Gmail Activity Events

message

General information about the event. The listed nested parameter can be used as a filter using the full parameter name.

• event_info.mail_event_type (integer)

  Logged event type. Since eventName is always a constant ( delivery ) for Gmail audit logs, this field helps determine the actual event that occurred.

  Possible values are:

  • 0 : Unknown mail event type
  • 1 : Message sent
  • 2 : Message received
  • 3 : A Gmail user manually applied a spam classification to the message. For example, the user marked the message as spam, phishing, or not spam.
  • 4 : Gmail flagged the message as spam after delivery. Several factors can cause this, including poor sender reputation or new virus hashes.
  • 5 : Message quarantined
  • 6 : Message released from quarantine
  • 7 : Message opened for the first time
  • 8 : Message marked as unread
  • 9 : Message replied to for the first time
  • 10 : Message forwarded for the first time
  • 11 : Message autoforwarded with a Gmail account forwarding setting
  • 12 : Message moved to Inbox
  • 13 : Message moved to Trash
  • 14 : Message removed from Trash
  • 15 : Link in message body was clicked
  • 16 : Link in message attachment link was clicked during attachment preview
  • 17 : One or more message attachments were downloaded
  • 18 : One or more message attachments saved to Google Drive
  • 19 : One or more Google Drive items in the message were saved to the recipient's Google Drive
  • 20 : Classification label applied to message
  • 21 : Message classification label change
  • 22 : Classification label removed from message
  • 23 : Classification label applied to all message attachments
  • 24 : Classification label changed on all message attachments
  • 25 : Classification label removed from all message attachments
  • 26 : Message archived
  • 27 : Message permanently deleted
  • 28 : One or more message attachments previewed
  • 29 : Message saved as draft
  • 30 : Message couldn't be delivered, and bounced
  • 31 : Message viewed, including first and following readings. For details on a known iOS issue, go to Google Workspace known issues.
  • 32 : Message downloaded
  • 33 : An application accessed a message on behalf of a user
  • 34 : Delegate Granted
  .