Admin Audit Activity Events - User Settings

This document lists the events and parameters for User Settings Admin Audit activity events. You can retrieve these events by calling Activities.list() with applicationName=admin.

User Settings

Events of this type are returned with type=USER_SETTINGS.

2-step Verification Scratch Codes Deletion

Event details
Event name DELETE_2SV_SCRATCH_CODES
Parameters
USER_EMAIL

string

The user's primary email address.

Sample request
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/admin?eventName=DELETE_2SV_SCRATCH_CODES&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format
2-step verification scratch codes of the user {USER_EMAIL} deleted

2-step Verification Scratch Codes Generate

Event details
Event name GENERATE_2SV_SCRATCH_CODES
Parameters
USER_EMAIL

string

The user's primary email address.

Sample request
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/admin?eventName=GENERATE_2SV_SCRATCH_CODES&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format
New 2-step verification scratch codes generated for the user {USER_EMAIL}

3-legged OAuth Device Tokens Revoke

Event details
Event name REVOKE_3LO_DEVICE_TOKENS
Parameters
DEVICE_ID

string

The device's ID.

DEVICE_TYPE

string

The device's type.

USER_EMAIL

string

The user's primary email address.

Sample request
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/admin?eventName=REVOKE_3LO_DEVICE_TOKENS&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format
3-legged OAuth tokens issued by user {USER_EMAIL} for the device type {DEVICE_TYPE} and id {DEVICE_ID} were revoked

3-legged OAuth Token Revoke

Event details
Event name REVOKE_3LO_TOKEN
Parameters
APP_ID

string

The application ID whose access is managed by the token.

USER_EMAIL

string

The user's primary email address.

Sample request
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/admin?eventName=REVOKE_3LO_TOKEN&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format
3-legged OAuth tokens issued by user {USER_EMAIL} for application {APP_ID} were revoked

Accept User Invite

Event details
Event name ACCEPT_USER_INVITATION
Parameters
USER_EMAIL

string

The user's primary email address.

Sample request
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/admin?eventName=ACCEPT_USER_INVITATION&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format
User invitation accepted for user: {USER_EMAIL}

Add Recovery Email

Event details
Event name ADD_RECOVERY_EMAIL
Parameters
USER_EMAIL

string

The user's primary email address.

Sample request
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/admin?eventName=ADD_RECOVERY_EMAIL&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format
Recovery email added for {USER_EMAIL}

Add Recovery Phone

Event details
Event name ADD_RECOVERY_PHONE
Parameters
USER_EMAIL

string

The user's primary email address.

Sample request
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/admin?eventName=ADD_RECOVERY_PHONE&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format
Recovery phone added for {USER_EMAIL}

Admin Privileges Grant

Event details
Event name GRANT_ADMIN_PRIVILEGE
Parameters
USER_EMAIL

string

The user's primary email address.

Sample request
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/admin?eventName=GRANT_ADMIN_PRIVILEGE&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format
Admin privileges granted to {USER_EMAIL}

Admin Privileges Revoke

Event details
Event name REVOKE_ADMIN_PRIVILEGE
Parameters
USER_EMAIL

string

The user's primary email address.

Sample request
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/admin?eventName=REVOKE_ADMIN_PRIVILEGE&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format
Admin privileges revoked from {USER_EMAIL}

Application Specific Password Revoke

Event details
Event name REVOKE_ASP
Parameters
ASP_ID

string

The application specific password ID.

USER_EMAIL

string

The user's primary email address.

Sample request
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/admin?eventName=REVOKE_ASP&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format
Application specific password with Id {ASP_ID} issued by user {USER_EMAIL} revoked

Automatic Contact Share Change

Event details
Event name TOGGLE_AUTOMATIC_CONTACT_SHARING
Parameters
NEW_VALUE

string

The setting value, either true or false.

USER_EMAIL

string

The user's primary email address.

Sample request
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/admin?eventName=TOGGLE_AUTOMATIC_CONTACT_SHARING&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format
Automatic contact sharing for {USER_EMAIL} changed to {NEW_VALUE}

Bulk Upload

Event details
Event name BULK_UPLOAD
Parameters
BULK_UPLOAD_FAIL_USERS_NUMBER

string

The number of users who did not successfully upload to the domain.

BULK_UPLOAD_TOTAL_USERS_NUMBER

string

The number of total users being uploaded.

DOMAIN_NAME

string

The primary domain name where users are being moved.

Sample request
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/admin?eventName=BULK_UPLOAD&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format
{BULK_UPLOAD_TOTAL_USERS_NUMBER} users selected for upload to your organization. {BULK_UPLOAD_FAIL_USERS_NUMBER} out of {BULK_UPLOAD_TOTAL_USERS_NUMBER} users were not uploaded.

Bulk Upload Notification

Event details
Event name BULK_UPLOAD_NOTIFICATION_SENT
Parameters
DOMAIN_NAME

string

The primary domain name where users were uploaded.

USER_EMAIL

string

The primary email address of user who was sent notification of bulk upload event.

Sample request
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/admin?eventName=BULK_UPLOAD_NOTIFICATION_SENT&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format
Notification of bulk users upload sent to {USER_EMAIL}

Cancel User Invite

Event details
Event name CANCEL_USER_INVITE
Parameters
DOMAIN_NAME

string

The primary domain name.

USER_EMAIL

string

The primary email address of the user whose invitation is being cancelled.

Sample request
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/admin?eventName=CANCEL_USER_INVITE&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format
Invite to {USER_EMAIL} cancelled

Change Custom Attribute

Event details
Event name CHANGE_USER_CUSTOM_FIELD
Parameters
NEW_VALUE

string

The new SETTING_NAME value that was set during this event.

OLD_VALUE

string

The previous SETTING_NAME value that was replaced during this event.

USER_CUSTOM_FIELD

string

The name of the user's custom field.

USER_EMAIL

string

The user's primary email address.

Sample request
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/admin?eventName=CHANGE_USER_CUSTOM_FIELD&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format
{USER_CUSTOM_FIELD} changed for {USER_EMAIL} from {OLD_VALUE} to {NEW_VALUE}

Change External Id

Event details
Event name CHANGE_USER_EXTERNAL_ID
Parameters
NEW_VALUE

string

The new SETTING_NAME value that was set during this event.

OLD_VALUE

string

The previous SETTING_NAME value that was replaced during this event.

USER_EMAIL

string

The user's primary email address.

Sample request
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/admin?eventName=CHANGE_USER_EXTERNAL_ID&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format
External Ids changed for {USER_EMAIL} from {OLD_VALUE} to {NEW_VALUE}

Change Gender

Change here is a verb. The genders will be customizable, so this should be broader than male vs female.

Event details
Event name CHANGE_USER_GENDER
Parameters
NEW_VALUE

string

The new SETTING_NAME value that was set during this event.

OLD_VALUE

string

The previous SETTING_NAME value that was replaced during this event.

USER_EMAIL

string

The user's primary email address.

Sample request
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/admin?eventName=CHANGE_USER_GENDER&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format
Gender changed for {USER_EMAIL} from {OLD_VALUE} to {NEW_VALUE}

Change IM

Event details
Event name CHANGE_USER_IM
Parameters
NEW_VALUE

string

The new SETTING_NAME value that was set during this event.

OLD_VALUE

string

The previous SETTING_NAME value that was replaced during this event.

USER_EMAIL

string

The user's primary email address.

Sample request
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/admin?eventName=CHANGE_USER_IM&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format
IMs changed for {USER_EMAIL} from {OLD_VALUE} to {NEW_VALUE}

Change IP Whitelist

Event details
Event name ENABLE_USER_IP_WHITELIST
Parameters
NEW_VALUE

string

The new SETTING_NAME value that was set during this event.

OLD_VALUE

string

The previous SETTING_NAME value that was replaced during this event.

USER_EMAIL

string

The user's primary email address.

Sample request
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/admin?eventName=ENABLE_USER_IP_WHITELIST&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format
IP whitelist changed for {USER_EMAIL} from {OLD_VALUE} to {NEW_VALUE}

Change Keyword

Keywords are used on user profiles to help identify a user in searches. Example: find person with name 'Larry' and school 'Stanford'. 'Change' is a verb.

Event details
Event name CHANGE_USER_KEYWORD
Parameters
NEW_VALUE

string

The new SETTING_NAME value that was set during this event.

OLD_VALUE

string

The previous SETTING_NAME value that was replaced during this event.

USER_EMAIL

string

The user's primary email address.

Sample request
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/admin?eventName=CHANGE_USER_KEYWORD&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format
Keywords changed for {USER_EMAIL} from {OLD_VALUE} to {NEW_VALUE}

Change Language

Can be a predefined set of more common languages provided by Google or a custom language. 'Change' here is a verb.

Event details
Event name CHANGE_USER_LANGUAGE
Parameters
NEW_VALUE

string

The new SETTING_NAME value that was set during this event.

OLD_VALUE

string

The previous SETTING_NAME value that was replaced during this event.

USER_EMAIL

string

The user's primary email address.

Sample request
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/admin?eventName=CHANGE_USER_LANGUAGE&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format
Languages changed for {USER_EMAIL} from {OLD_VALUE} to {NEW_VALUE}

Change Location

Location is different from address in the following ways: (1) Location can be fuzzy. Example: Near Seattle. (2) Hovercards and other short user summaries display location, not address. 'Change' is a verb.

Event details
Event name CHANGE_USER_LOCATION
Parameters
NEW_VALUE

string

The new SETTING_NAME value that was set during this event.

OLD_VALUE

string

The previous SETTING_NAME value that was replaced during this event.

USER_EMAIL

string

The user's primary email address.

Sample request
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/admin?eventName=CHANGE_USER_LOCATION&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format
Locations changed for {USER_EMAIL} from {OLD_VALUE} to {NEW_VALUE}

Change Organization

Event details
Event name CHANGE_USER_ORGANIZATION
Parameters
NEW_VALUE

string

The new SETTING_NAME value that was set during this event.

OLD_VALUE

string

The previous SETTING_NAME value that was replaced during this event.

USER_EMAIL

string

The user's primary email address.

Sample request
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/admin?eventName=CHANGE_USER_ORGANIZATION&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format
Organizations changed for {USER_EMAIL} from {OLD_VALUE} to {NEW_VALUE}

Change Phone Numbers

Event details
Event name CHANGE_USER_PHONE_NUMBER
Parameters
NEW_VALUE

string

The new SETTING_NAME value that was set during this event.

OLD_VALUE

string

The previous SETTING_NAME value that was replaced during this event.

USER_EMAIL

string

The user's primary email address.

Sample request
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/admin?eventName=CHANGE_USER_PHONE_NUMBER&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format
Phone Numbers changed for {USER_EMAIL} from {OLD_VALUE} to {NEW_VALUE}

Change Recovery Email

Event details
Event name CHANGE_RECOVERY_EMAIL
Parameters
USER_EMAIL

string

The user's primary email address.

Sample request
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/admin?eventName=CHANGE_RECOVERY_EMAIL&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format
Recovery email changed for {USER_EMAIL}

Change Recovery Phone

Event details
Event name CHANGE_RECOVERY_PHONE
Parameters
USER_EMAIL

string

The user's primary email address.

Sample request
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/admin?eventName=CHANGE_RECOVERY_PHONE&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format
Recovery phone changed for {USER_EMAIL}

Change Relation

Event details
Event name CHANGE_USER_RELATION
Parameters
NEW_VALUE

string

The new SETTING_NAME value that was set during this event.

OLD_VALUE

string

The previous SETTING_NAME value that was replaced during this event.

USER_EMAIL

string

The user's primary email address.

Sample request
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/admin?eventName=CHANGE_USER_RELATION&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format
Relations changed for {USER_EMAIL} from {OLD_VALUE} to {NEW_VALUE}

Change User Address

Event details
Event name CHANGE_USER_ADDRESS
Parameters
NEW_VALUE

string

The new SETTING_NAME value that was set during this event.

OLD_VALUE

string

The previous SETTING_NAME value that was replaced during this event.

USER_EMAIL

string

The user's primary email address.

Sample request
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/admin?eventName=CHANGE_USER_ADDRESS&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format
Addresses changed for {USER_EMAIL} from {OLD_VALUE} to {NEW_VALUE}

Create an email monitor

Event details
Event name CREATE_EMAIL_MONITOR
Parameters
BEGIN_DATE_TIME

string

The start date and time for the email monitor.

EMAIL_MONITOR_DEST_EMAIL

string

The destination address of the email monitor.

EMAIL_MONITOR_LEVEL_CHAT

string

The chat email monitor level.

EMAIL_MONITOR_LEVEL_DRAFT_EMAIL

string

The draft email monitor level.

EMAIL_MONITOR_LEVEL_INCOMING_EMAIL

string

The incoming email monitor level.

EMAIL_MONITOR_LEVEL_OUTGOING_EMAIL

string

The outgoing email monitor level.

END_DATE_TIME

string

The end date and time for the email monitor.

USER_EMAIL

string

The user's primary email address.

Sample request
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/admin?eventName=CREATE_EMAIL_MONITOR&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format
Created an email monitor for {USER_EMAIL} to {EMAIL_MONITOR_DEST_EMAIL} that will expire on {END_DATE_TIME}

Data transfer request created

Event details
Event name CREATE_DATA_TRANSFER_REQUEST
Parameters
APPLICATION_NAME

string

A comma-separated application names for which data transfer is requested.

DESTINATION_USER_EMAIL

string

The new owner's primary user email to whom to transfer user data to.

USER_EMAIL

string

The user's primary email address.

Sample request
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/admin?eventName=CREATE_DATA_TRANSFER_REQUEST&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format
Data transfer request created from {USER_EMAIL} to {DESTINATION_USER_EMAIL} for apps {APPLICATION_NAME}

Delegated Admin Privileges Grant

Event details
Event name GRANT_DELEGATED_ADMIN_PRIVILEGES
Parameters
NEW_VALUE

string

The new delegated admin privilege.

USER_EMAIL

string

The user's primary email address.

Sample request
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/admin?eventName=GRANT_DELEGATED_ADMIN_PRIVILEGES&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format
{USER_EMAIL} assigned {NEW_VALUE} admin privileges

Delete account information dump

Event details
Event name DELETE_ACCOUNT_INFO_DUMP
Parameters
REQUEST_ID

string

The request ID.

USER_EMAIL

string

The user's primary email address.

Sample request
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/admin?eventName=DELETE_ACCOUNT_INFO_DUMP&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format
Deleted account and login information dump for {USER_EMAIL} and request ID {REQUEST_ID}

Delete an email monitor

Event details
Event name DELETE_EMAIL_MONITOR
Parameters
EMAIL_MONITOR_DEST_EMAIL

string

The destination address of the email monitor.

USER_EMAIL

string

The user's primary email address.

Sample request
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/admin?eventName=DELETE_EMAIL_MONITOR&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format
Deleted an email monitor for {USER_EMAIL} to {EMAIL_MONITOR_DEST_EMAIL}

Delete mailbox dump

Event details
Event name DELETE_MAILBOX_DUMP
Parameters
REQUEST_ID

string

The request ID.

USER_EMAIL

string

The user's primary email address.

Sample request
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/admin?eventName=DELETE_MAILBOX_DUMP&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format
Deleted mailbox dump for {USER_EMAIL} and request ID {REQUEST_ID}

Delete Profile Photo

Event details
Event name DELETE_PROFILE_PHOTO
Parameters
USER_EMAIL

string

The user's primary email address.

Sample request
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/admin?eventName=DELETE_PROFILE_PHOTO&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format
Profile photo of {USER_EMAIL} has been deleted

Display Name Added

Event details
Event name ADD_DISPLAY_NAME
Parameters
USER_DISPLAY_NAME

string

User display name.

USER_EMAIL

string

The user's primary email address.

Sample request
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/admin?eventName=ADD_DISPLAY_NAME&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format
{USER_DISPLAY_NAME} added as a display name of {USER_EMAIL}

Display Name Change

Event details
Event name CHANGE_DISPLAY_NAME
Parameters
NEW_VALUE

string

The new SETTING_NAME value that was set during this event.

OLD_VALUE

string

The previous SETTING_NAME value that was replaced during this event.

USER_EMAIL

string

The user's primary email address.

Sample request
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/admin?eventName=CHANGE_DISPLAY_NAME&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format
Display name of {USER_EMAIL} changed from {OLD_VALUE} to {NEW_VALUE}

Display Name Removed

Event details
Event name REMOVE_DISPLAY_NAME
Parameters
USER_DISPLAY_NAME

string

User display name.

USER_EMAIL

string

The user's primary email address.

Sample request
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/admin?eventName=REMOVE_DISPLAY_NAME&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format
{USER_DISPLAY_NAME} removed as a display name of {USER_EMAIL}

First Name Change

Event details
Event name CHANGE_FIRST_NAME
Parameters
NEW_VALUE

string

The user's new first name.

OLD_VALUE

string

The user's previous first name.

USER_EMAIL

string

The user's primary email address.

Sample request
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/admin?eventName=CHANGE_FIRST_NAME&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format
First name of {USER_EMAIL} changed from {OLD_VALUE} to {NEW_VALUE}

Gmail Account Reset

Event details
Event name GMAIL_RESET_USER
Parameters
GMAIL_RESET_REASON

string

Gmail's reason for resetting the account.

USER_EMAIL

string

The user's primary email address.

Sample request
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/admin?eventName=GMAIL_RESET_USER&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format
Gmail account of {USER_EMAIL} reset

Last Name Change

Event details
Event name CHANGE_LAST_NAME
Parameters
NEW_VALUE

string

The user's new last name.

OLD_VALUE

string

The user's previous last name.

USER_EMAIL

string

The user's primary email address.

Sample request
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/admin?eventName=CHANGE_LAST_NAME&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format
Last name of {USER_EMAIL} changed from {OLD_VALUE} to {NEW_VALUE}

Mail Routing Destination Creation

Event details
Event name MAIL_ROUTING_DESTINATION_ADDED
Parameters
NEW_VALUE

string

The new routing destination.

USER_EMAIL

string

The user's primary email address.

Sample request
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/admin?eventName=MAIL_ROUTING_DESTINATION_ADDED&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format
User {USER_EMAIL} has received the following individual mail routing destination: {NEW_VALUE}

Mail Routing Destination Deletion

Event details
Event name MAIL_ROUTING_DESTINATION_REMOVED
Parameters
OLD_VALUE

string

The previous routing destination.

USER_EMAIL

string

The user's primary email address.

Sample request
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/admin?eventName=MAIL_ROUTING_DESTINATION_REMOVED&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format
User {USER_EMAIL} has had the following individual mail routing destination removed: {OLD_VALUE}

Nickname Creation

Event details
Event name ADD_NICKNAME
Parameters
USER_EMAIL

string

The primary user email.

USER_NICKNAME

string

The user's nickname, also known as alternate email or alias. For Admin console information, see the administration help center.

Sample request
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/admin?eventName=ADD_NICKNAME&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format
{USER_NICKNAME} created as a nickname of {USER_EMAIL}

Nickname Deletion

Event details
Event name REMOVE_NICKNAME
Parameters
USER_EMAIL

string

The user's primary email address.

USER_NICKNAME

string

The user's previous nickname.

Sample request
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/admin?eventName=REMOVE_NICKNAME&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format
{USER_NICKNAME} deleted as a nickname of {USER_EMAIL}

Passkey revoked

Event details
Event name PASSKEY_REVOKED
Parameters
enrollment_type

string

Describers whether the passkey was enrolled by user or created automatically. Possible values:

  • automatically_created
    Passkey enrolled automatically on android device.
  • user_created
    Passkey enrolled by end user.
passkey_added_from

string

Location from where the passkey was added.

passkey_added_on_timestamp

integer

Timestamp when the passkey was added.

passkey_last_used_from

string

Location from where was the passkey last used.

passkey_last_used_timestamp

integer

Timestamp when the passkey was last used.

platform_or_device

string

Platform or device used for creating the passkey. Possible values:

  • apple_icloud_keychain
    Passkey created using apple icloud keychain.
  • bitwarden
    Passkey created using bitwarden.
  • chrome_on_mac
    Passkey created using chrome on mac.
  • chrome_os
    Passkey created using chrome os.
  • dashlane
    Passkey created using dashlane.
  • edge_on_mac
    Passkey created using Edge on Mac.
  • generic_passkey
    Passkey type generic passkey description.
  • generic_usb_key
    Passkey created using FIDO2 security key.
  • generic_usb_up_key
    Passkey created using security key.
  • google_account_passkey_on_android
    Passkey created using android device.
  • google_password_manager
    Passkey created using google password manager.
  • keeper
    Passkey created using keeper.
  • nordpass
    Passkey created using nordpass.
  • one_password
    Passkey created using 1Password.
  • samsung_pass
    Passkey created using Samsung pass.
  • titan_key
    Passkey created using titan security key.
  • windows_hello
    Passkey created using windows hello.
  • yubikey
    Passkey created using yubico security key.
supports_passwordless

boolean

Whether the passkey can be used to skip password.

USER_EMAIL

string

The user's primary email address.

Sample request
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/admin?eventName=PASSKEY_REVOKED&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format
A passkey enrolled for user {USER_EMAIL} was revoked

Password Change

Event details
Event name CHANGE_PASSWORD
Parameters
USER_EMAIL

string

The user's primary email address.

Sample request
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/admin?eventName=CHANGE_PASSWORD&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format
Password changed for {USER_EMAIL}

Password Change on Next Login

Event details
Event name CHANGE_PASSWORD_ON_NEXT_LOGIN
Parameters
NEW_VALUE

string

Indicates whether the user must change their password on their next login; can be true or false.

OLD_VALUE

string

The previous setting value; can be true or false.

USER_EMAIL

string

The user's primary email address.

Sample request
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/admin?eventName=CHANGE_PASSWORD_ON_NEXT_LOGIN&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format
Password change requirement for {USER_EMAIL} on next login changed from {OLD_VALUE} to {NEW_VALUE}

Pending Invites List Download

Event details
Event name DOWNLOAD_PENDING_INVITES_LIST
Sample request
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/admin?eventName=DOWNLOAD_PENDING_INVITES_LIST&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format
Pending Invites List was downloaded as a CSV file

Public Key Certificate Status Updated

Event details
Event name UPDATE_PUBLIC_KEY_CERTIFICATE_STATUS
Parameters
PUBLIC_KEY_CERTIFICATE_STATUS

string

Public key certificate status.

USER_EMAIL

string

The user's primary email address.

USER_IMPACTED_EMAIL

string

User impacted email.

Sample request
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/admin?eventName=UPDATE_PUBLIC_KEY_CERTIFICATE_STATUS&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format
Public key certificate status updated to {PUBLIC_KEY_CERTIFICATE_STATUS} for email {USER_IMPACTED_EMAIL} of user {USER_EMAIL}

Public Key Certificate Updated

Event details
Event name UPDATE_PUBLIC_KEY_CERTIFICATE
Parameters
USER_EMAIL

string

The user's primary email address.

USER_IMPACTED_EMAIL

string

User impacted email.

Sample request
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/admin?eventName=UPDATE_PUBLIC_KEY_CERTIFICATE&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format
Public key certificate updated for {USER_DISPLAY_NAME} email {USER_EMAIL}

Remove Recovery Email

Event details
Event name REMOVE_RECOVERY_EMAIL
Parameters
USER_EMAIL

string

The user's primary email address.

Sample request
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/admin?eventName=REMOVE_RECOVERY_EMAIL&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format
Recovery email removed for {USER_EMAIL}

Remove Recovery Phone

Event details
Event name REMOVE_RECOVERY_PHONE
Parameters
USER_EMAIL

string

The user's primary email address.

Sample request
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/admin?eventName=REMOVE_RECOVERY_PHONE&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format
Recovery phone removed for {USER_EMAIL}

Request account information

Event details
Event name REQUEST_ACCOUNT_INFO
Parameters
USER_EMAIL

string

The user's primary email address.

Sample request
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/admin?eventName=REQUEST_ACCOUNT_INFO&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format
Requested account and login information for {USER_EMAIL}

Request mailbox dump

Event details
Event name REQUEST_MAILBOX_DUMP
Parameters
BEGIN_DATE_TIME

string

The start date and time for the email monitor.

EMAIL_EXPORT_INCLUDE_DELETED

string

Indicates if deleted emails are included in the export.

EMAIL_EXPORT_PACKAGE_CONTENT

string

The contents of the mailbox package.

END_DATE_TIME

string

The end date and time for the email monitor.

SEARCH_QUERY_FOR_DUMP

string

The search query used for the dump.

USER_EMAIL

string

The user's primary email address.

Sample request
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/admin?eventName=REQUEST_MAILBOX_DUMP&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format
Requested mailbox dump for {USER_EMAIL}

Resend User Invite

Event details
Event name RESEND_USER_INVITE
Parameters
DOMAIN_NAME

string

The primary domain name.

USER_EMAIL

string

The user's primary email address.

Sample request
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/admin?eventName=RESEND_USER_INVITE&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format
Invite email to {USER_EMAIL} resent