Device Audit Activity Events

    This document lists the events and parameters for various types of Device Audit activity events. You can retrieve these events by calling Activities.list() with applicationName=mobile .

    Device Applications

    Device applications events in Mobile device. Events of this type are returned with type=device_applications .

    Device application change

    Event details
    Event name
    APPLICATION_EVENT
    Parameters
    APK_ SHA256_ HASH

    string

    Parameter to indicate the SHA-256 hash of an application.

    APPLICATION_ ID

    string

    Parameter to indicate the Application Id.

    APPLICATION_ STATE

    string

    Parameter to indicate the application install/uninstall/update done on device. Possible values:

    • INSTALLED
      Application install event.
    • NOT_PHA
      Potentially harmful application not flagged event.
    • PHA
      Potentially harmful application detection event.
    • UNINSTALLED
      Application uninstall event.
    • UPDATED
      Application version update event.
    DEVICE_ ID

    string

    Parameter to indicate the Device Id.

    DEVICE_ MODEL

    string

    Parameter to indicate the device model.

    DEVICE_ TYPE

    string

    Parameter to indicate the device type. Possible values:

    • ANDROID
      Android.
    • ASSISTANT
      Assistant.
    • DESKTOP_CHROME
      Desktop Chrome.
    • iOS
      iOS.
    • LINUX
      Linux.
    • MAC
      Mac.
    • WINDOWS
      Windows.
    IOS_ VENDOR_ ID

    string

    Parameter to indicate the iOS Vendor Id.

    NEW_ VALUE

    string

    Parameter to indicate the new value.

    PHA_ CATEGORY

    string

    Potentially harmful app category reported by SafetyNet. Possible values:

    • BACKDOOR
      EnumParameter to indicate that application package potentially contains a backdoor.
    • CALL_FRAUD
      EnumParameter to indicate that application package potentially contains call fraud.
    • DATA_COLLECTION
      EnumParameter to indicate that application package potentially contains data collection capabilities.
    • DENIAL_OF_SERVICE
      EnumParameter to indicate that application package potentially contains denial of service logic.
    • FRAUDWARE
      EnumParameter to indicate that application package is potentially fraudware.
    • GENERIC_MALWARE
      EnumParameter to indicate that application package is potentially malware.
    • HARMFUL_SITE
      EnumParameter to indicate that application package potentially contains harmful sites.
    • HOSTILE_DOWNLOADER
      EnumParameter to indicate that application package is potentially a hostile downloader.
    • NON_ANDROID_THREAT
      EnumParameter to indicate that application package potentially contains threats to non-Android systems.
    • PHISHING
      EnumParameter to indicate that application package potentially contains phishing.
    • PRIVILEGE_ESCALATION
      EnumParameter to indicate that application package potentially contains privilege escalation capabilities.
    • RANSOMWARE
      EnumParameter to indicate that application package is potentially ransomware.
    • ROOTING
      EnumParameter to indicate that application package potentially contains rooting capabilities.
    • SPAM
      EnumParameter to indicate that application package potentially contains spam.
    • SPYWARE
      EnumParameter to indicate that application package is potentially spyware.
    • TOLL_FRAUD
      EnumParameter to indicate that application package potentially contains toll fraud.
    • TRACKING
      EnumParameter to indicate that application package potentially contains tracking logic.
    • TROJAN
      EnumParameter to indicate that application package potentially contains a trojan.
    • UNCOMMON
      EnumParameter to indicate that application package is uncommon.
    • WAP_FRAUD
      EnumParameter to indicate that application package potentially contains WAP fraud.
    • WINDOWS_MALWARE
      EnumParameter to indicate that application package potentially contains windows malware.
    RESOURCE_ ID

    string

    Parameter to indicate the unique resource id of a device.

    SECURITY_ EVENT_ ID

    integer

    Security event id.

    SERIAL_ NUMBER

    string

    Parameter to indicate the Serial number.

    USER_ EMAIL

    string

    Parameter to indicate the User email.

    Sample request
    GET https://admin.googleapis.com /admin /reports /v1 /activity /users /all /applications / mobile ?eventName= APPLICATION_EVENT &maxResults=10 &access_token= YOUR_ACCESS_TOKEN
    Admin Console message format
    {APPLICATION_ID} version {NEW_VALUE} was {APPLICATION_STATE} {actor} 's {DEVICE_MODEL}

    Device application report

    Event details
    Event name
    APPLICATION_REPORT_EVENT
    Parameters
    APPLICATION_ ID

    string

    Parameter to indicate the Application Id.

    APPLICATION_ MESSAGE

    string

    Parameter to indicate the message sent by an application report.

    APPLICATION_ REPORT_ KEY

    string

    Parameter to indicate the key of an application message.

    APPLICATION_ REPORT_ SEVERITY

    string

    Parameter to indicate the severity of a report. Possible values:

    • ERROR
      EnumParameter to indicate the application report severity is error.
    • INFO
      EnumParameter to indicate the application report severity is informational.
    • UNKNOWN
      EnumParameter to indicate the application report severity is unknown.
    APPLICATION_ REPORT_ TIMESTAMP

    integer

    Parameter to indicate the timestamp of a report.

    DEVICE_ APP_ COMPLIANCE

    string

    Parameter to indicate the managed app compliance state with managed application configurations. Possible values:

    • COMPLIANT
      Compliant devices.
    • NON_COMPLIANT
      Non-compliant devices.
    DEVICE_ ID

    string

    Parameter to indicate the Device Id.

    DEVICE_ MODEL

    string

    Parameter to indicate the device model.

    DEVICE_ TYPE

    string

    Parameter to indicate the device type. Possible values:

    • ANDROID
      Android.
    • ASSISTANT
      Assistant.
    • DESKTOP_CHROME
      Desktop Chrome.
    • iOS
      iOS.
    • LINUX
      Linux.
    • MAC
      Mac.
    • WINDOWS
      Windows.
    RESOURCE_ ID

    string

    Parameter to indicate the unique resource id of a device.

    SERIAL_ NUMBER

    string

    Parameter to indicate the Serial number.

    USER_ EMAIL

    string

    Parameter to indicate the User email.

    Sample request
    GET https://admin.googleapis.com /admin /reports /v1 /activity /users /all /applications / mobile ?eventName= APPLICATION_REPORT_EVENT &maxResults=10 &access_token= YOUR_ACCESS_TOKEN
    Admin Console message format
    {APPLICATION_ID} reported a status of severity: {APPLICATION_REPORT_SEVERITY} for application key: {APPLICATION_REPORT_KEY} with the message:' {APPLICATION_MESSAGE} '

    Device Updates

    Device update events in Mobile device. Events of this type are returned with type=device_updates .

    Account registration change

    Event details
    Event name
    DEVICE_REGISTER_UNREGISTER_EVENT
    Parameters
    ACCOUNT_ STATE

    string

    Parameter to indicate the account state on the device, eg: registered/unregistered. Possible values:

    • REGISTERED
      Register type event.
    • UNREGISTERED
      Unregister type event.
    BASIC_ INTEGRITY

    string

    Parameter to indicate whether the device passes the basic integrity check.

    CTS_ PROFILE_ MATCH

    string

    Parameter to indicate whether the device passes the CTS profile match.

    DEVICE_ ID

    string

    Parameter to indicate the Device Id.

    DEVICE_ MODEL

    string

    Parameter to indicate the device model.

    DEVICE_ TYPE

    string

    Parameter to indicate the device type. Possible values:

    • ANDROID
      Android.
    • ASSISTANT
      Assistant.
    • DESKTOP_CHROME
      Desktop Chrome.
    • iOS
      iOS.
    • LINUX
      Linux.
    • MAC
      Mac.
    • WINDOWS
      Windows.
    IOS_ VENDOR_ ID

    string

    Parameter to indicate the iOS Vendor Id.

    OS_ VERSION

    string

    Parameter to indicate the OS version.

    REGISTER_ PRIVILEGE

    string

    Parameter to indicate Device Policy app's privilege on the user's device. Possible values:

    • DEVICE_ADMINISTRATOR
      Device administrator privilege.
    • DEVICE_OWNER
      Device owner privilege.
    • PROFILE_OWNER
      Work profile privilege.
    RESOURCE_ ID

    string

    Parameter to indicate the unique resource id of a device.

    SECURITY_ PATCH_ LEVEL

    string

    Parameter to indicate the security patch Level.

    SERIAL_ NUMBER

    string

    Parameter to indicate the Serial number.

    USER_ EMAIL

    string

    Parameter to indicate the User email.

    Sample request
    GET https://admin.googleapis.com /admin /reports /v1 /activity /users /all /applications / mobile ?eventName= DEVICE_REGISTER_UNREGISTER_EVENT &maxResults=10 &access_token= YOUR_ACCESS_TOKEN
    Admin Console message format
    {actor} 's account {ACCOUNT_STATE} {DEVICE_MODEL} {REGISTER_PRIVILEGE}

    Advanced Policy Sync event

    Advanced Policy Sync events.

    Event details
    Event name
    ADVANCED_POLICY_SYNC_EVENT
    Parameters
    DEVICE_ ID

    string

    Parameter to indicate the Device Id.

    DEVICE_ MODEL

    string

    Parameter to indicate the device model.

    DEVICE_ TYPE

    string

    Parameter to indicate the device type. Possible values:

    • ANDROID
      Android.
    • ASSISTANT
      Assistant.
    • DESKTOP_CHROME
      Desktop Chrome.
    • iOS
      iOS.
    • LINUX
      Linux.
    • MAC
      Mac.
    • WINDOWS
      Windows.
    NEW_ VALUE

    string

    Parameter to indicate the new value.

    OS_ EDITION

    string

    Parameter to indicate the Windows OS edition.

    OS_ VERSION

    string

    Parameter to indicate the OS version.

    POLICY_ NAME

    string

    Parameter to indicate the policy name.

    POLICY_ SYNC_ RESULT

    string

    Parameter to indicate the policy status. Possible values:

    • POLICY_SYNC_ABORTED
      EnumParameter to indicate that policy sync is aborted.
    • POLICY_SYNC_FAILED
      EnumParameter to indicate that policy sync is failed.
    • POLICY_SYNC_SUCCEEDED
      EnumParameter to indicate that policy sync is successful.
    POLICY_ SYNC_ TYPE

    string

    Parameter to indicate the policy sync type. Possible values:

    • POLICY_APPLIED_TYPE
      EnumParameter to indicate that policy is applied.
    • POLICY_REMOVED_TYPE
      EnumParameter to indicate that policy is removed.
    RESOURCE_ ID

    string

    Parameter to indicate the unique resource id of a device.

    SERIAL_ NUMBER

    string

    Parameter to indicate the Serial number.

    USER_ EMAIL

    string

    Parameter to indicate the User email.

    VALUE

    string

    Parameter to indicate the value of a field.

    WINDOWS_ SYNCML_ POLICY_ STATUS_ CODE

    string

    Parameter to indicate the policy status code.

    Sample request
    GET https://admin.googleapis.com /admin /reports /v1 /activity /users /all /applications / mobile ?eventName= ADVANCED_POLICY_SYNC_EVENT &maxResults=10 &access_token= YOUR_ACCESS_TOKEN
    Admin Console message format
    {POLICY_SYNC_TYPE} {POLICY_NAME} {NEW_VALUE} {VALUE} {DEVICE_TYPE} policy {POLICY_SYNC_RESULT} on {actor} 's {DEVICE_MODEL} with serial id {SERIAL_NUMBER}

    Device Action event

    Device Action events.

    Event details
    Event name
    DEVICE_ACTION_EVENT
    Parameters
    ACTION_ EXECUTION_ STATUS

    string

    The execution status of an action. Possible values:

    • ACTION_REJECTED_BY_USER
      Action Rejected by User action execution status.
    • CANCELLED
      Cancelled action execution status.
    • EXECUTED
      Executed action execution status.
    • FAILED
      Failed action execution status.
    • PENDING
      Pending action execution status.
    • SENT_TO_DEVICE
      Sent to Device action execution status.
    • UNKNOWN
      Display name for Unknown action execution status.
    ACTION_ ID

    string

    Unique identifier for an action.

    ACTION_ TYPE

    string

    The type of an action. Possible values:

    • ACCOUNT_WIPE
      Account Wipe action type.
    • ALLOW_ACCESS
      Allow Access action type.
    • APPROVE
      Approve action type.
    • BLOCK
      Block action type.
    • COLLECT_BUGREPORT
      Collect Bugreport action type.
    • DEVICE_WIPE
      Device Wipe action type.
    • DISALLOW_ACCESS
      Disallow Access action type.
    • LOCATE_DEVICE
      Locate Device action type.
    • LOCK_DEVICE
      Lock Device action type.
    • REMOVE_APP_FROM_DEVICE
      Remove App action type.
    • REMOVE_IOS_PROFILE
      Remove iOS Profile action type.
    • RESET_PIN
      Reset PIN action type.
    • REVOKE_TOKEN
      Revoke Token action type.
    • RING_DEVICE
      Ring Device action type.
    • SIGN_OUT_USER
      Sign out user action type.
    • SYNC_DEVICE
      Sync Device action type.
    • UNENROLL
      Unenrolls a device from Windows Advanced management.
    • UNKNOWN
      Unknown action type.
    DEVICE_ ID

    string

    Parameter to indicate the Device Id.

    DEVICE_ MODEL

    string

    Parameter to indicate the device model.

    DEVICE_ TYPE

    string

    Parameter to indicate the device type. Possible values:

    • ANDROID
      Android.
    • ASSISTANT
      Assistant.
    • DESKTOP_CHROME
      Desktop Chrome.
    • iOS
      iOS.
    • LINUX
      Linux.
    • MAC
      Mac.
    • WINDOWS
      Windows.
    IOS_ VENDOR_ ID

    string

    Parameter to indicate the iOS Vendor Id.

    RESOURCE_ ID

    string

    Parameter to indicate the unique resource id of a device.

    SERIAL_ NUMBER

    string

    Parameter to indicate the Serial number.

    USER_ EMAIL

    string

    Parameter to indicate the User email.

    Sample request
    GET https://admin.googleapis.com /admin /reports /v1 /activity /users /all /applications / mobile ?eventName= DEVICE_ACTION_EVENT &maxResults=10 &access_token= YOUR_ACCESS_TOKEN
    Admin Console message format
    {ACTION_TYPE} with id {ACTION_ID} on {actor} 's {DEVICE_MODEL} was {ACTION_EXECUTION_STATUS}

    Device compliance status

    Event details
    Event name
    DEVICE_COMPLIANCE_CHANGED_EVENT
    Parameters
    DEVICE_ COMPLIANCE

    string

    Parameter to indicate the device compliance state with set policies. Possible values:

    • COMPLIANT
      Compliant devices.
    • NON_COMPLIANT
      Non-compliant devices.
    DEVICE_ DEACTIVATION_ REASON

    string

    Parameter to indicate the reason for the deactivation of the mobile device. Possible values:

    • CAMERA_NOT_DISABLED
      The device has been deactivated because camera is not disabled on the device.
    • DEVICE_BLOCKED_BY_ADMIN
      The device has been deactivated because it has been blocked by the admin.
    • DEVICE_COMPROMISED
      Device is compromised.
    • DEVICE_MODEL_NOT_ALLOWED
      The device has been deactivated because the device model is not allowed by the admin.
    • DEVICE_NOT_ENCRYPTED
      The device has been deactivated because the device is not encrypted.
    • DEVICE_POLICY_APP_REQUIRED
      The device has been deactivated because the Device Policy App is not installed.
    • DMAGENT_NOT_DEVICE_OWNER
      The device has been deactivated because it's Device Policy app is not device owner.
    • DMAGENT_NOT_LATEST
      The device has been deactivated because it does not have the latest version of the Device Policy app.
    • DMAGENT_NOT_PROFILE_OR_DEVICE_OWNER
      The device has been deactivated because it's Device Policy app is neither profile owner nor device owner.
    • IOS_ROOTED_STATUS_STALE
      The device has been deactivated because the iOS rooted status is stale.
    • KEYGUARD_NOT_DISABLED
      The device has been deactivated because lock screen widgets are not disabled on the device.
    • OS_VERSION_TOO_OLD
      The device has been deactivated because the operating system version is older than required by the admin.
    • PASSWORD_POLICY_NOT_SATISFIED
      The device has been deactivated because the password policy is not satisfied.
    • SECURITY_PATCH_TOO_OLD
      The device has been deactivated because the security patch on the device is older than required by the admin.
    • SYNC_DISABLED
      The device has been deactivated because sync is not enabled for this device.
    DEVICE_ ID

    string

    Parameter to indicate the Device Id.

    DEVICE_ MODEL

    string

    Parameter to indicate the device model.

    DEVICE_ TYPE

    string

    Parameter to indicate the device type. Possible values:

    • ANDROID
      Android.
    • ASSISTANT
      Assistant.
    • DESKTOP_CHROME
      Desktop Chrome.
    • iOS
      iOS.
    • LINUX
      Linux.
    • MAC
      Mac.
    • WINDOWS
      Windows.
    RESOURCE_ ID

    string

    Parameter to indicate the unique resource id of a device.

    SERIAL_ NUMBER

    string

    Parameter to indicate the Serial number.

    USER_ EMAIL

    string

    Parameter to indicate the User email.

    Sample request
    GET https://admin.googleapis.com /admin /reports /v1 /activity /users /all /applications / mobile ?eventName= DEVICE_COMPLIANCE_CHANGED_EVENT &maxResults=10 &access_token= YOUR_ACCESS_TOKEN
    Admin Console message format
    {actor} 's {DEVICE_MODEL} is {DEVICE_COMPLIANCE} {DEVICE_DEACTIVATION_REASON}

    Device OS update

    Event details
    Event name
    OS_UPDATED_EVENT
    Parameters
    DEVICE_ ID

    string

    Parameter to indicate the Device Id.

    DEVICE_ MODEL

    string

    Parameter to indicate the device model.

    DEVICE_ TYPE

    string

    Parameter to indicate the device type. Possible values:

    • ANDROID
      Android.
    • ASSISTANT
      Assistant.
    • DESKTOP_CHROME
      Desktop Chrome.
    • iOS
      iOS.
    • LINUX
      Linux.
    • MAC
      Mac.
    • WINDOWS
      Windows.
    IOS_ VENDOR_ ID

    string

    Parameter to indicate the iOS Vendor Id.

    NEW_ VALUE

    string

    Parameter to indicate the new value.

    OLD_ VALUE

    string

    Parameter to indicate the old value.

    OS_ PROPERTY

    string

    Parameter to indicate OS Property, eg: OS version. Possible values:

    • BASEBAND_VERSION
      Device baseband version.
    • BUILD_NUMBER
      Build number.
    • KERNEL_VERSION
      Kernel version.
    • OS_VERSION
      OS version.
    • SECURITY_PATCH
      OS security patch.
    RESOURCE_ ID

    string

    Parameter to indicate the unique resource id of a device.

    SERIAL_ NUMBER

    string

    Parameter to indicate the Serial number.

    USER_ EMAIL

    string

    Parameter to indicate the User email.

    Sample request
    GET https://admin.googleapis.com /admin /reports /v1 /activity /users /all /applications / mobile ?eventName= OS_UPDATED_EVENT &maxResults=10 &access_token= YOUR_ACCESS_TOKEN
    Admin Console message format
    {OS_PROPERTY} updated on {actor} 's {DEVICE_MODEL} from {OLD_VALUE} to {NEW_VALUE}

    Device ownership

    Device ownership events.

    Event details
    Event name
    DEVICE_OWNERSHIP_CHANGE_EVENT
    Parameters
    DEVICE_ ID

    string

    Parameter to indicate the Device Id.

    DEVICE_ MODEL

    string

    Parameter to indicate the device model.

    DEVICE_ OWNERSHIP

    string

    Parameter to indicate the ownership of mobile device. Possible values:

    • COMPANY_OWNED
      The ownership of this device has been changed to company owned.
    • USER_OWNED
      The ownership of this device has been changed to user owned.
    DEVICE_ TYPE

    string

    Parameter to indicate the device type. Possible values:

    • ANDROID
      Android.
    • ASSISTANT
      Assistant.
    • DESKTOP_CHROME
      Desktop Chrome.
    • iOS
      iOS.
    • LINUX
      Linux.
    • MAC
      Mac.
    • WINDOWS
      Windows.
    NEW_ DEVICE_ ID

    string

    Parameter to indicate the new Device Id.

    RESOURCE_ ID

    string

    Parameter to indicate the unique resource id of a device.

    SERIAL_ NUMBER

    string

    Parameter to indicate the Serial number.

    USER_ EMAIL

    string

    Parameter to indicate the User email.

    Sample request
    GET https://admin.googleapis.com /admin /reports /v1 /activity /users /all /applications / mobile ?eventName= DEVICE_OWNERSHIP_CHANGE_EVENT &maxResults=10 &access_token= YOUR_ACCESS_TOKEN
    Admin Console message format
    Ownership of {actor} 's {DEVICE_MODEL} has changed to {DEVICE_OWNERSHIP} , with new device id {NEW_DEVICE_ID}

    Device settings change

    Event details
    Event name
    DEVICE_SETTINGS_UPDATED_EVENT
    Parameters
    DEVICE_ ID

    string

    Parameter to indicate the Device Id.

    DEVICE_ MODEL

    string

    Parameter to indicate the device model.

    DEVICE_ SETTING

    string

    Parameter to indicate device settings, eg: USB debugging setting. Possible values:

    • DEVELOPER_OPTIONS
      Developer options.
    • UNKNOWN_SOURCES
      Unknown sources.
    • USB_DEBUGGING
      USB debugging.
    • VERIFY_APPS
      Verify apps.
    DEVICE_ TYPE

    string

    Parameter to indicate the device type. Possible values:

    • ANDROID
      Android.
    • ASSISTANT
      Assistant.
    • DESKTOP_CHROME
      Desktop Chrome.
    • iOS
      iOS.
    • LINUX
      Linux.
    • MAC
      Mac.
    • WINDOWS
      Windows.
    NEW_ VALUE

    string

    Parameter to indicate the new value. Possible values:

    • OFF
      off.
    • ON
      on.
    OLD_ VALUE

    string

    Parameter to indicate the old value. Possible values:

    • OFF
      off.
    • ON
      on.
    RESOURCE_ ID

    string

    Parameter to indicate the unique resource id of a device.

    SERIAL_ NUMBER

    string

    Parameter to indicate the Serial number.

    USER_ EMAIL

    string

    Parameter to indicate the User email.

    Sample request
    GET https://admin.googleapis.com /admin /reports /v1 /activity /users /all /applications / mobile ?eventName= DEVICE_SETTINGS_UPDATED_EVENT &maxResults=10 &access_token= YOUR_ACCESS_TOKEN
    Admin Console message format
    {DEVICE_SETTING} changed from {OLD_VALUE} to {NEW_VALUE} by {actor} on {DEVICE_MODEL}

    Device status changed on Apple portal

    Event details
    Event name
    APPLE_DEP_DEVICE_UPDATE_ON_APPLE_PORTAL_EVENT
    Parameters
    DEVICE_ STATUS_ ON_ APPLE_ PORTAL

    string

    Parameter to indicate the device status on Apple portal. Possible values:

    • ADDED
      EnumParameter to indicate the device is added on Apple portal.
    • DELETED
      EnumParameter to indicate the device is deleted on Apple portal.
    SERIAL_ NUMBER

    string

    Parameter to indicate the Serial number.

    Sample request
    GET https://admin.googleapis.com /admin /reports /v1 /activity /users /all /applications / mobile ?eventName= APPLE_DEP_DEVICE_UPDATE_ON_APPLE_PORTAL_EVENT &maxResults=10 &access_token= YOUR_ACCESS_TOKEN
    Admin Console message format
    Device with serial number {SERIAL_NUMBER} {DEVICE_STATUS_ON_APPLE_PORTAL} through Apple Device Enrollment

    Device Sync

    Device Sync events.

    Event details
    Event name
    DEVICE_SYNC_EVENT
    Parameters
    BASIC_ INTEGRITY

    string

    Parameter to indicate whether the device passes the basic integrity check.

    CTS_ PROFILE_ MATCH

    string

    Parameter to indicate whether the device passes the CTS profile match.

    DEVICE_ ID

    string

    Parameter to indicate the Device Id.

    DEVICE_ MODEL

    string

    Parameter to indicate the device model.

    DEVICE_ TYPE

    string

    Parameter to indicate the device type. Possible values:

    • ANDROID
      Android.
    • ASSISTANT
      Assistant.
    • DESKTOP_CHROME
      Desktop Chrome.
    • iOS
      iOS.
    • LINUX
      Linux.
    • MAC
      Mac.
    • WINDOWS
      Windows.
    IOS_ VENDOR_ ID

    string

    Parameter to indicate the iOS Vendor Id.

    OS_ VERSION

    string

    Parameter to indicate the OS version.

    RESOURCE_ ID

    string

    Parameter to indicate the unique resource id of a device.

    SECURITY_ PATCH_ LEVEL

    string

    Parameter to indicate the security patch Level.

    SERIAL_ NUMBER

    string

    Parameter to indicate the Serial number.

    USER_ EMAIL

    string

    Parameter to indicate the User email.

    Sample request
    GET https://admin.googleapis.com /admin /reports /v1 /activity /users /all /applications / mobile ?eventName= DEVICE_SYNC_EVENT &maxResults=10 &access_token= YOUR_ACCESS_TOKEN
    Admin Console message format
    {actor} 's account synced on {DEVICE_MODEL}

    Risk signal change

    Event details
    Event name
    RISK_SIGNAL_UPDATED_EVENT
    Parameters
    DEVICE_ ID

    string

    Parameter to indicate the Device Id.

    DEVICE_ MODEL

    string

    Parameter to indicate the device model.

    DEVICE_ TYPE

    string

    Parameter to indicate the device type. Possible values:

    • ANDROID
      Android.
    • ASSISTANT
      Assistant.
    • DESKTOP_CHROME
      Desktop Chrome.
    • iOS
      iOS.
    • LINUX
      Linux.
    • MAC
      Mac.
    • WINDOWS
      Windows.
    IOS_ VENDOR_ ID

    string

    Parameter to indicate the iOS Vendor Id.

    NEW_ VALUE

    string

    Parameter to indicate the new value.

    OLD_ VALUE

    string

    Parameter to indicate the old value.

    RESOURCE_ ID

    string

    Parameter to indicate the unique resource id of a device.

    RISK_ SIGNAL

    string

    Parameter to indicate the risk signal, e.g. CTS profile match. Possible values:

    • BASIC_INTEGRITY
      EnumParameter to indicate whether the device passes the basic integrity check.
    • CTS_PROFILE_MATCH
      EnumParameter to indicate whether the device passes the CTS profile match.
    SERIAL_ NUMBER

    string

    Parameter to indicate the Serial number.

    USER_ EMAIL

    string

    Parameter to indicate the User email.

    Sample request
    GET https://admin.googleapis.com /admin /reports /v1 /activity /users /all /applications / mobile ?eventName= RISK_SIGNAL_UPDATED_EVENT &maxResults=10 &access_token= YOUR_ACCESS_TOKEN
    Admin Console message format
    {RISK_SIGNAL} updated on {actor} 's {DEVICE_MODEL} from {OLD_VALUE} to {NEW_VALUE}

    Work profile support

    Event details
    Event name
    ANDROID_WORK_PROFILE_SUPPORT_ENABLED_EVENT
    Parameters
    DEVICE_ ID

    string

    Parameter to indicate the Device Id.

    DEVICE_ MODEL

    string

    Parameter to indicate the device model.

    DEVICE_ TYPE

    string

    Parameter to indicate the device type. Possible values:

    • ANDROID
      Android.
    • ASSISTANT
      Assistant.
    • DESKTOP_CHROME
      Desktop Chrome.
    • iOS
      iOS.
    • LINUX
      Linux.
    • MAC
      Mac.
    • WINDOWS
      Windows.
    RESOURCE_ ID

    string

    Parameter to indicate the unique resource id of a device.

    SERIAL_ NUMBER

    string

    Parameter to indicate the Serial number.

    USER_ EMAIL

    string

    Parameter to indicate the User email.

    Sample request
    GET https://admin.googleapis.com /admin /reports /v1 /activity /users /all /applications / mobile ?eventName= ANDROID_WORK_PROFILE_SUPPORT_ENABLED_EVENT &maxResults=10 &access_token= YOUR_ACCESS_TOKEN
    Admin Console message format
    Work profile is supported on {actor} 's {DEVICE_MODEL}

    Suspicious Activity

    Suspicious activity events in Mobile device. Events of this type are returned with type=suspicious_activity .

    Device compromise

    Device compromised.

    Event details
    Event name
    DEVICE_COMPROMISED_EVENT
    Parameters
    DEVICE_ COMPROMISED_ STATE

    string

    Parameter to indicate the compromised state of device. Possible values:

    • COMPROMISED
      Device is compromised.
    • NOT_COMPROMISED
      Device is no longer compromised.
    DEVICE_ ID

    string

    Parameter to indicate the Device Id.

    DEVICE_ MODEL

    string

    Parameter to indicate the device model.

    DEVICE_ TYPE

    string

    Parameter to indicate the device type. Possible values:

    • ANDROID
      Android.
    • ASSISTANT
      Assistant.
    • DESKTOP_CHROME
      Desktop Chrome.
    • iOS
      iOS.
    • LINUX
      Linux.
    • MAC
      Mac.
    • WINDOWS
      Windows.
    IOS_ VENDOR_ ID

    string

    Parameter to indicate the iOS Vendor Id.

    RESOURCE_ ID

    string

    Parameter to indicate the unique resource id of a device.

    SERIAL_ NUMBER

    string

    Parameter to indicate the Serial number.

    USER_ EMAIL

    string

    Parameter to indicate the User email.

    Sample request
    GET https://admin.googleapis.com /admin /reports /v1 /activity /users /all /applications / mobile ?eventName= DEVICE_COMPROMISED_EVENT &maxResults=10 &access_token= YOUR_ACCESS_TOKEN
    Admin Console message format
    {actor} 's {DEVICE_MODEL} {DEVICE_COMPROMISED_STATE}

    Failed screen unlock attempts

    Event details
    Event name
    FAILED_PASSWORD_ATTEMPTS_EVENT
    Parameters
    DEVICE_ ID

    string

    Parameter to indicate the Device Id.

    DEVICE_ MODEL

    string

    Parameter to indicate the device model.

    DEVICE_ TYPE

    string

    Parameter to indicate the device type. Possible values:

    • ANDROID
      Android.
    • ASSISTANT
      Assistant.
    • DESKTOP_CHROME
      Desktop Chrome.
    • iOS
      iOS.
    • LINUX
      Linux.
    • MAC
      Mac.
    • WINDOWS
      Windows.
    FAILED_ PASSWD_ ATTEMPTS

    integer

    Parameter to indicate the number of failed screen unlock attempts.

    RESOURCE_ ID

    string

    Parameter to indicate the unique resource id of a device.

    SERIAL_ NUMBER

    string

    Parameter to indicate the Serial number.

    USER_ EMAIL

    string

    Parameter to indicate the User email.

    Sample request
    GET https://admin.googleapis.com /admin /reports /v1 /activity /users /all /applications / mobile ?eventName= FAILED_PASSWORD_ATTEMPTS_EVENT &maxResults=10 &access_token= YOUR_ACCESS_TOKEN
    Admin Console message format
    {FAILED_PASSWD_ATTEMPTS} failed attempts to unlock {actor} 's {DEVICE_MODEL}

    Suspicious activity

    Event details
    Event name
    SUSPICIOUS_ACTIVITY_EVENT
    Parameters
    DEVICE_ ID

    string

    Parameter to indicate the Device Id.

    DEVICE_ MODEL

    string

    Parameter to indicate the device model.

    DEVICE_ PROPERTY

    string

    Parameter to indicate the changed device property. Possible values:

    • BASIC_INTEGRITY
      EnumParameter to indicate whether the device passes the basic integrity check.
    • CTS_PROFILE_MATCH
      EnumParameter to indicate whether the device passes the CTS profile match.
    • DEVICE_BOOTLOADER
      Bootloader version on the device.
    • DEVICE_BRAND
      Device brand.
    • DEVICE_HARDWARE
      Device hardware details.
    • DEVICE_MANUFACTURER
      Manufacturer of the device.
    • DEVICE_MODEL
      Device model.
    • DMAGENT_PERMISSION
      Device Policy app's privilege on the device.
    • IMEI_NUMBER
      IMEI number.
    • MEID_NUMBER
      MEID number.
    • SERIAL_NUMBER
      Serial number.
    • WIFI_MAC_ADDRESS
      WiFi MAC address.
    DEVICE_ TYPE

    string

    Parameter to indicate the device type. Possible values:

    • ANDROID
      Android.
    • ASSISTANT
      Assistant.
    • DESKTOP_CHROME
      Desktop Chrome.
    • iOS
      iOS.
    • LINUX
      Linux.
    • MAC
      Mac.
    • WINDOWS
      Windows.
    IOS_ VENDOR_ ID

    string

    Parameter to indicate the iOS Vendor Id.

    NEW_ VALUE

    string

    New value. The possible values listed below only apply when DEVICE_PROPERTY is set to DMAGENT_PERMISSION . For other properties this parameter will contain arbitrary string values. Possible values:

    • DEVICE_ADMINISTRATOR
      Device administrator privilege.
    • DEVICE_OWNER
      Device owner privilege.
    • PROFILE_OWNER
      Profile owner privilege.
    • UNKNOWN_PERMISSION
      Unknown privilege.
    OLD_ VALUE

    string

    Old value. The possible values listed below only apply when DEVICE_PROPERTY is set to DMAGENT_PERMISSION . For other properties this parameter will contain arbitrary string values. Possible values:

    • DEVICE_ADMINISTRATOR
      Device administrator privilege.
    • DEVICE_OWNER
      Device owner privilege.
    • PROFILE_OWNER
      Profile owner privilege.
    • UNKNOWN_PERMISSION
      Unknown privilege.
    RESOURCE_ ID

    string

    Parameter to indicate the unique resource id of a device.

    SERIAL_ NUMBER

    string

    Parameter to indicate the Serial number.

    USER_ EMAIL

    string

    Parameter to indicate the User email.

    Sample request
    GET https://admin.googleapis.com /admin /reports /v1 /activity /users /all /applications / mobile ?eventName= SUSPICIOUS_ACTIVITY_EVENT &maxResults=10 &access_token= YOUR_ACCESS_TOKEN
    Admin Console message format
    {DEVICE_PROPERTY} changed on {actor} 's {DEVICE_MODEL} from {OLD_VALUE} to {NEW_VALUE}
    Create a Mobile Website
    View Site in Mobile | Classic
    Share by: