User Creation
| Event details |
| Event name |
CREATE_USER |
| Parameters |
USER_EMAIL |
string
The new user's primary user email.
|
|
| Sample request |
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/admin?eventName=CREATE_USER&maxResults=10&access_token=YOUR_ACCESS_TOKEN
|
| Admin Console message format |
{USER_EMAIL} created
|
User Deletion
| Event details |
| Event name |
DELETE_USER |
| Parameters |
USER_EMAIL |
string
The deleted user's primary user email.
|
|
| Sample request |
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/admin?eventName=DELETE_USER&maxResults=10&access_token=YOUR_ACCESS_TOKEN
|
| Admin Console message format |
{USER_EMAIL} deleted
|
User Downgrade From Google+
| Event details |
| Event name |
DOWNGRADE_USER_FROM_GPLUS |
| Parameters |
USER_EMAIL |
string
The user's primary email address.
|
|
| Sample request |
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/admin?eventName=DOWNGRADE_USER_FROM_GPLUS&maxResults=10&access_token=YOUR_ACCESS_TOKEN
|
| Admin Console message format |
{USER_EMAIL} was downgraded from Google+
|
User Enrolled In 2-Step Verification
| Event details |
| Event name |
USER_ENROLLED_IN_TWO_STEP_VERIFICATION |
| Parameters |
USER_EMAIL |
string
The user's primary email address.
|
|
| Sample request |
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/admin?eventName=USER_ENROLLED_IN_TWO_STEP_VERIFICATION&maxResults=10&access_token=YOUR_ACCESS_TOKEN
|
| Admin Console message format |
{USER_EMAIL} enrolled in 2-step verification
|
User List Download
| Event details |
| Event name |
DOWNLOAD_USERLIST_CSV |
| Sample request |
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/admin?eventName=DOWNLOAD_USERLIST_CSV&maxResults=10&access_token=YOUR_ACCESS_TOKEN
|
| Admin Console message format |
User list was downloaded as a CSV file
|
User OrgUnit Change
| Event details |
| Event name |
MOVE_USER_TO_ORG_UNIT |
| Parameters |
NEW_VALUE |
string
The user's new organizational unit.
|
ORG_UNIT_NAME |
string
The organizational unit (OU) name (path).
|
USER_EMAIL |
string
The user's primary email address.
|
|
| Sample request |
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/admin?eventName=MOVE_USER_TO_ORG_UNIT&maxResults=10&access_token=YOUR_ACCESS_TOKEN
|
| Admin Console message format |
{USER_EMAIL} moved from {ORG_UNIT_NAME} to {NEW_VALUE}
|
User Put In 2-Step Verification Grace Period
| Event details |
| Event name |
USER_PUT_IN_TWO_STEP_VERIFICATION_GRACE_PERIOD |
| Parameters |
NEW_VALUE |
string
The new SETTING_NAME value that was set during this event.
|
USER_EMAIL |
string
The user's primary email address.
|
|
| Sample request |
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/admin?eventName=USER_PUT_IN_TWO_STEP_VERIFICATION_GRACE_PERIOD&maxResults=10&access_token=YOUR_ACCESS_TOKEN
|
| Admin Console message format |
2-step verification grace period has been enabled on {USER_EMAIL} till {NEW_VALUE}
|
User Rename
| Event details |
| Event name |
RENAME_USER |
| Parameters |
NEW_VALUE |
string
The user's new name.
|
USER_EMAIL |
string
The user's primary email address.
|
|
| Sample request |
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/admin?eventName=RENAME_USER&maxResults=10&access_token=YOUR_ACCESS_TOKEN
|
| Admin Console message format |
{USER_EMAIL} renamed to {NEW_VALUE}
|
User Strong Auth Unenroll
| Event details |
| Event name |
UNENROLL_USER_FROM_STRONG_AUTH |
| Parameters |
USER_EMAIL |
string
The user's primary email address.
|
|
| Sample request |
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/admin?eventName=UNENROLL_USER_FROM_STRONG_AUTH&maxResults=10&access_token=YOUR_ACCESS_TOKEN
|
| Admin Console message format |
User {USER_EMAIL} unenrolled from Strong Auth
|
User Suspension
| Event details |
| Event name |
SUSPEND_USER |
| Parameters |
USER_EMAIL |
string
The user's primary email address.
|
|
| Sample request |
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/admin?eventName=SUSPEND_USER&maxResults=10&access_token=YOUR_ACCESS_TOKEN
|
| Admin Console message format |
{USER_EMAIL} suspended
|
User Unarchival
| Event details |
| Event name |
UNARCHIVE_USER |
| Parameters |
USER_EMAIL |
string
The user's primary email address.
|
|
| Sample request |
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/admin?eventName=UNARCHIVE_USER&maxResults=10&access_token=YOUR_ACCESS_TOKEN
|
| Admin Console message format |
{USER_EMAIL} unarchived
|
User Undeletion
| Event details |
| Event name |
UNDELETE_USER |
| Parameters |
USER_EMAIL |
string
The user's primary email address.
|
|
| Sample request |
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/admin?eventName=UNDELETE_USER&maxResults=10&access_token=YOUR_ACCESS_TOKEN
|
| Admin Console message format |
{USER_EMAIL} undeleted
|
User Unsuspension
| Event details |
| Event name |
UNSUSPEND_USER |
| Parameters |
USER_EMAIL |
string
The user's primary email address.
|
|
| Sample request |
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/admin?eventName=UNSUSPEND_USER&maxResults=10&access_token=YOUR_ACCESS_TOKEN
|
| Admin Console message format |
{USER_EMAIL} unsuspended
|
User Upgrade To Google+
| Event details |
| Event name |
UPGRADE_USER_TO_GPLUS |
| Parameters |
USER_EMAIL |
string
The user's primary email address.
|
|
| Sample request |
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/admin?eventName=UPGRADE_USER_TO_GPLUS&maxResults=10&access_token=YOUR_ACCESS_TOKEN
|
| Admin Console message format |
{USER_EMAIL} was upgraded to Google+
|
Users Bulk Upload
| Event details |
| Event name |
USERS_BULK_UPLOAD |
| Parameters |
BULK_UPLOAD_FAIL_USERS_NUMBER |
string
The number of failures when attemping to bulk upload users.
|
BULK_UPLOAD_TOTAL_USERS_NUMBER |
string
The total number of bulk uploaded users.
|
|
| Sample request |
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/admin?eventName=USERS_BULK_UPLOAD&maxResults=10&access_token=YOUR_ACCESS_TOKEN
|
| Admin Console message format |
A total of {BULK_UPLOAD_TOTAL_USERS_NUMBER} users selected for upload. {BULK_UPLOAD_FAIL_USERS_NUMBER} out of {BULK_UPLOAD_TOTAL_USERS_NUMBER} users failed to be uploaded.
|
Users Bulk Upload Notification
| Event details |
| Event name |
USERS_BULK_UPLOAD_NOTIFICATION_SENT |
| Parameters |
USER_EMAIL |
string
The user's primary email address.
|
|
| Sample request |
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/admin?eventName=USERS_BULK_UPLOAD_NOTIFICATION_SENT&maxResults=10&access_token=YOUR_ACCESS_TOKEN
|
| Admin Console message format |
Notification of bulk users upload sent to {USER_EMAIL}
|
