Access Evaluation Audit Activity Events

    This document lists the events and parameters for various types of Access Evaluation Audit activity events. You can retrieve these events by calling Activities.list with applicationName=access_evaluation .

    Access Token Evaluation

    An access token evaluation was performed. Events of this type are returned with type=access_token_evaluation .

    Access Token Request

    An access token request was evaluated successfully to allow access.

    Event details
    Event name
    allow_token_request
    Parameters
    client_ type

    string

    Client Type of the client ID. Possible values:

    • CONNECTED_DEVICE
      A connected device client.
    • NATIVE_ANDROID
      An Android application.
    • NATIVE_APPLICATION
      A native application.
    • NATIVE_CHROME_EXTENSION
      A Chrome application.
    • NATIVE_DEVICE
      A native device application.
    • NATIVE_IOS
      An iOS application.
    • NATIVE_SONY
      A native Sony application.
    • TYPE_UNSPECIFIED
      An unspecified client type.
    • WEB
      A web application.
    configuration_ source

    string

    The Configuration Source. Possible values:

    • APP_ACCESS_CONTROL
      Admin has set a policy in API Controls.
    • CONFIGURATION_SOURCE_UNSPECIFIED
      Admin has not set any policy that blocks access for this application.
    • DOMAIN_WIDE_DELEGATION
      Admin has domain wide delegated the application.
    • GOOGLE_WORKSPACE_MARKETPLACE
      Admin has installed the application in Google Workspace Marketplace.
    • MOBILE_DEVICE_MANAGEMENT
      Admin has set a policy in Google Endpoint Management.
    device_ id

    string

    The Device ID.

    scope_ data

    message

    The Scope Data.

    scopes_ requested

    string

    Scopes for which the access was requested.

    Sample request
    GET https://admin.googleapis.com /admin /reports /v1 /activity /users /all /applications / access_evaluation ?eventName= allow_token_request &maxResults=10 &access_token= YOUR_ACCESS_TOKEN
    Admin Console message format
    {actor} token request from {APPLICATION_NAME_IDENTIFIER} was allowed due to {configuration_source}

    Allow Token Impersonation

    A Token impersonation was evaluated successfully to allow access.

    Event details
    Event name
    allow_token_impersonation
    Parameters
    client_ type

    string

    Client Type of the client ID. Possible values:

    • CONNECTED_DEVICE
      A connected device client.
    • NATIVE_ANDROID
      An Android application.
    • NATIVE_APPLICATION
      A native application.
    • NATIVE_CHROME_EXTENSION
      A Chrome application.
    • NATIVE_DEVICE
      A native device application.
    • NATIVE_IOS
      An iOS application.
    • NATIVE_SONY
      A native Sony application.
    • TYPE_UNSPECIFIED
      An unspecified client type.
    • WEB
      A web application.
    configuration_ source

    string

    The Configuration Source. Possible values:

    • APP_ACCESS_CONTROL
      Admin has set a policy in API Controls.
    • CONFIGURATION_SOURCE_UNSPECIFIED
      Admin has not set any policy that blocks access for this application.
    • DOMAIN_WIDE_DELEGATION
      Admin has domain wide delegated the application.
    • GOOGLE_WORKSPACE_MARKETPLACE
      Admin has installed the application in Google Workspace Marketplace.
    • MOBILE_DEVICE_MANAGEMENT
      Admin has set a policy in Google Endpoint Management.
    device_ id

    string

    The Device ID.

    scope_ data

    message

    The Scope Data.

    scopes_ requested

    string

    Scopes for which the access was requested.

    service_ account

    string

    The Service Account.

    Sample request
    GET https://admin.googleapis.com /admin /reports /v1 /activity /users /all /applications / access_evaluation ?eventName= allow_token_impersonation &maxResults=10 &access_token= YOUR_ACCESS_TOKEN
    Admin Console message format
    {service_account} impersonation access for {actor} was allowed due to {configuration_source}

    Credential Validation

    An end user credential was validated against security policies. Events of this type are returned with type=credential_validation .

    Allow Credential Validation Request

    An end user credential was validated successfully against security policies to allow access.

    Event details
    Event name
    allow_credential_validation_request
    Parameters
    scopes_ requested

    string

    Scopes for which the access was requested.

    Sample request
    GET https://admin.googleapis.com /admin /reports /v1 /activity /users /all /applications / access_evaluation ?eventName= allow_credential_validation_request &maxResults=10 &access_token= YOUR_ACCESS_TOKEN
    Admin Console message format
    {actor} credential validation request from {APPLICATION_NAME_IDENTIFIER} was allowed due to security policy configuration
    Design a Mobile Site
    View Site in Mobile | Classic
    Share by: