Admin Audit Activity Events - User Settings

    This document lists the events and parameters for User Settings Admin Audit activity events. You can retrieve these events by calling Activities.list() with applicationName=admin .

    Events of this type are returned with type=USER_SETTINGS .

    2-step Verification Scratch Codes Deletion

    Event details
    Event name
    DELETE_2SV_SCRATCH_CODES
    Parameters
    USER_ EMAIL

    string

    The user's primary email address.

    Sample request
    GET https://admin.googleapis.com /admin /reports /v1 /activity /users /all /applications / admin ?eventName= DELETE_2SV_SCRATCH_CODES &maxResults=10 &access_token= YOUR_ACCESS_TOKEN
    Admin Console message format
    2-step verification scratch codes of the user {USER_EMAIL} deleted

    2-step Verification Scratch Codes Generate

    Event details
    Event name
    GENERATE_2SV_SCRATCH_CODES
    Parameters
    USER_ EMAIL

    string

    The user's primary email address.

    Sample request
    GET https://admin.googleapis.com /admin /reports /v1 /activity /users /all /applications / admin ?eventName= GENERATE_2SV_SCRATCH_CODES &maxResults=10 &access_token= YOUR_ACCESS_TOKEN
    Admin Console message format
    New 2-step verification scratch codes generated for the user {USER_EMAIL}

    3-legged OAuth Device Tokens Revoke

    Event details
    Event name
    REVOKE_3LO_DEVICE_TOKENS
    Parameters
    DEVICE_ ID

    string

    The device's ID.
    DEVICE_ TYPE

    string

    The device's type.
    USER_ EMAIL

    string

    The user's primary email address.
    Sample request
    GET https://admin.googleapis.com /admin /reports /v1 /activity /users /all /applications / admin ?eventName= REVOKE_3LO_DEVICE_TOKENS &maxResults=10 &access_token= YOUR_ACCESS_TOKEN
    Admin Console message format
    3-legged OAuth tokens issued by user {USER_EMAIL} for the device type {DEVICE_TYPE} and id {DEVICE_ID} were revoked

    3-legged OAuth Token Revoke

    Event details
    Event name
    REVOKE_3LO_TOKEN
    Parameters
    APP_ ID

    string

    The application ID whose access is managed by the token.
    USER_ EMAIL

    string

    The user's primary email address.
    Sample request
    GET https://admin.googleapis.com /admin /reports /v1 /activity /users /all /applications / admin ?eventName= REVOKE_3LO_TOKEN &maxResults=10 &access_token= YOUR_ACCESS_TOKEN
    Admin Console message format
    3-legged OAuth tokens issued by user {USER_EMAIL} for application {APP_ID} were revoked

    Accept User Invite

    Event details
    Event name
    ACCEPT_USER_INVITATION
    Parameters
    USER_ EMAIL

    string

    The user's primary email address.

    Sample request
    GET https://admin.googleapis.com /admin /reports /v1 /activity /users /all /applications / admin ?eventName= ACCEPT_USER_INVITATION &maxResults=10 &access_token= YOUR_ACCESS_TOKEN
    Admin Console message format
    User invitation accepted for user: {USER_EMAIL}

    Add Recovery Email

    Event details
    Event name
    ADD_RECOVERY_EMAIL
    Parameters
    USER_ EMAIL

    string

    The user's primary email address.

    Sample request
    GET https://admin.googleapis.com /admin /reports /v1 /activity /users /all /applications / admin ?eventName= ADD_RECOVERY_EMAIL &maxResults=10 &access_token= YOUR_ACCESS_TOKEN
    Admin Console message format
    Recovery email added for {USER_EMAIL}

    Add Recovery Phone

    Event details
    Event name
    ADD_RECOVERY_PHONE
    Parameters
    USER_ EMAIL

    string

    The user's primary email address.

    Sample request
    GET https://admin.googleapis.com /admin /reports /v1 /activity /users /all /applications / admin ?eventName= ADD_RECOVERY_PHONE &maxResults=10 &access_token= YOUR_ACCESS_TOKEN
    Admin Console message format
    Recovery phone added for {USER_EMAIL}

    Admin Privileges Grant

    Event details
    Event name
    GRANT_ADMIN_PRIVILEGE
    Parameters
    USER_ EMAIL

    string

    The user's primary email address.

    Sample request
    GET https://admin.googleapis.com /admin /reports /v1 /activity /users /all /applications / admin ?eventName= GRANT_ADMIN_PRIVILEGE &maxResults=10 &access_token= YOUR_ACCESS_TOKEN
    Admin Console message format
    Admin privileges granted to {USER_EMAIL}

    Admin Privileges Revoke

    Event details
    Event name
    REVOKE_ADMIN_PRIVILEGE
    Parameters
    USER_ EMAIL

    string

    The user's primary email address.

    Sample request
    GET https://admin.googleapis.com /admin /reports /v1 /activity /users /all /applications / admin ?eventName= REVOKE_ADMIN_PRIVILEGE &maxResults=10 &access_token= YOUR_ACCESS_TOKEN
    Admin Console message format
    Admin privileges revoked from {USER_EMAIL}

    Application Specific Password Revoke

    Event details
    Event name
    REVOKE_ASP
    Parameters
    ASP_ ID

    string

    The application specific password ID.
    USER_ EMAIL

    string

    The user's primary email address.
    Sample request
    GET https://admin.googleapis.com /admin /reports /v1 /activity /users /all /applications / admin ?eventName= REVOKE_ASP &maxResults=10 &access_token= YOUR_ACCESS_TOKEN
    Admin Console message format
    Application specific password with Id {ASP_ID} issued by user {USER_EMAIL} revoked

    Automatic Contact Share Change

    Event details
    Event name
    TOGGLE_AUTOMATIC_CONTACT_SHARING
    Parameters
    NEW_ VALUE

    string

    The setting value, either true or false .
    USER_ EMAIL

    string

    The user's primary email address.
    Sample request
    GET https://admin.googleapis.com /admin /reports /v1 /activity /users /all /applications / admin ?eventName= TOGGLE_AUTOMATIC_CONTACT_SHARING &maxResults=10 &access_token= YOUR_ACCESS_TOKEN
    Admin Console message format
    Automatic contact sharing for {USER_EMAIL} changed to {NEW_VALUE}

    Bulk Upload

    Event details
    Event name
    BULK_UPLOAD
    Parameters
    BULK_ UPLOAD_ FAIL_ USERS_ NUMBER

    string

    The number of users who did not successfully upload to the domain.
    BULK_ UPLOAD_ TOTAL_ USERS_ NUMBER

    string

    The number of total users being uploaded.
    DOMAIN_ NAME

    string

    The primary domain name where users are being moved.
    Sample request
    GET https://admin.googleapis.com /admin /reports /v1 /activity /users /all /applications / admin ?eventName= BULK_UPLOAD &maxResults=10 &access_token= YOUR_ACCESS_TOKEN
    Admin Console message format
    {BULK_UPLOAD_TOTAL_USERS_NUMBER} users selected for upload to your organization. {BULK_UPLOAD_FAIL_USERS_NUMBER} out of {BULK_UPLOAD_TOTAL_USERS_NUMBER} users were not uploaded.

    Bulk Upload Notification

    Event details
    Event name
    BULK_UPLOAD_NOTIFICATION_SENT
    Parameters
    DOMAIN_ NAME

    string

    The primary domain name where users were uploaded.
    USER_ EMAIL

    string

    The primary email address of user who was sent notification of bulk upload event.
    Sample request
    GET https://admin.googleapis.com /admin /reports /v1 /activity /users /all /applications / admin ?eventName= BULK_UPLOAD_NOTIFICATION_SENT &maxResults=10 &access_token= YOUR_ACCESS_TOKEN
    Admin Console message format
    Notification of bulk users upload sent to {USER_EMAIL}

    Cancel User Invite

    Event details
    Event name
    CANCEL_USER_INVITE
    Parameters
    DOMAIN_ NAME

    string

    The primary domain name.
    USER_ EMAIL

    string

    The primary email address of the user whose invitation is being cancelled.
    Sample request
    GET https://admin.googleapis.com /admin /reports /v1 /activity /users /all /applications / admin ?eventName= CANCEL_USER_INVITE &maxResults=10 &access_token= YOUR_ACCESS_TOKEN
    Admin Console message format
    Invite to {USER_EMAIL} cancelled

    Change Custom Attribute

    Event details
    Event name
    CHANGE_USER_CUSTOM_FIELD
    Parameters
    NEW_ VALUE

    string

    The new SETTING_NAME value that was set during this event.
    OLD_ VALUE

    string

    The previous SETTING_NAME value that was replaced during this event.
    USER_ CUSTOM_ FIELD

    string

    The name of the user's custom field.
    USER_ EMAIL

    string

    The user's primary email address.
    Sample request
    GET https://admin.googleapis.com /admin /reports /v1 /activity /users /all /applications / admin ?eventName= CHANGE_USER_CUSTOM_FIELD &maxResults=10 &access_token= YOUR_ACCESS_TOKEN
    Admin Console message format
    {USER_CUSTOM_FIELD} changed for {USER_EMAIL} from {OLD_VALUE} to {NEW_VALUE}

    Change External Id

    Event details
    Event name
    CHANGE_USER_EXTERNAL_ID
    Parameters
    NEW_ VALUE

    string

    The new SETTING_NAME value that was set during this event.
    OLD_ VALUE

    string

    The previous SETTING_NAME value that was replaced during this event.
    USER_ EMAIL

    string

    The user's primary email address.
    Sample request
    GET https://admin.googleapis.com /admin /reports /v1 /activity /users /all /applications / admin ?eventName= CHANGE_USER_EXTERNAL_ID &maxResults=10 &access_token= YOUR_ACCESS_TOKEN
    Admin Console message format
    External Ids changed for {USER_EMAIL} from {OLD_VALUE} to {NEW_VALUE}

    Change Gender

    Change here is a verb. The genders will be customizable, so this should be broader than male vs female.

    Event details
    Event name
    CHANGE_USER_GENDER
    Parameters
    NEW_ VALUE

    string

    The new SETTING_NAME value that was set during this event.
    OLD_ VALUE

    string

    The previous SETTING_NAME value that was replaced during this event.
    USER_ EMAIL

    string

    The user's primary email address.
    Sample request
    GET https://admin.googleapis.com /admin /reports /v1 /activity /users /all /applications / admin ?eventName= CHANGE_USER_GENDER &maxResults=10 &access_token= YOUR_ACCESS_TOKEN
    Admin Console message format
    Gender changed for {USER_EMAIL} from {OLD_VALUE} to {NEW_VALUE}

    Change IM

    Event details
    Event name
    CHANGE_USER_IM
    Parameters
    NEW_ VALUE

    string

    The new SETTING_NAME value that was set during this event.
    OLD_ VALUE

    string

    The previous SETTING_NAME value that was replaced during this event.
    USER_ EMAIL

    string

    The user's primary email address.
    Sample request
    GET https://admin.googleapis.com /admin /reports /v1 /activity /users /all /applications / admin ?eventName= CHANGE_USER_IM &maxResults=10 &access_token= YOUR_ACCESS_TOKEN
    Admin Console message format
    IMs changed for {USER_EMAIL} from {OLD_VALUE} to {NEW_VALUE}

    Change IP Whitelist

    Event details
    Event name
    ENABLE_USER_IP_WHITELIST
    Parameters
    NEW_ VALUE

    string

    The new SETTING_NAME value that was set during this event.
    OLD_ VALUE

    string

    The previous SETTING_NAME value that was replaced during this event.
    USER_ EMAIL

    string

    The user's primary email address.
    Sample request
    GET https://admin.googleapis.com /admin /reports /v1 /activity /users /all /applications / admin ?eventName= ENABLE_USER_IP_WHITELIST &maxResults=10 &access_token= YOUR_ACCESS_TOKEN
    Admin Console message format
    IP whitelist changed for {USER_EMAIL} from {OLD_VALUE} to {NEW_VALUE}

    Change Keyword

    Keywords are used on user profiles to help identify a user in searches. Example: find person with name 'Larry' and school 'Stanford'. 'Change' is a verb.

    Event details
    Event name
    CHANGE_USER_KEYWORD
    Parameters
    NEW_ VALUE

    string

    The new SETTING_NAME value that was set during this event.
    OLD_ VALUE

    string

    The previous SETTING_NAME value that was replaced during this event.
    USER_ EMAIL

    string

    The user's primary email address.
    Sample request
    GET https://admin.googleapis.com /admin /reports /v1 /activity /users /all /applications / admin ?eventName= CHANGE_USER_KEYWORD &maxResults=10 &access_token= YOUR_ACCESS_TOKEN
    Admin Console message format
    Keywords changed for {USER_EMAIL} from {OLD_VALUE} to {NEW_VALUE}

    Change Language

    Can be a predefined set of more common languages provided by Google or a custom language. 'Change' here is a verb.

    Event details
    Event name
    CHANGE_USER_LANGUAGE
    Parameters
    NEW_ VALUE

    string

    The new SETTING_NAME value that was set during this event.
    OLD_ VALUE

    string

    The previous SETTING_NAME value that was replaced during this event.
    USER_ EMAIL

    string

    The user's primary email address.
    Sample request
    GET https://admin.googleapis.com /admin /reports /v1 /activity /users /all /applications / admin ?eventName= CHANGE_USER_LANGUAGE &maxResults=10 &access_token= YOUR_ACCESS_TOKEN
    Admin Console message format
    Languages changed for {USER_EMAIL} from {OLD_VALUE} to {NEW_VALUE}

    Change Location

    Location is different from address in the following ways: (1) Location can be fuzzy. Example: Near Seattle. (2) Hovercards and other short user summaries display location, not address. 'Change' is a verb.

    Event details
    Event name
    CHANGE_USER_LOCATION
    Parameters
    NEW_ VALUE

    string

    The new SETTING_NAME value that was set during this event.
    OLD_ VALUE

    string

    The previous SETTING_NAME value that was replaced during this event.
    USER_ EMAIL

    string

    The user's primary email address.
    Sample request
    GET https://admin.googleapis.com /admin /reports /v1 /activity /users /all /applications / admin ?eventName= CHANGE_USER_LOCATION &maxResults=10 &access_token= YOUR_ACCESS_TOKEN
    Admin Console message format
    Locations changed for {USER_EMAIL} from {OLD_VALUE} to {NEW_VALUE}

    Change Organization

    Event details
    Event name
    CHANGE_USER_ORGANIZATION
    Parameters
    NEW_ VALUE

    string

    The new SETTING_NAME value that was set during this event.
    OLD_ VALUE

    string

    The previous SETTING_NAME value that was replaced during this event.
    USER_ EMAIL

    string

    The user's primary email address.
    Sample request
    GET https://admin.googleapis.com /admin /reports /v1 /activity /users /all /applications / admin ?eventName= CHANGE_USER_ORGANIZATION &maxResults=10 &access_token= YOUR_ACCESS_TOKEN
    Admin Console message format
    Organizations changed for {USER_EMAIL} from {OLD_VALUE} to {NEW_VALUE}

    Change Phone Numbers

    Event details
    Event name
    CHANGE_USER_PHONE_NUMBER
    Parameters
    NEW_ VALUE

    string

    The new SETTING_NAME value that was set during this event.
    OLD_ VALUE

    string

    The previous SETTING_NAME value that was replaced during this event.
    USER_ EMAIL

    string

    The user's primary email address.
    Sample request
    GET https://admin.googleapis.com /admin /reports /v1 /activity /users /all /applications / admin ?eventName= CHANGE_USER_PHONE_NUMBER &maxResults=10 &access_token= YOUR_ACCESS_TOKEN
    Admin Console message format
    Phone Numbers changed for {USER_EMAIL} from {OLD_VALUE} to {NEW_VALUE}

    Change Recovery Email

    Event details
    Event name
    CHANGE_RECOVERY_EMAIL
    Parameters
    USER_ EMAIL

    string

    The user's primary email address.

    Sample request
    GET https://admin.googleapis.com /admin /reports /v1 /activity /users /all /applications / admin ?eventName= CHANGE_RECOVERY_EMAIL &maxResults=10 &access_token= YOUR_ACCESS_TOKEN
    Admin Console message format
    Recovery email changed for {USER_EMAIL}

    Change Recovery Phone

    Event details
    Event name
    CHANGE_RECOVERY_PHONE
    Parameters
    USER_ EMAIL

    string

    The user's primary email address.

    Sample request
    GET https://admin.googleapis.com /admin /reports /v1 /activity /users /all /applications / admin ?eventName= CHANGE_RECOVERY_PHONE &maxResults=10 &access_token= YOUR_ACCESS_TOKEN
    Admin Console message format
    Recovery phone changed for {USER_EMAIL}

    Change Relation

    Event details
    Event name
    CHANGE_USER_RELATION
    Parameters
    NEW_ VALUE

    string

    The new SETTING_NAME value that was set during this event.
    OLD_ VALUE

    string

    The previous SETTING_NAME value that was replaced during this event.
    USER_ EMAIL

    string

    The user's primary email address.
    Sample request
    GET https://admin.googleapis.com /admin /reports /v1 /activity /users /all /applications / admin ?eventName= CHANGE_USER_RELATION &maxResults=10 &access_token= YOUR_ACCESS_TOKEN
    Admin Console message format
    Relations changed for {USER_EMAIL} from {OLD_VALUE} to {NEW_VALUE}

    Change User Address

    Event details
    Event name
    CHANGE_USER_ADDRESS
    Parameters
    NEW_ VALUE

    string

    The new SETTING_NAME value that was set during this event.
    OLD_ VALUE

    string

    The previous SETTING_NAME value that was replaced during this event.
    USER_ EMAIL

    string

    The user's primary email address.
    Sample request
    GET https://admin.googleapis.com /admin /reports /v1 /activity /users /all /applications / admin ?eventName= CHANGE_USER_ADDRESS &maxResults=10 &access_token= YOUR_ACCESS_TOKEN
    Admin Console message format
    Addresses changed for {USER_EMAIL} from {OLD_VALUE} to {NEW_VALUE}

    Create an email monitor

    Event details
    Event name
    CREATE_EMAIL_MONITOR
    Parameters
    BEGIN_ DATE_ TIME

    string

    The start date and time for the email monitor.
    EMAIL_ MONITOR_ DEST_ EMAIL

    string

    The destination address of the email monitor.
    EMAIL_ MONITOR_ LEVEL_ CHAT

    string

    The chat email monitor level.
    EMAIL_ MONITOR_ LEVEL_ DRAFT_ EMAIL

    string

    The draft email monitor level.
    EMAIL_ MONITOR_ LEVEL_ INCOMING_ EMAIL

    string

    The incoming email monitor level.
    EMAIL_ MONITOR_ LEVEL_ OUTGOING_ EMAIL

    string

    The outgoing email monitor level.
    END_ DATE_ TIME

    string

    The end date and time for the email monitor.
    USER_ EMAIL

    string

    The user's primary email address.
    Sample request
    GET https://admin.googleapis.com /admin /reports /v1 /activity /users /all /applications / admin ?eventName= CREATE_EMAIL_MONITOR &maxResults=10 &access_token= YOUR_ACCESS_TOKEN
    Admin Console message format
    Created an email monitor for {USER_EMAIL} to {EMAIL_MONITOR_DEST_EMAIL} that will expire on {END_DATE_TIME}

    Data transfer request created

    Event details
    Event name
    CREATE_DATA_TRANSFER_REQUEST
    Parameters
    APPLICATION_ NAME

    string

    A comma-separated application names for which data transfer is requested.
    DESTINATION_ USER_ EMAIL

    string

    The new owner's primary user email to whom to transfer user data to.
    USER_ EMAIL

    string

    The user's primary email address.
    Sample request
    GET https://admin.googleapis.com /admin /reports /v1 /activity /users /all /applications / admin ?eventName= CREATE_DATA_TRANSFER_REQUEST &maxResults=10 &access_token= YOUR_ACCESS_TOKEN
    Admin Console message format
    Data transfer request created from {USER_EMAIL} to {DESTINATION_USER_EMAIL} for apps {APPLICATION_NAME}

    Delegated Admin Privileges Grant

    Event details
    Event name
    GRANT_DELEGATED_ADMIN_PRIVILEGES
    Parameters
    NEW_ VALUE

    string

    The new delegated admin privilege.
    USER_ EMAIL

    string

    The user's primary email address.
    Sample request
    GET https://admin.googleapis.com /admin /reports /v1 /activity /users /all /applications / admin ?eventName= GRANT_DELEGATED_ADMIN_PRIVILEGES &maxResults=10 &access_token= YOUR_ACCESS_TOKEN
    Admin Console message format
    {USER_EMAIL} assigned {NEW_VALUE} admin privileges
    Event details
    Event name
    DELETE_ACCOUNT_INFO_DUMP
    Parameters
    REQUEST_ ID

    string

    The request ID.
    USER_ EMAIL

    string

    The user's primary email address.
    Sample request
    GET https://admin.googleapis.com /admin /reports /v1 /activity /users /all /applications / admin ?eventName= DELETE_ACCOUNT_INFO_DUMP &maxResults=10 &access_token= YOUR_ACCESS_TOKEN
    Admin Console message format
    Deleted account and login information dump for {USER_EMAIL} and request ID {REQUEST_ID}

    Delete an email monitor

    Event details
    Event name
    DELETE_EMAIL_MONITOR
    Parameters
    EMAIL_ MONITOR_ DEST_ EMAIL

    string

    The destination address of the email monitor.
    USER_ EMAIL

    string

    The user's primary email address.
    Sample request
    GET https://admin.googleapis.com /admin /reports /v1 /activity /users /all /applications / admin ?eventName= DELETE_EMAIL_MONITOR &maxResults=10 &access_token= YOUR_ACCESS_TOKEN
    Admin Console message format
    Deleted an email monitor for {USER_EMAIL} to {EMAIL_MONITOR_DEST_EMAIL}

    Delete mailbox dump

    Event details
    Event name
    DELETE_MAILBOX_DUMP
    Parameters
    REQUEST_ ID

    string

    The request ID.
    USER_ EMAIL

    string

    The user's primary email address.
    Sample request
    GET https://admin.googleapis.com /admin /reports /v1 /activity /users /all /applications / admin ?eventName= DELETE_MAILBOX_DUMP &maxResults=10 &access_token= YOUR_ACCESS_TOKEN
    Admin Console message format
    Deleted mailbox dump for {USER_EMAIL} and request ID {REQUEST_ID}

    Delete Profile Photo

    Event details
    Event name
    DELETE_PROFILE_PHOTO
    Parameters
    USER_ EMAIL

    string

    The user's primary email address.

    Sample request
    GET https://admin.googleapis.com /admin /reports /v1 /activity /users /all /applications / admin ?eventName= DELETE_PROFILE_PHOTO &maxResults=10 &access_token= YOUR_ACCESS_TOKEN
    Admin Console message format
    Profile photo of {USER_EMAIL} has been deleted

    Display Name Added

    Event details
    Event name
    ADD_DISPLAY_NAME
    Parameters
    USER_ DISPLAY_ NAME

    string

    User display name.
    USER_ EMAIL

    string

    The user's primary email address.
    Sample request
    GET https://admin.googleapis.com /admin /reports /v1 /activity /users /all /applications / admin ?eventName= ADD_DISPLAY_NAME &maxResults=10 &access_token= YOUR_ACCESS_TOKEN
    Admin Console message format
    {USER_DISPLAY_NAME} added as a display name of {USER_EMAIL}

    Display Name Change

    Event details
    Event name
    CHANGE_DISPLAY_NAME
    Parameters
    NEW_ VALUE

    string

    The new SETTING_NAME value that was set during this event.
    OLD_ VALUE

    string

    The previous SETTING_NAME value that was replaced during this event.
    USER_ EMAIL

    string

    The user's primary email address.
    Sample request
    GET https://admin.googleapis.com /admin /reports /v1 /activity /users /all /applications / admin ?eventName= CHANGE_DISPLAY_NAME &maxResults=10 &access_token= YOUR_ACCESS_TOKEN
    Admin Console message format
    Display name of {USER_EMAIL} changed from {OLD_VALUE} to {NEW_VALUE}

    Display Name Removed

    Event details
    Event name
    REMOVE_DISPLAY_NAME
    Parameters
    USER_ DISPLAY_ NAME

    string

    User display name.
    USER_ EMAIL

    string

    The user's primary email address.
    Sample request
    GET https://admin.googleapis.com /admin /reports /v1 /activity /users /all /applications / admin ?eventName= REMOVE_DISPLAY_NAME &maxResults=10 &access_token= YOUR_ACCESS_TOKEN
    Admin Console message format
    {USER_DISPLAY_NAME} removed as a display name of {USER_EMAIL}

    First Name Change

    Event details
    Event name
    CHANGE_FIRST_NAME
    Parameters
    NEW_ VALUE

    string

    The user's new first name.
    OLD_ VALUE

    string

    The user's previous first name.
    USER_ EMAIL

    string

    The user's primary email address.
    Sample request
    GET https://admin.googleapis.com /admin /reports /v1 /activity /users /all /applications / admin ?eventName= CHANGE_FIRST_NAME &maxResults=10 &access_token= YOUR_ACCESS_TOKEN
    Admin Console message format
    First name of {USER_EMAIL} changed from {OLD_VALUE} to {NEW_VALUE}

    Gmail Account Reset

    Event details
    Event name
    GMAIL_RESET_USER
    Parameters
    GMAIL_ RESET_ REASON

    string

    Gmail's reason for resetting the account.
    USER_ EMAIL

    string

    The user's primary email address.
    Sample request
    GET https://admin.googleapis.com /admin /reports /v1 /activity /users /all /applications / admin ?eventName= GMAIL_RESET_USER &maxResults=10 &access_token= YOUR_ACCESS_TOKEN
    Admin Console message format
    Gmail account of {USER_EMAIL} reset

    Last Name Change

    Event details
    Event name
    CHANGE_LAST_NAME
    Parameters
    NEW_ VALUE

    string

    The user's new last name.
    OLD_ VALUE

    string

    The user's previous last name.
    USER_ EMAIL

    string

    The user's primary email address.
    Sample request
    GET https://admin.googleapis.com /admin /reports /v1 /activity /users /all /applications / admin ?eventName= CHANGE_LAST_NAME &maxResults=10 &access_token= YOUR_ACCESS_TOKEN
    Admin Console message format
    Last name of {USER_EMAIL} changed from {OLD_VALUE} to {NEW_VALUE}

    Mail Routing Destination Creation

    Event details
    Event name
    MAIL_ROUTING_DESTINATION_ADDED
    Parameters
    NEW_ VALUE

    string

    The new routing destination.
    USER_ EMAIL

    string

    The user's primary email address.
    Sample request
    GET https://admin.googleapis.com /admin /reports /v1 /activity /users /all /applications / admin ?eventName= MAIL_ROUTING_DESTINATION_ADDED &maxResults=10 &access_token= YOUR_ACCESS_TOKEN
    Admin Console message format
    User {USER_EMAIL} has received the following individual mail routing destination: {NEW_VALUE}

    Mail Routing Destination Deletion

    Event details
    Event name
    MAIL_ROUTING_DESTINATION_REMOVED
    Parameters
    OLD_ VALUE

    string

    The previous routing destination.
    USER_ EMAIL

    string

    The user's primary email address.
    Sample request
    GET https://admin.googleapis.com /admin /reports /v1 /activity /users /all /applications / admin ?eventName= MAIL_ROUTING_DESTINATION_REMOVED &maxResults=10 &access_token= YOUR_ACCESS_TOKEN
    Admin Console message format
    User {USER_EMAIL} has had the following individual mail routing destination removed: {OLD_VALUE}

    Nickname Creation

    Event details
    Event name
    ADD_NICKNAME
    Parameters
    USER_ EMAIL

    string

    The primary user email.
    USER_ NICKNAME

    string

    The user's nickname, also known as alternate email or alias. For Admin console information, see the administration help center .
    Sample request
    GET https://admin.googleapis.com /admin /reports /v1 /activity /users /all /applications / admin ?eventName= ADD_NICKNAME &maxResults=10 &access_token= YOUR_ACCESS_TOKEN
    Admin Console message format
    {USER_NICKNAME} created as a nickname of {USER_EMAIL}

    Nickname Deletion

    Event details
    Event name
    REMOVE_NICKNAME
    Parameters
    USER_ EMAIL

    string

    The user's primary email address.
    USER_ NICKNAME

    string

    The user's previous nickname.
    Sample request
    GET https://admin.googleapis.com /admin /reports /v1 /activity /users /all /applications / admin ?eventName= REMOVE_NICKNAME &maxResults=10 &access_token= YOUR_ACCESS_TOKEN
    Admin Console message format
    {USER_NICKNAME} deleted as a nickname of {USER_EMAIL}

    Passkey revoked

    Event details
    Event name
    PASSKEY_REVOKED
    Parameters
    enrollment_ type

    string

    Describers whether the passkey was enrolled by user or created automatically. Possible values:

    • automatically_created
      Passkey enrolled automatically on android device.
    • user_created
      Passkey enrolled by end user.
    passkey_ added_ from

    string

    Location from where the passkey was added.

    passkey_ added_ on_ timestamp

    integer

    Timestamp when the passkey was added.

    passkey_ last_ used_ from

    string

    Location from where was the passkey last used.

    passkey_ last_ used_ timestamp

    integer

    Timestamp when the passkey was last used.

    platform_ or_ device

    string

    Platform or device used for creating the passkey. Possible values:

    • apple_icloud_keychain
      Passkey created using apple icloud keychain.
    • bitwarden
      Passkey created using bitwarden.
    • chrome_on_mac
      Passkey created using chrome on mac.
    • chrome_os
      Passkey created using chrome os.
    • dashlane
      Passkey created using dashlane.
    • edge_on_mac
      Passkey created using Edge on Mac.
    • generic_passkey
      Passkey type generic passkey description.
    • generic_usb_key
      Passkey created using FIDO2 security key.
    • generic_usb_up_key
      Passkey created using security key.
    • google_account_passkey_on_android
      Passkey created using android device.
    • google_password_manager
      Passkey created using google password manager.
    • keeper
      Passkey created using keeper.
    • nordpass
      Passkey created using nordpass.
    • one_password
      Passkey created using 1Password.
    • samsung_pass
      Passkey created using Samsung pass.
    • titan_key
      Passkey created using titan security key.
    • windows_hello
      Passkey created using windows hello.
    • yubikey
      Passkey created using yubico security key.
    supports_ passwordless

    boolean

    Whether the passkey can be used to skip password.

    USER_ EMAIL

    string

    The user's primary email address.

    Sample request
    GET https://admin.googleapis.com /admin /reports /v1 /activity /users /all /applications / admin ?eventName= PASSKEY_REVOKED &maxResults=10 &access_token= YOUR_ACCESS_TOKEN
    Admin Console message format
    A passkey enrolled for user {USER_EMAIL} was revoked

    Password Change

    Event details
    Event name
    CHANGE_PASSWORD
    Parameters
    USER_ EMAIL

    string

    The user's primary email address.

    Sample request
    GET https://admin.googleapis.com /admin /reports /v1 /activity /users /all /applications / admin ?eventName= CHANGE_PASSWORD &maxResults=10 &access_token= YOUR_ACCESS_TOKEN
    Admin Console message format
    Password changed for {USER_EMAIL}
    Event details
    Event name
    CHANGE_PASSWORD_ON_NEXT_LOGIN
    Parameters
    NEW_ VALUE

    string

    Indicates whether the user must change their password on their next login; can be true or false .
    OLD_ VALUE

    string

    The previous setting value; can be true or false .
    USER_ EMAIL

    string

    The user's primary email address.
    Sample request
    GET https://admin.googleapis.com /admin /reports /v1 /activity /users /all /applications / admin ?eventName= CHANGE_PASSWORD_ON_NEXT_LOGIN &maxResults=10 &access_token= YOUR_ACCESS_TOKEN
    Admin Console message format
    Password change requirement for {USER_EMAIL} on next login changed from {OLD_VALUE} to {NEW_VALUE}

    Pending Invites List Download

    Event details
    Event name DOWNLOAD_PENDING_INVITES_LIST
    Sample request
    GET https://admin.googleapis.com /admin /reports /v1 /activity /users /all /applications / admin ?eventName= DOWNLOAD_PENDING_INVITES_LIST &maxResults=10 &access_token= YOUR_ACCESS_TOKEN
    Admin Console message format
    Pending Invites List was downloaded as a CSV file

    Public Key Certificate Status Updated

    Event details
    Event name
    UPDATE_PUBLIC_KEY_CERTIFICATE_STATUS
    Parameters
    PUBLIC_ KEY_ CERTIFICATE_ STATUS

    string

    Public key certificate status.
    USER_ EMAIL

    string

    The user's primary email address.
    USER_ IMPACTED_ EMAIL

    string

    User impacted email.
    Sample request
    GET https://admin.googleapis.com /admin /reports /v1 /activity /users /all /applications / admin ?eventName= UPDATE_PUBLIC_KEY_CERTIFICATE_STATUS &maxResults=10 &access_token= YOUR_ACCESS_TOKEN
    Admin Console message format
    Public key certificate status updated to {PUBLIC_KEY_CERTIFICATE_STATUS} for email {USER_IMPACTED_EMAIL} of user {USER_EMAIL}

    Public Key Certificate Updated

    Event details
    Event name
    UPDATE_PUBLIC_KEY_CERTIFICATE
    Parameters
    USER_ EMAIL

    string

    The user's primary email address.
    USER_ IMPACTED_ EMAIL

    string

    User impacted email.
    Sample request
    GET https://admin.googleapis.com /admin /reports /v1 /activity /users /all /applications / admin ?eventName= UPDATE_PUBLIC_KEY_CERTIFICATE &maxResults=10 &access_token= YOUR_ACCESS_TOKEN
    Admin Console message format
    Public key certificate updated for {USER_DISPLAY_NAME} email {USER_EMAIL}

    Remove Recovery Email

    Event details
    Event name
    REMOVE_RECOVERY_EMAIL
    Parameters
    USER_ EMAIL

    string

    The user's primary email address.

    Sample request
    GET https://admin.googleapis.com /admin /reports /v1 /activity /users /all /applications / admin ?eventName= REMOVE_RECOVERY_EMAIL &maxResults=10 &access_token= YOUR_ACCESS_TOKEN
    Admin Console message format
    Recovery email removed for {USER_EMAIL}

    Remove Recovery Phone

    Event details
    Event name
    REMOVE_RECOVERY_PHONE
    Parameters
    USER_ EMAIL

    string

    The user's primary email address.

    Sample request
    GET https://admin.googleapis.com /admin /reports /v1 /activity /users /all /applications / admin ?eventName= REMOVE_RECOVERY_PHONE &maxResults=10 &access_token= YOUR_ACCESS_TOKEN
    Admin Console message format
    Recovery phone removed for {USER_EMAIL}
    Event details
    Event name
    REQUEST_ACCOUNT_INFO
    Parameters
    USER_ EMAIL

    string

    The user's primary email address.

    Sample request
    GET https://admin.googleapis.com /admin /reports /v1 /activity /users /all /applications / admin ?eventName= REQUEST_ACCOUNT_INFO &maxResults=10 &access_token= YOUR_ACCESS_TOKEN
    Admin Console message format
    Requested account and login information for {USER_EMAIL}

    Request mailbox dump

    Event details
    Event name
    REQUEST_MAILBOX_DUMP
    Parameters
    BEGIN_ DATE_ TIME

    string

    The start date and time for the email monitor.
    EMAIL_ EXPORT_ INCLUDE_ DELETED

    string

    Indicates if deleted emails are included in the export.
    EMAIL_ EXPORT_ PACKAGE_ CONTENT

    string

    The contents of the mailbox package.
    END_ DATE_ TIME

    string

    The end date and time for the email monitor.
    SEARCH_ QUERY_ FOR_ DUMP

    string

    The search query used for the dump.
    USER_ EMAIL

    string

    The user's primary email address.
    Sample request
    GET https://admin.googleapis.com /admin /reports /v1 /activity /users /all /applications / admin ?eventName= REQUEST_MAILBOX_DUMP &maxResults=10 &access_token= YOUR_ACCESS_TOKEN
    Admin Console message format
    Requested mailbox dump for {USER_EMAIL}

    Resend User Invite

    Event details
    Event name
    RESEND_USER_INVITE
    Parameters
    DOMAIN_ NAME

    string

    The primary domain name.
    USER_ EMAIL

    string

    The user's primary email address.
    Sample request
    GET https://admin.googleapis.com /admin /reports /v1 /activity /users /all /applications / admin ?eventName= RESEND_USER_INVITE &maxResults=10 &access_token= YOUR_ACCESS_TOKEN
    Admin Console message format
    Invite email to {USER_EMAIL} resent
    Event details
    Event name
    RESET_SIGNIN_COOKIES
    Parameters
    USER_ EMAIL

    string

    The user's primary email address.

    Sample request
    GET https://admin.googleapis.com /admin /reports /v1 /activity /users /all /applications / admin ?eventName= RESET_SIGNIN_COOKIES &maxResults=10 &access_token= YOUR_ACCESS_TOKEN
    Admin Console message format
    Cookies reset for {USER_EMAIL} and forced re-login

    Security Key Registered For User

    Event details
    Event name
    SECURITY_KEY_REGISTERED_FOR_USER
    Parameters
    USER_ EMAIL

    string

    The user's primary email address.

    Sample request
    GET https://admin.googleapis.com /admin /reports /v1 /activity /users /all /applications / admin ?eventName= SECURITY_KEY_REGISTERED_FOR_USER &maxResults=10 &access_token= YOUR_ACCESS_TOKEN
    Admin Console message format
    Security key registered for {USER_EMAIL}

    Security Key Revoke

    Event details
    Event name
    REVOKE_SECURITY_KEY
    Parameters
    enrollment_ type

    string

    Describers whether the passkey was enrolled by user or created automatically. Possible values:

    • automatically_created
      Passkey enrolled automatically on android device.
    • user_created
      Passkey enrolled by end user.
    passkey_ added_ from

    string

    Location from where the passkey was added.

    passkey_ added_ on_ timestamp

    integer

    Timestamp when the passkey was added.

    passkey_ last_ used_ from

    string

    Location from where was the passkey last used.

    passkey_ last_ used_ timestamp

    integer

    Timestamp when the passkey was last used.

    platform_ or_ device

    string

    Platform or device used for creating the passkey. Possible values:

    • apple_icloud_keychain
      Passkey created using apple icloud keychain.
    • bitwarden
      Passkey created using bitwarden.
    • chrome_on_mac
      Passkey created using chrome on mac.
    • chrome_os
      Passkey created using chrome os.
    • dashlane
      Passkey created using dashlane.
    • edge_on_mac
      Passkey created using Edge on Mac.
    • generic_passkey
      Passkey type generic passkey description.
    • generic_usb_key
      Passkey created using FIDO2 security key.
    • generic_usb_up_key
      Passkey created using security key.
    • google_account_passkey_on_android
      Passkey created using android device.
    • google_password_manager
      Passkey created using google password manager.
    • keeper
      Passkey created using keeper.
    • nordpass
      Passkey created using nordpass.
    • one_password
      Passkey created using 1Password.
    • samsung_pass
      Passkey created using Samsung pass.
    • titan_key
      Passkey created using titan security key.
    • windows_hello
      Passkey created using windows hello.
    • yubikey
      Passkey created using yubico security key.
    supports_ passwordless

    boolean

    Whether the passkey can be used to skip password.

    USER_ EMAIL

    string

    The user's primary email address.

    Sample request
    GET https://admin.googleapis.com /admin /reports /v1 /activity /users /all /applications / admin ?eventName= REVOKE_SECURITY_KEY &maxResults=10 &access_token= YOUR_ACCESS_TOKEN
    Admin Console message format
    A security key enrolled for user {USER_EMAIL} for 2-step verification was revoked

    Send User Invite

    Event details
    Event name
    USER_INVITE
    Parameters
    DOMAIN_ NAME

    string

    The primary domain name.
    USER_ EMAIL

    string

    The user's primary email address.
    Sample request
    GET https://admin.googleapis.com /admin /reports /v1 /activity /users /all /applications / admin ?eventName= USER_INVITE &maxResults=10 &access_token= YOUR_ACCESS_TOKEN
    Admin Console message format
    {USER_EMAIL} invited to join your organization

    Temporary Password Viewed

    Event details
    Event name
    VIEW_TEMP_PASSWORD
    Parameters
    DOMAIN_ NAME

    string

    The primary domain name.
    USER_ EMAIL

    string

    The user's primary email address.
    Sample request
    GET https://admin.googleapis.com /admin /reports /v1 /activity /users /all /applications / admin ?eventName= VIEW_TEMP_PASSWORD &maxResults=10 &access_token= YOUR_ACCESS_TOKEN
    Admin Console message format
    Temporary password for user {USER_EMAIL} viewed by the admin

    Turn off 2-step verification

    Event details
    Event name
    TURN_OFF_2_STEP_VERIFICATION
    Parameters
    USER_ EMAIL

    string

    The user's primary email address.

    Sample request
    GET https://admin.googleapis.com /admin /reports /v1 /activity /users /all /applications / admin ?eventName= TURN_OFF_2_STEP_VERIFICATION &maxResults=10 &access_token= YOUR_ACCESS_TOKEN
    Admin Console message format
    2-step verification has been turned off for the user {USER_EMAIL}

    Unblock User Session

    Event details
    Event name
    UNBLOCK_USER_SESSION
    Parameters
    USER_ EMAIL

    string

    The user's primary email address.

    Sample request
    GET https://admin.googleapis.com /admin /reports /v1 /activity /users /all /applications / admin ?eventName= UNBLOCK_USER_SESSION &maxResults=10 &access_token= YOUR_ACCESS_TOKEN
    Admin Console message format
    User {USER_EMAIL} unblocked by temporarily disabling login challenge

    Unmanaged Users Bulk Upload

    Event details
    Event name
    UNMANAGED_USERS_BULK_UPLOAD
    Parameters
    BULK_ UPLOAD_ FAIL_ USERS_ NUMBER

    string

    Bulk Upload Failed Users Number.
    BULK_ UPLOAD_ TOTAL_ USERS_ NUMBER

    string

    Bulk Upload Total Users Number.
    Sample request
    GET https://admin.googleapis.com /admin /reports /v1 /activity /users /all /applications / admin ?eventName= UNMANAGED_USERS_BULK_UPLOAD &maxResults=10 &access_token= YOUR_ACCESS_TOKEN
    Admin Console message format
    A total of {BULK_UPLOAD_TOTAL_USERS_NUMBER} unmanaged users selected for upload. {BULK_UPLOAD_FAIL_USERS_NUMBER} out of {BULK_UPLOAD_TOTAL_USERS_NUMBER} users failed to be uploaded.

    Unmanaged Users List Download

    Event details
    Event name DOWNLOAD_UNMANAGED_USERS_LIST
    Sample request
    GET https://admin.googleapis.com /admin /reports /v1 /activity /users /all /applications / admin ?eventName= DOWNLOAD_UNMANAGED_USERS_LIST &maxResults=10 &access_token= YOUR_ACCESS_TOKEN
    Admin Console message format
    Unmanaged Users list was downloaded as a CSV file

    Update Profile Photo

    Event details
    Event name
    UPDATE_PROFILE_PHOTO
    Parameters
    USER_ EMAIL

    string

    The user's primary email address.

    Sample request
    GET https://admin.googleapis.com /admin /reports /v1 /activity /users /all /applications / admin ?eventName= UPDATE_PROFILE_PHOTO &maxResults=10 &access_token= YOUR_ACCESS_TOKEN
    Admin Console message format
    Profile photo of {USER_EMAIL} has been updated

    User Advanced Protection Unenroll

    Event details
    Event name
    UNENROLL_USER_FROM_TITANIUM
    Parameters
    USER_ EMAIL

    string

    The user's primary email address.

    Sample request
    GET https://admin.googleapis.com /admin /reports /v1 /activity /users /all /applications / admin ?eventName= UNENROLL_USER_FROM_TITANIUM &maxResults=10 &access_token= YOUR_ACCESS_TOKEN
    Admin Console message format
    User {USER_EMAIL} unenrolled from Advanced Protection

    User Archival

    Event details
    Event name
    ARCHIVE_USER
    Parameters
    USER_ EMAIL

    string

    The user's primary email address.

    Sample request
    GET https://admin.googleapis.com /admin /reports /v1 /activity /users /all /applications / admin ?eventName= ARCHIVE_USER &maxResults=10 &access_token= YOUR_ACCESS_TOKEN
    Admin Console message format
    {USER_EMAIL} archived

    User BirthDate Change

    Event details
    Event name
    UPDATE_BIRTHDATE
    Parameters
    BIRTHDATE

    string

    The date of the user's birthday.
    USER_ EMAIL

    string

    The user's primary email address.
    Sample request
    GET https://admin.googleapis.com /admin /reports /v1 /activity /users /all /applications / admin ?eventName= UPDATE_BIRTHDATE &maxResults=10 &access_token= YOUR_ACCESS_TOKEN
    Admin Console message format
    The birth date for {USER_EMAIL} changed to {BIRTHDATE}

    User created passkey revoked

    Event details
    Event name
    USER_CREATED_PASSKEY_REVOKE
    Parameters
    USER_ EMAIL

    string

    The user's primary email address.

    Sample request
    GET https://admin.googleapis.com /admin /reports /v1 /activity /users /all /applications / admin ?eventName= USER_CREATED_PASSKEY_REVOKE &maxResults=10 &access_token= YOUR_ACCESS_TOKEN
    Admin Console message format
    A user created passkey enrolled for user {USER_EMAIL} was revoked

    User Creation

    Event details
    Event name
    CREATE_USER
    Parameters
    USER_ EMAIL

    string

    The new user's primary user email.

    Sample request
    GET https://admin.googleapis.com /admin /reports /v1 /activity /users /all /applications / admin ?eventName= CREATE_USER &maxResults=10 &access_token= YOUR_ACCESS_TOKEN
    Admin Console message format
    {USER_EMAIL} created

    User Deletion

    Event details
    Event name
    DELETE_USER
    Parameters
    USER_ EMAIL

    string

    The deleted user's primary user email.

    Sample request
    GET https://admin.googleapis.com /admin /reports /v1 /activity /users /all /applications / admin ?eventName= DELETE_USER &maxResults=10 &access_token= YOUR_ACCESS_TOKEN
    Admin Console message format
    {USER_EMAIL} deleted

    User Downgrade From Google+

    Event details
    Event name
    DOWNGRADE_USER_FROM_GPLUS
    Parameters
    USER_ EMAIL

    string

    The user's primary email address.

    Sample request
    GET https://admin.googleapis.com /admin /reports /v1 /activity /users /all /applications / admin ?eventName= DOWNGRADE_USER_FROM_GPLUS &maxResults=10 &access_token= YOUR_ACCESS_TOKEN
    Admin Console message format
    {USER_EMAIL} was downgraded from Google+

    User Enrolled In 2-Step Verification

    Event details
    Event name
    USER_ENROLLED_IN_TWO_STEP_VERIFICATION
    Parameters
    USER_ EMAIL

    string

    The user's primary email address.

    Sample request
    GET https://admin.googleapis.com /admin /reports /v1 /activity /users /all /applications / admin ?eventName= USER_ENROLLED_IN_TWO_STEP_VERIFICATION &maxResults=10 &access_token= YOUR_ACCESS_TOKEN
    Admin Console message format
    {USER_EMAIL} enrolled in 2-step verification

    User List Download

    Event details
    Event name DOWNLOAD_USERLIST_CSV
    Sample request
    GET https://admin.googleapis.com /admin /reports /v1 /activity /users /all /applications / admin ?eventName= DOWNLOAD_USERLIST_CSV &maxResults=10 &access_token= YOUR_ACCESS_TOKEN
    Admin Console message format
    User list was downloaded as a CSV file

    User List Download

    Event details
    Event name
    DOWNLOAD_USERLIST
    Parameters
    FORMAT

    string

    Format.

    Sample request
    GET https://admin.googleapis.com /admin /reports /v1 /activity /users /all /applications / admin ?eventName= DOWNLOAD_USERLIST &maxResults=10 &access_token= YOUR_ACCESS_TOKEN
    Admin Console message format
    User list was downloaded in {FORMAT}

    User OrgUnit Change

    Event details
    Event name
    MOVE_USER_TO_ORG_UNIT
    Parameters
    NEW_ VALUE

    string

    The user's new organizational unit.
    ORG_ UNIT_ NAME

    string

    The organizational unit (OU) name (path).
    USER_ EMAIL

    string

    The user's primary email address.
    Sample request
    GET https://admin.googleapis.com /admin /reports /v1 /activity /users /all /applications / admin ?eventName= MOVE_USER_TO_ORG_UNIT &maxResults=10 &access_token= YOUR_ACCESS_TOKEN
    Admin Console message format
    {USER_EMAIL} moved from {ORG_UNIT_NAME} to {NEW_VALUE}

    User Put In 2-Step Verification Grace Period

    Event details
    Event name
    USER_PUT_IN_TWO_STEP_VERIFICATION_GRACE_PERIOD
    Parameters
    NEW_ VALUE

    string

    The new SETTING_NAME value that was set during this event.
    USER_ EMAIL

    string

    The user's primary email address.
    Sample request
    GET https://admin.googleapis.com /admin /reports /v1 /activity /users /all /applications / admin ?eventName= USER_PUT_IN_TWO_STEP_VERIFICATION_GRACE_PERIOD &maxResults=10 &access_token= YOUR_ACCESS_TOKEN
    Admin Console message format
    2-step verification grace period has been enabled on {USER_EMAIL} till {NEW_VALUE}

    User Rename

    Event details
    Event name
    RENAME_USER
    Parameters
    NEW_ VALUE

    string

    The user's new name.
    USER_ EMAIL

    string

    The user's primary email address.
    Sample request
    GET https://admin.googleapis.com /admin /reports /v1 /activity /users /all /applications / admin ?eventName= RENAME_USER &maxResults=10 &access_token= YOUR_ACCESS_TOKEN
    Admin Console message format
    {USER_EMAIL} renamed to {NEW_VALUE}

    User Strong Auth Unenroll

    Event details
    Event name
    UNENROLL_USER_FROM_STRONG_AUTH
    Parameters
    USER_ EMAIL

    string

    The user's primary email address.

    Sample request
    GET https://admin.googleapis.com /admin /reports /v1 /activity /users /all /applications / admin ?eventName= UNENROLL_USER_FROM_STRONG_AUTH &maxResults=10 &access_token= YOUR_ACCESS_TOKEN
    Admin Console message format
    User {USER_EMAIL} unenrolled from Strong Auth

    User Suspension

    Event details
    Event name
    SUSPEND_USER
    Parameters
    USER_ EMAIL

    string

    The user's primary email address.

    Sample request
    GET https://admin.googleapis.com /admin /reports /v1 /activity /users /all /applications / admin ?eventName= SUSPEND_USER &maxResults=10 &access_token= YOUR_ACCESS_TOKEN
    Admin Console message format
    {USER_EMAIL} suspended

    User Unarchival

    Event details
    Event name
    UNARCHIVE_USER
    Parameters
    USER_ EMAIL

    string

    The user's primary email address.

    Sample request
    GET https://admin.googleapis.com /admin /reports /v1 /activity /users /all /applications / admin ?eventName= UNARCHIVE_USER &maxResults=10 &access_token= YOUR_ACCESS_TOKEN
    Admin Console message format
    {USER_EMAIL} unarchived

    User Undeletion

    Event details
    Event name
    UNDELETE_USER
    Parameters
    USER_ EMAIL

    string

    The user's primary email address.

    Sample request
    GET https://admin.googleapis.com /admin /reports /v1 /activity /users /all /applications / admin ?eventName= UNDELETE_USER &maxResults=10 &access_token= YOUR_ACCESS_TOKEN
    Admin Console message format
    {USER_EMAIL} undeleted

    User Unsuspension

    Event details
    Event name
    UNSUSPEND_USER
    Parameters
    USER_ EMAIL

    string

    The user's primary email address.

    Sample request
    GET https://admin.googleapis.com /admin /reports /v1 /activity /users /all /applications / admin ?eventName= UNSUSPEND_USER &maxResults=10 &access_token= YOUR_ACCESS_TOKEN
    Admin Console message format
    {USER_EMAIL} unsuspended

    User Upgrade To Google+

    Event details
    Event name
    UPGRADE_USER_TO_GPLUS
    Parameters
    USER_ EMAIL

    string

    The user's primary email address.

    Sample request
    GET https://admin.googleapis.com /admin /reports /v1 /activity /users /all /applications / admin ?eventName= UPGRADE_USER_TO_GPLUS &maxResults=10 &access_token= YOUR_ACCESS_TOKEN
    Admin Console message format
    {USER_EMAIL} was upgraded to Google+

    Users Bulk Upload

    Event details
    Event name
    USERS_BULK_UPLOAD
    Parameters
    BULK_ UPLOAD_ FAIL_ USERS_ NUMBER

    string

    The number of failures when attemping to bulk upload users.
    BULK_ UPLOAD_ TOTAL_ USERS_ NUMBER

    string

    The total number of bulk uploaded users.
    Sample request
    GET https://admin.googleapis.com /admin /reports /v1 /activity /users /all /applications / admin ?eventName= USERS_BULK_UPLOAD &maxResults=10 &access_token= YOUR_ACCESS_TOKEN
    Admin Console message format
    A total of {BULK_UPLOAD_TOTAL_USERS_NUMBER} users selected for upload. {BULK_UPLOAD_FAIL_USERS_NUMBER} out of {BULK_UPLOAD_TOTAL_USERS_NUMBER} users failed to be uploaded.

    Users Bulk Upload Notification

    Event details
    Event name
    USERS_BULK_UPLOAD_NOTIFICATION_SENT
    Parameters
    USER_ EMAIL

    string

    The user's primary email address.

    Sample request
    GET https://admin.googleapis.com /admin /reports /v1 /activity /users /all /applications / admin ?eventName= USERS_BULK_UPLOAD_NOTIFICATION_SENT &maxResults=10 &access_token= YOUR_ACCESS_TOKEN
    Admin Console message format
    Notification of bulk users upload sent to {USER_EMAIL}
    Create a Mobile Website
    View Site in Mobile | Classic
    Share by: