Vault Audit Activity Events

    This document lists the events and parameters for various types of Vault Audit activity events. You can retrieve these events by calling Activities.list() with applicationName=vault .

    Event Type: User Action

    User Action Event Type. Events of this type are returned with type=user_action .

    Add Collaborator Begin

    The name of the Vault event: Add Collaborator Begin.

    Event details
    Event name
    add_collaborator_begin
    Parameters
    additional_ details

    string

    Additional details pertaining to an audit log.
    matter_ id

    string

    The Matter ID an audit pertains to.
    organizational_ unit_ name

    string

    The organizational unit name.
    query

    string

    The user inputted query for search and exports.
    resource_ name

    string

    The resource name of the action, such as hold name or saved query name.
    resource_ url

    string

    The document URL of the document view.
    target_ user

    string

    The targeted user (such as user put on hold).
    Sample request
    GET https://admin.googleapis.com /admin /reports /v1 /activity /users /all /applications / vault ?eventName= add_collaborator_begin &maxResults=10 &access_token= YOUR_ACCESS_TOKEN
    Admin Console message format
    Collaborator addition began

    Add Collaborator End

    The name of the Vault event: Add Collaborator End.

    Event details
    Event name
    add_collaborator_end
    Parameters
    additional_ details

    string

    Additional details pertaining to an audit log.
    matter_ id

    string

    The Matter ID an audit pertains to.
    organizational_ unit_ name

    string

    The organizational unit name.
    query

    string

    The user inputted query for search and exports.
    resource_ name

    string

    The resource name of the action, such as hold name or saved query name.
    resource_ url

    string

    The document URL of the document view.
    target_ user

    string

    The targeted user (such as user put on hold).
    Sample request
    GET https://admin.googleapis.com /admin /reports /v1 /activity /users /all /applications / vault ?eventName= add_collaborator_end &maxResults=10 &access_token= YOUR_ACCESS_TOKEN
    Admin Console message format
    Collaborator addition ended

    Add Litigation Hold Begin

    The name of the Vault event: Add Litigation Hold Begin.

    Event details
    Event name
    add_litigation_hold_begin
    Parameters
    additional_ details

    string

    Additional details pertaining to an audit log.
    matter_ id

    string

    The Matter ID an audit pertains to.
    organizational_ unit_ name

    string

    The organizational unit name.
    query

    string

    The user inputted query for search and exports.
    resource_ name

    string

    The resource name of the action, such as hold name or saved query name.
    resource_ url

    string

    The document URL of the document view.
    target_ user

    string

    The targeted user (such as user put on hold).
    Sample request
    GET https://admin.googleapis.com /admin /reports /v1 /activity /users /all /applications / vault ?eventName= add_litigation_hold_begin &maxResults=10 &access_token= YOUR_ACCESS_TOKEN
    Admin Console message format
    Litigation hold addition began

    Add Litigation Hold End

    The name of the Vault event: Add Litigation Hold End.

    Event details
    Event name
    add_litigation_hold_end
    Parameters
    additional_ details

    string

    Additional details pertaining to an audit log.
    matter_ id

    string

    The Matter ID an audit pertains to.
    organizational_ unit_ name

    string

    The organizational unit name.
    query

    string

    The user inputted query for search and exports.
    resource_ name

    string

    The resource name of the action, such as hold name or saved query name.
    resource_ url

    string

    The document URL of the document view.
    target_ user

    string

    The targeted user (such as user put on hold).
    Sample request
    GET https://admin.googleapis.com /admin /reports /v1 /activity /users /all /applications / vault ?eventName= add_litigation_hold_end &maxResults=10 &access_token= YOUR_ACCESS_TOKEN
    Admin Console message format
    Litigation hold addition ended

    Add Preservation Rule Begin

    The name of the Vault event: Add Preservation Rule Begin.

    Event details
    Event name
    add_preservation_rule_begin
    Parameters
    additional_ details

    string

    Additional details pertaining to an audit log.
    matter_ id

    string

    The Matter ID an audit pertains to.
    organizational_ unit_ name

    string

    The organizational unit name.
    query

    string

    The user inputted query for search and exports.
    resource_ name

    string

    The resource name of the action, such as hold name or saved query name.
    resource_ url

    string

    The document URL of the document view.
    target_ user

    string

    The targeted user (such as user put on hold).
    Sample request
    GET https://admin.googleapis.com /admin /reports /v1 /activity /users /all /applications / vault ?eventName= add_preservation_rule_begin &maxResults=10 &access_token= YOUR_ACCESS_TOKEN
    Admin Console message format
    Preservation rule addition began

    Add Preservation Rule End

    The name of the Vault event: Add Preservation Rule End.

    Event details
    Event name
    add_preservation_rule_end
    Parameters
    additional_ details

    string

    Additional details pertaining to an audit log.
    matter_ id

    string

    The Matter ID an audit pertains to.
    organizational_ unit_ name

    string

    The organizational unit name.
    query

    string

    The user inputted query for search and exports.
    resource_ name

    string

    The resource name of the action, such as hold name or saved query name.
    resource_ url

    string

    The document URL of the document view.
    target_ user

    string

    The targeted user (such as user put on hold).
    Sample request
    GET https://admin.googleapis.com /admin /reports /v1 /activity /users /all /applications / vault ?eventName= add_preservation_rule_end &maxResults=10 &access_token= YOUR_ACCESS_TOKEN
    Admin Console message format
    Preservation rule addition ended

    Add Retention Rule Begin

    The name of the Vault event: Add Retention Rule Begin.

    Event details
    Event name
    add_retention_rule_begin
    Parameters
    additional_ details

    string

    Additional details pertaining to an audit log.
    matter_ id

    string

    The Matter ID an audit pertains to.
    organizational_ unit_ name

    string

    The organizational unit name.
    query

    string

    The user inputted query for search and exports.
    resource_ name

    string

    The resource name of the action, such as hold name or saved query name.
    resource_ url

    string

    The document URL of the document view.
    target_ user

    string

    The targeted user (such as user put on hold).
    Sample request
    GET https://admin.googleapis.com /admin /reports /v1 /activity /users /all /applications / vault ?eventName= add_retention_rule_begin &maxResults=10 &access_token= YOUR_ACCESS_TOKEN
    Admin Console message format
    Retention rule addition began

    Add Retention Rule End

    The name of the Vault event: Add Retention Rule End.

    Event details
    Event name
    add_retention_rule_end
    Parameters
    additional_ details

    string

    Additional details pertaining to an audit log.
    matter_ id

    string

    The Matter ID an audit pertains to.
    organizational_ unit_ name

    string

    The organizational unit name.
    query

    string

    The user inputted query for search and exports.
    resource_ name

    string

    The resource name of the action, such as hold name or saved query name.
    resource_ url

    string

    The document URL of the document view.
    target_ user

    string

    The targeted user (such as user put on hold).
    Sample request
    GET https://admin.googleapis.com /admin /reports /v1 /activity /users /all /applications / vault ?eventName= add_retention_rule_end &maxResults=10 &access_token= YOUR_ACCESS_TOKEN
    Admin Console message format
    Retention rule addition ended

    Cancel Accelerated Deletion Begin

    The name of the Vault event: Cancel Accelerated Deletion Begin.

    Event details
    Event name
    cancel_accelerated_deletion_begin
    Parameters
    additional_ details

    string

    Additional details pertaining to an audit log.
    matter_ id

    string

    The Matter ID an audit pertains to.
    organizational_ unit_ name

    string

    The organizational unit name.
    query

    string

    The user inputted query for search and exports.
    resource_ name

    string

    The resource name of the action, such as hold name or saved query name.
    resource_ url

    string

    The document URL of the document view.
    target_ user

    string

    The targeted user (such as user put on hold).
    Sample request
    GET https://admin.googleapis.com /admin /reports /v1 /activity /users /all /applications / vault ?eventName= cancel_accelerated_deletion_begin &maxResults=10 &access_token= YOUR_ACCESS_TOKEN
    Admin Console message format
    Accelerated deletion cancellation began

    Cancel Accelerated Deletion End

    The name of the Vault event: Cancel Accelerated Deletion End.

    Event details
    Event name
    cancel_accelerated_deletion_end
    Parameters
    additional_ details

    string

    Additional details pertaining to an audit log.
    matter_ id

    string

    The Matter ID an audit pertains to.
    organizational_ unit_ name

    string

    The organizational unit name.
    query

    string

    The user inputted query for search and exports.
    resource_ name

    string

    The resource name of the action, such as hold name or saved query name.
    resource_ url

    string

    The document URL of the document view.
    target_ user

    string

    The targeted user (such as user put on hold).
    Sample request
    GET https://admin.googleapis.com /admin /reports /v1 /activity /users /all /applications / vault ?eventName= cancel_accelerated_deletion_end &maxResults=10 &access_token= YOUR_ACCESS_TOKEN
    Admin Console message format
    Accelerated deletion cancellation ended

    Close Investigation Begin

    The name of the Vault event: Close Investigation Begin.

    Event details
    Event name
    close_investigation_begin
    Parameters
    additional_ details

    string

    Additional details pertaining to an audit log.
    matter_ id

    string

    The Matter ID an audit pertains to.
    organizational_ unit_ name

    string

    The organizational unit name.
    query

    string

    The user inputted query for search and exports.
    resource_ name

    string

    The resource name of the action, such as hold name or saved query name.
    resource_ url

    string

    The document URL of the document view.
    target_ user

    string

    The targeted user (such as user put on hold).
    Sample request
    GET https://admin.googleapis.com /admin /reports /v1 /activity /users /all /applications / vault ?eventName= close_investigation_begin &maxResults=10 &access_token= YOUR_ACCESS_TOKEN
    Admin Console message format
    Investigation closure began

    Close Investigation End

    The name of the Vault event: Close Investigation End.

    Event details
    Event name
    close_investigation_end
    Parameters
    additional_ details

    string

    Additional details pertaining to an audit log.
    matter_ id

    string

    The Matter ID an audit pertains to.
    organizational_ unit_ name

    string

    The organizational unit name.
    query

    string

    The user inputted query for search and exports.
    resource_ name

    string

    The resource name of the action, such as hold name or saved query name.
    resource_ url

    string

    The document URL of the document view.
    target_ user

    string

    The targeted user (such as user put on hold).
    Sample request
    GET https://admin.googleapis.com /admin /reports /v1 /activity /users /all /applications / vault ?eventName= close_investigation_end &maxResults=10 &access_token= YOUR_ACCESS_TOKEN
    Admin Console message format
    Investigation closure ended

    Convert Saved Query To Collection Begin

    The name of the Vault event: Convert Saved Query To Collection Begin.

    Event details
    Event name
    convert_saved_query_to_collection_begin
    Parameters
    additional_ details

    string

    Additional details pertaining to an audit log.
    matter_ id

    string

    The Matter ID an audit pertains to.
    organizational_ unit_ name

    string

    The organizational unit name.
    query

    string

    The user inputted query for search and exports.
    resource_ name

    string

    The resource name of the action, such as hold name or saved query name.
    resource_ url

    string

    The document URL of the document view.
    target_ user

    string

    The targeted user (such as user put on hold).
    Sample request
    GET https://admin.googleapis.com /admin /reports /v1 /activity /users /all /applications / vault ?eventName= convert_saved_query_to_collection_begin &maxResults=10 &access_token= YOUR_ACCESS_TOKEN
    Admin Console message format
    Saved query to collection conversion began

    Convert Saved Query To Collection End

    The name of the Vault event: Convert Saved Query To Collection End.

    Event details
    Event name
    convert_saved_query_to_collection_end
    Parameters
    additional_ details

    string

    Additional details pertaining to an audit log.
    matter_ id

    string

    The Matter ID an audit pertains to.
    organizational_ unit_ name

    string

    The organizational unit name.
    query

    string

    The user inputted query for search and exports.
    resource_ name

    string

    The resource name of the action, such as hold name or saved query name.
    resource_ url

    string

    The document URL of the document view.
    target_ user

    string

    The targeted user (such as user put on hold).
    Sample request
    GET https://admin.googleapis.com /admin /reports /v1 /activity /users /all /applications / vault ?eventName= convert_saved_query_to_collection_end &maxResults=10 &access_token= YOUR_ACCESS_TOKEN
    Admin Console message format
    Saved query to collection conversion ended

    Create Accelerated Deletion Begin

    The name of the Vault event: Create Accelerated Deletion Begin.

    Event details
    Event name
    create_accelerated_deletion_begin
    Parameters
    additional_ details

    string

    Additional details pertaining to an audit log.
    matter_ id

    string

    The Matter ID an audit pertains to.
    organizational_ unit_ name

    string

    The organizational unit name.
    query

    string

    The user inputted query for search and exports.
    resource_ name

    string

    The resource name of the action, such as hold name or saved query name.
    resource_ url

    string

    The document URL of the document view.
    target_ user

    string

    The targeted user (such as user put on hold).
    Sample request
    GET https://admin.googleapis.com /admin /reports /v1 /activity /users /all /applications / vault ?eventName= create_accelerated_deletion_begin &maxResults=10 &access_token= YOUR_ACCESS_TOKEN
    Admin Console message format
    Accelerated deletion request creation began

    Create Accelerated Deletion End

    The name of the Vault event: Create Accelerated Deletion End.

    Event details
    Event name
    create_accelerated_deletion_end
    Parameters
    additional_ details

    string

    Additional details pertaining to an audit log.
    matter_ id

    string

    The Matter ID an audit pertains to.
    organizational_ unit_ name

    string

    The organizational unit name.
    query

    string

    The user inputted query for search and exports.
    resource_ name

    string

    The resource name of the action, such as hold name or saved query name.
    resource_ url

    string

    The document URL of the document view.
    target_ user

    string

    The targeted user (such as user put on hold).
    Sample request
    GET https://admin.googleapis.com /admin /reports /v1 /activity /users /all /applications / vault ?eventName= create_accelerated_deletion_end &maxResults=10 &access_token= YOUR_ACCESS_TOKEN
    Admin Console message format
    Accelerated deletion request creation ended

    Create Export Begin

    The name of the Vault event: Create Export Begin.

    Event details
    Event name
    create_export_begin
    Parameters
    additional_ details

    string

    Additional details pertaining to an audit log.
    matter_ id

    string

    The Matter ID an audit pertains to.
    organizational_ unit_ name

    string

    The organizational unit name.
    query

    string

    The user inputted query for search and exports.
    resource_ name

    string

    The resource name of the action, such as hold name or saved query name.
    resource_ url

    string

    The document URL of the document view.
    target_ user

    string

    The targeted user (such as user put on hold).
    Sample request
    GET https://admin.googleapis.com /admin /reports /v1 /activity /users /all /applications / vault ?eventName= create_export_begin &maxResults=10 &access_token= YOUR_ACCESS_TOKEN
    Admin Console message format
    Export creation began

    Create Export End

    The name of the Vault event: Create Export End.

    Event details
    Event name
    create_export_end
    Parameters
    additional_ details

    string

    Additional details pertaining to an audit log.
    matter_ id

    string

    The Matter ID an audit pertains to.
    organizational_ unit_ name

    string

    The organizational unit name.
    query

    string

    The user inputted query for search and exports.
    resource_ name

    string

    The resource name of the action, such as hold name or saved query name.
    resource_ url

    string

    The document URL of the document view.
    target_ user

    string

    The targeted user (such as user put on hold).
    Sample request
    GET https://admin.googleapis.com /admin /reports /v1 /activity /users /all /applications / vault ?eventName= create_export_end &maxResults=10 &access_token= YOUR_ACCESS_TOKEN
    Admin Console message format
    Export creation ended

    Create Investigation Begin

    The name of the Vault event: Create Investigation Begin.

    Event details
    Event name
    create_investigation_begin
    Parameters
    additional_ details

    string

    Additional details pertaining to an audit log.
    matter_ id

    string

    The Matter ID an audit pertains to.
    organizational_ unit_ name

    string

    The organizational unit name.
    query

    string

    The user inputted query for search and exports.
    resource_ name

    string

    The resource name of the action, such as hold name or saved query name.
    resource_ url

    string

    The document URL of the document view.
    target_ user

    string

    The targeted user (such as user put on hold).
    Sample request
    GET https://admin.googleapis.com /admin /reports /v1 /activity /users /all /applications / vault ?eventName= create_investigation_begin &maxResults=10 &access_token= YOUR_ACCESS_TOKEN
    Admin Console message format
    Investigation creation began

    Create Investigation End

    The name of the Vault event: Create Investigation End.

    Event details
    Event name
    create_investigation_end
    Parameters
    additional_ details

    string

    Additional details pertaining to an audit log.
    matter_ id

    string

    The Matter ID an audit pertains to.
    organizational_ unit_ name

    string

    The organizational unit name.
    query

    string

    The user inputted query for search and exports.
    resource_ name

    string

    The resource name of the action, such as hold name or saved query name.
    resource_ url

    string

    The document URL of the document view.
    target_ user

    string

    The targeted user (such as user put on hold).
    Sample request
    GET https://admin.googleapis.com /admin /reports /v1 /activity /users /all /applications / vault ?eventName= create_investigation_end &maxResults=10 &access_token= YOUR_ACCESS_TOKEN
    Admin Console message format
    Investigation creation ended

    Create Saved Query Begin

    The name of the Vault event: Create Saved Query Begin.

    Event details
    Event name
    create_saved_query_begin
    Parameters
    additional_ details

    string

    Additional details pertaining to an audit log.
    matter_ id

    string

    The Matter ID an audit pertains to.
    organizational_ unit_ name

    string

    The organizational unit name.
    query

    string

    The user inputted query for search and exports.
    resource_ name

    string

    The resource name of the action, such as hold name or saved query name.
    resource_ url

    string

    The document URL of the document view.
    target_ user

    string

    The targeted user (such as user put on hold).
    Sample request
    GET https://admin.googleapis.com /admin /reports /v1 /activity /users /all /applications / vault ?eventName= create_saved_query_begin &maxResults=10 &access_token= YOUR_ACCESS_TOKEN
    Admin Console message format
    Saved query creation began

    Create Saved Query End

    The name of the Vault event: Create Saved Query End.

    Event details
    Event name
    create_saved_query_end
    Parameters
    additional_ details

    string

    Additional details pertaining to an audit log.
    matter_ id

    string

    The Matter ID an audit pertains to.
    organizational_ unit_ name

    string

    The organizational unit name.
    query

    string

    The user inputted query for search and exports.
    resource_ name

    string

    The resource name of the action, such as hold name or saved query name.
    resource_ url

    string

    The document URL of the document view.
    target_ user

    string

    The targeted user (such as user put on hold).
    Sample request
    GET https://admin.googleapis.com /admin /reports /v1 /activity /users /all /applications / vault ?eventName= create_saved_query_end &maxResults=10 &access_token= YOUR_ACCESS_TOKEN
    Admin Console message format
    Saved query creation ended

    Delete Export Begin

    The name of the Vault event: Delete Export Begin.

    Event details
    Event name
    delete_export_begin
    Parameters
    additional_ details

    string

    Additional details pertaining to an audit log.
    matter_ id

    string

    The Matter ID an audit pertains to.
    organizational_ unit_ name

    string

    The organizational unit name.
    query

    string

    The user inputted query for search and exports.
    resource_ name

    string

    The resource name of the action, such as hold name or saved query name.
    resource_ url

    string

    The document URL of the document view.
    target_ user

    string

    The targeted user (such as user put on hold).
    Sample request
    GET https://admin.googleapis.com /admin /reports /v1 /activity /users /all /applications / vault ?eventName= delete_export_begin &maxResults=10 &access_token= YOUR_ACCESS_TOKEN
    Admin Console message format
    Export deletion began

    Delete Export End

    The name of the Vault event: Delete Export End.

    Event details
    Event name
    delete_export_end
    Parameters
    additional_ details

    string

    Additional details pertaining to an audit log.
    matter_ id

    string

    The Matter ID an audit pertains to.
    organizational_ unit_ name

    string

    The organizational unit name.
    query

    string

    The user inputted query for search and exports.
    resource_ name

    string

    The resource name of the action, such as hold name or saved query name.
    resource_ url

    string

    The document URL of the document view.
    target_ user

    string

    The targeted user (such as user put on hold).
    Sample request
    GET https://admin.googleapis.com /admin /reports /v1 /activity /users /all /applications / vault ?eventName= delete_export_end &maxResults=10 &access_token= YOUR_ACCESS_TOKEN
    Admin Console message format
    Export deletion ended

    Delete Export Fail

    The name of the Vault event: Delete Export Fail.

    Event details
    Event name
    delete_export_fail
    Parameters
    additional_ details

    string

    Additional details pertaining to an audit log.
    matter_ id

    string

    The Matter ID an audit pertains to.
    organizational_ unit_ name

    string

    The organizational unit name.
    query

    string

    The user inputted query for search and exports.
    resource_ name

    string

    The resource name of the action, such as hold name or saved query name.
    resource_ url

    string

    The document URL of the document view.
    target_ user

    string

    The targeted user (such as user put on hold).
    Sample request
    GET https://admin.googleapis.com /admin /reports /v1 /activity /users /all /applications / vault ?eventName= delete_export_fail &maxResults=10 &access_token= YOUR_ACCESS_TOKEN
    Admin Console message format
    Export deletion failed

    Delete Investigation Begin

    The name of the Vault event: Delete Investigation Begin.

    Event details
    Event name
    delete_investigation_begin
    Parameters
    additional_ details

    string

    Additional details pertaining to an audit log.
    matter_ id

    string

    The Matter ID an audit pertains to.
    organizational_ unit_ name

    string

    The organizational unit name.
    query

    string

    The user inputted query for search and exports.
    resource_ name

    string

    The resource name of the action, such as hold name or saved query name.
    resource_ url

    string

    The document URL of the document view.
    target_ user

    string

    The targeted user (such as user put on hold).
    Sample request
    GET https://admin.googleapis.com /admin /reports /v1 /activity /users /all /applications / vault ?eventName= delete_investigation_begin &maxResults=10 &access_token= YOUR_ACCESS_TOKEN
    Admin Console message format
    Investigation deletion began

    Delete Investigation End

    The name of the Vault event: Delete Investigation End.

    Event details
    Event name
    delete_investigation_end
    Parameters
    additional_ details

    string

    Additional details pertaining to an audit log.
    matter_ id

    string

    The Matter ID an audit pertains to.
    organizational_ unit_ name

    string

    The organizational unit name.
    query

    string

    The user inputted query for search and exports.
    resource_ name

    string

    The resource name of the action, such as hold name or saved query name.
    resource_ url

    string

    The document URL of the document view.
    target_ user

    string

    The targeted user (such as user put on hold).
    Sample request
    GET https://admin.googleapis.com /admin /reports /v1 /activity /users /all /applications / vault ?eventName= delete_investigation_end &maxResults=10 &access_token= YOUR_ACCESS_TOKEN
    Admin Console message format
    Investigation deletion ended

    Delete Preservation Rule Begin

    The name of the Vault event: Delete Preservation Rule Begin.

    Event details
    Event name
    delete_preservation_rule_begin
    Parameters
    additional_ details

    string

    Additional details pertaining to an audit log.
    matter_ id

    string

    The Matter ID an audit pertains to.
    organizational_ unit_ name

    string

    The organizational unit name.
    query

    string

    The user inputted query for search and exports.
    resource_ name

    string

    The resource name of the action, such as hold name or saved query name.
    resource_ url

    string

    The document URL of the document view.
    target_ user

    string

    The targeted user (such as user put on hold).
    Sample request
    GET https://admin.googleapis.com /admin /reports /v1 /activity /users /all /applications / vault ?eventName= delete_preservation_rule_begin &maxResults=10 &access_token= YOUR_ACCESS_TOKEN
    Admin Console message format
    Preservation rule deletion began

    Delete Preservation Rule End

    The name of the Vault event: Delete Preservation Rule End.

    Event details
    Event name
    delete_preservation_rule_end
    Parameters
    additional_ details

    string

    Additional details pertaining to an audit log.
    matter_ id

    string

    The Matter ID an audit pertains to.
    organizational_ unit_ name

    string

    The organizational unit name.
    query

    string

    The user inputted query for search and exports.
    resource_ name

    string

    The resource name of the action, such as hold name or saved query name.
    resource_ url

    string

    The document URL of the document view.
    target_ user

    string

    The targeted user (such as user put on hold).
    Sample request
    GET https://admin.googleapis.com /admin /reports /v1 /activity /users /all /applications / vault ?eventName= delete_preservation_rule_end &maxResults=10 &access_token= YOUR_ACCESS_TOKEN
    Admin Console message format
    Preservation rule deletion ended

    Delete Retention Rule Begin

    The name of the Vault event: Delete Retention Rule Begin.

    Event details
    Event name
    delete_retention_rule_begin
    Parameters
    additional_ details

    string

    Additional details pertaining to an audit log.
    matter_ id

    string

    The Matter ID an audit pertains to.
    organizational_ unit_ name

    string

    The organizational unit name.
    query

    string

    The user inputted query for search and exports.
    resource_ name

    string

    The resource name of the action, such as hold name or saved query name.
    resource_ url

    string

    The document URL of the document view.
    target_ user

    string

    The targeted user (such as user put on hold).
    Sample request
    GET https://admin.googleapis.com /admin /reports /v1 /activity /users /all /applications / vault ?eventName= delete_retention_rule_begin &maxResults=10 &access_token= YOUR_ACCESS_TOKEN
    Admin Console message format
    Retention rule deletion began

    Delete Retention Rule End

    The name of the Vault event: Delete Retention Rule End.

    Event details
    Event name
    delete_retention_rule_end
    Parameters
    additional_ details

    string

    Additional details pertaining to an audit log.
    matter_ id

    string

    The Matter ID an audit pertains to.
    organizational_ unit_ name

    string

    The organizational unit name.
    query

    string

    The user inputted query for search and exports.
    resource_ name

    string

    The resource name of the action, such as hold name or saved query name.
    resource_ url

    string

    The document URL of the document view.
    target_ user

    string

    The targeted user (such as user put on hold).
    Sample request
    GET https://admin.googleapis.com /admin /reports /v1 /activity /users /all /applications / vault ?eventName= delete_retention_rule_end &maxResults=10 &access_token= YOUR_ACCESS_TOKEN
    Admin Console message format
    Retention rule deletion ended

    Delete Saved Query Begin

    The name of the Vault event: Delete Saved Query Begin.

    Event details
    Event name
    delete_saved_query_begin
    Parameters
    additional_ details

    string

    Additional details pertaining to an audit log.
    matter_ id

    string

    The Matter ID an audit pertains to.
    organizational_ unit_ name

    string

    The organizational unit name.
    query

    string

    The user inputted query for search and exports.
    resource_ name

    string

    The resource name of the action, such as hold name or saved query name.
    resource_ url

    string

    The document URL of the document view.
    target_ user

    string

    The targeted user (such as user put on hold).
    Sample request
    GET https://admin.googleapis.com /admin /reports /v1 /activity /users /all /applications / vault ?eventName= delete_saved_query_begin &maxResults=10 &access_token= YOUR_ACCESS_TOKEN
    Admin Console message format
    Saved query deletion began

    Delete Saved Query End

    The name of the Vault event: Delete Saved Query End.

    Event details
    Event name
    delete_saved_query_end
    Parameters
    additional_ details

    string

    Additional details pertaining to an audit log.
    matter_ id

    string

    The Matter ID an audit pertains to.
    organizational_ unit_ name

    string

    The organizational unit name.
    query

    string

    The user inputted query for search and exports.
    resource_ name

    string

    The resource name of the action, such as hold name or saved query name.
    resource_ url

    string

    The document URL of the document view.
    target_ user

    string

    The targeted user (such as user put on hold).
    Sample request
    GET https://admin.googleapis.com /admin /reports /v1 /activity /users /all /applications / vault ?eventName= delete_saved_query_end &maxResults=10 &access_token= YOUR_ACCESS_TOKEN
    Admin Console message format
    Saved query deletion ended

    The name of the Vault event: Deletion Search.

    Event details
    Event name
    deletion_search
    Parameters
    additional_ details

    string

    Additional details pertaining to an audit log.
    matter_ id

    string

    The Matter ID an audit pertains to.
    organizational_ unit_ name

    string

    The organizational unit name.
    query

    string

    The user inputted query for search and exports.
    resource_ name

    string

    The resource name of the action, such as hold name or saved query name.
    resource_ url

    string

    The document URL of the document view.
    target_ user

    string

    The targeted user (such as user put on hold).
    Sample request
    GET https://admin.googleapis.com /admin /reports /v1 /activity /users /all /applications / vault ?eventName= deletion_search &maxResults=10 &access_token= YOUR_ACCESS_TOKEN
    Admin Console message format
    User performed a deletion search

    The name of the Vault event: Download Count Per Account CSV.

    Event details
    Event name
    download_count_per_account_csv
    Parameters
    additional_ details

    string

    Additional details pertaining to an audit log.
    matter_ id

    string

    The Matter ID an audit pertains to.
    organizational_ unit_ name

    string

    The organizational unit name.
    query

    string

    The user inputted query for search and exports.
    resource_ name

    string

    The resource name of the action, such as hold name or saved query name.
    resource_ url

    string

    The document URL of the document view.
    target_ user

    string

    The targeted user (such as user put on hold).
    Sample request
    GET https://admin.googleapis.com /admin /reports /v1 /activity /users /all /applications / vault ?eventName= download_count_per_account_csv &maxResults=10 &access_token= YOUR_ACCESS_TOKEN
    Admin Console message format
    User downloaded count CSV results

    Download Cross Matter Litigation Hold Report

    The name of the Vault event: Download Cross Matter Litigation Hold Report.

    Event details
    Event name
    download_cross_matter_litigation_hold_report
    Parameters
    additional_ details

    string

    Additional details pertaining to an audit log.
    matter_ id

    string

    The Matter ID an audit pertains to.
    organizational_ unit_ name

    string

    The organizational unit name.
    query

    string

    The user inputted query for search and exports.
    resource_ name

    string

    The resource name of the action, such as hold name or saved query name.
    resource_ url

    string

    The document URL of the document view.
    target_ user

    string

    The targeted user (such as user put on hold).
    Sample request
    GET https://admin.googleapis.com /admin /reports /v1 /activity /users /all /applications / vault ?eventName= download_cross_matter_litigation_hold_report &maxResults=10 &access_token= YOUR_ACCESS_TOKEN
    Admin Console message format
    User downloaded cross matter litigation hold report

    Download Per Matter Litigation Hold Report

    The name of the Vault event: Download Per Matter Litigation Hold Report.

    Event details
    Event name
    download_per_matter_litigation_hold_report
    Parameters
    additional_ details

    string

    Additional details pertaining to an audit log.
    matter_ id

    string

    The Matter ID an audit pertains to.
    organizational_ unit_ name

    string

    The organizational unit name.
    query

    string

    The user inputted query for search and exports.
    resource_ name

    string

    The resource name of the action, such as hold name or saved query name.
    resource_ url

    string

    The document URL of the document view.
    target_ user

    string

    The targeted user (such as user put on hold).
    Sample request
    GET https://admin.googleapis.com /admin /reports /v1 /activity /users /all /applications / vault ?eventName= download_per_matter_litigation_hold_report &maxResults=10 &access_token= YOUR_ACCESS_TOKEN
    Admin Console message format
    User downloaded per matter litigation hold report

    Export

    The name of the Vault event: Export.

    Event details
    Event name
    export
    Parameters
    additional_ details

    string

    Additional details pertaining to an audit log.
    matter_ id

    string

    The Matter ID an audit pertains to.
    organizational_ unit_ name

    string

    The organizational unit name.
    query

    string

    The user inputted query for search and exports.
    resource_ name

    string

    The resource name of the action, such as hold name or saved query name.
    resource_ url

    string

    The document URL of the document view.
    target_ user

    string

    The targeted user (such as user put on hold).
    Sample request
    GET https://admin.googleapis.com /admin /reports /v1 /activity /users /all /applications / vault ?eventName= export &maxResults=10 &access_token= YOUR_ACCESS_TOKEN
    Admin Console message format
    User performed an export

    Export File Download

    The name of the Vault event: Export File Download.

    Event details
    Event name
    export_file_download
    Parameters
    additional_ details

    string

    Additional details pertaining to an audit log.
    matter_ id

    string

    The Matter ID an audit pertains to.
    organizational_ unit_ name

    string

    The organizational unit name.
    query

    string

    The user inputted query for search and exports.
    resource_ name

    string

    The resource name of the action, such as hold name or saved query name.
    resource_ url

    string

    The document URL of the document view.
    target_ user

    string

    The targeted user (such as user put on hold).
    Sample request
    GET https://admin.googleapis.com /admin /reports /v1 /activity /users /all /applications / vault ?eventName= export_file_download &maxResults=10 &access_token= YOUR_ACCESS_TOKEN
    Admin Console message format
    User downloaded an export file

    Get Count Operation

    The name of the Vault event: Get Count Operation.

    Event details
    Event name
    get_count_operation
    Parameters
    additional_ details

    string

    Additional details pertaining to an audit log.
    matter_ id

    string

    The Matter ID an audit pertains to.
    organizational_ unit_ name

    string

    The organizational unit name.
    query

    string

    The user inputted query for search and exports.
    resource_ name

    string

    The resource name of the action, such as hold name or saved query name.
    resource_ url

    string

    The document URL of the document view.
    target_ user

    string

    The targeted user (such as user put on hold).
    Sample request
    GET https://admin.googleapis.com /admin /reports /v1 /activity /users /all /applications / vault ?eventName= get_count_operation &maxResults=10 &access_token= YOUR_ACCESS_TOKEN
    Admin Console message format
    User viewed search count

    Legacy Export Download

    The name of the Vault event: Legacy Export Download.

    Event details
    Event name
    legacy_export_download
    Parameters
    additional_ details

    string

    Additional details pertaining to an audit log.
    matter_ id

    string

    The Matter ID an audit pertains to.
    organizational_ unit_ name

    string

    The organizational unit name.
    query

    string

    The user inputted query for search and exports.
    resource_ name

    string

    The resource name of the action, such as hold name or saved query name.
    resource_ url

    string

    The document URL of the document view.
    target_ user

    string

    The targeted user (such as user put on hold).
    Sample request
    GET https://admin.googleapis.com /admin /reports /v1 /activity /users /all /applications / vault ?eventName= legacy_export_download &maxResults=10 &access_token= YOUR_ACCESS_TOKEN
    Admin Console message format
    User downloaded a legacy export

    Modify Default Retention Period Begin

    The name of the Vault event: Modify Default Retention Period Begin.

    Event details
    Event name
    modify_default_retention_period_begin
    Parameters
    additional_ details

    string

    Additional details pertaining to an audit log.
    matter_ id

    string

    The Matter ID an audit pertains to.
    organizational_ unit_ name

    string

    The organizational unit name.
    query

    string

    The user inputted query for search and exports.
    resource_ name

    string

    The resource name of the action, such as hold name or saved query name.
    resource_ url

    string

    The document URL of the document view.
    target_ user

    string

    The targeted user (such as user put on hold).
    Sample request
    GET https://admin.googleapis.com /admin /reports /v1 /activity /users /all /applications / vault ?eventName= modify_default_retention_period_begin &maxResults=10 &access_token= YOUR_ACCESS_TOKEN
    Admin Console message format
    Default retention period modification began

    Modify Default Retention Period End

    The name of the Vault event: Modify Default Retention Period End.

    Event details
    Event name
    modify_default_retention_period_end
    Parameters
    additional_ details

    string

    Additional details pertaining to an audit log.
    matter_ id

    string

    The Matter ID an audit pertains to.
    organizational_ unit_ name

    string

    The organizational unit name.
    query

    string

    The user inputted query for search and exports.
    resource_ name

    string

    The resource name of the action, such as hold name or saved query name.
    resource_ url

    string

    The document URL of the document view.
    target_ user

    string

    The targeted user (such as user put on hold).
    Sample request
    GET https://admin.googleapis.com /admin /reports /v1 /activity /users /all /applications / vault ?eventName= modify_default_retention_period_end &maxResults=10 &access_token= YOUR_ACCESS_TOKEN
    Admin Console message format
    Default retention period modification ended

    Obsolete API Exports List

    The name of the Vault event: Obsolete API Exports List.

    Event details
    Event name
    obsolete_api_exports_list
    Parameters
    additional_ details

    string

    Additional details pertaining to an audit log.
    matter_ id

    string

    The Matter ID an audit pertains to.
    organizational_ unit_ name

    string

    The organizational unit name.
    query

    string

    The user inputted query for search and exports.
    resource_ name

    string

    The resource name of the action, such as hold name or saved query name.
    resource_ url

    string

    The document URL of the document view.
    target_ user

    string

    The targeted user (such as user put on hold).
    Sample request
    GET https://admin.googleapis.com /admin /reports /v1 /activity /users /all /applications / vault ?eventName= obsolete_api_exports_list &maxResults=10 &access_token= YOUR_ACCESS_TOKEN
    Admin Console message format
    Exports listed through the API

    Obsolete API Holds Insert

    The name of the Vault event: Obsolete API Holds Insert.

    Event details
    Event name
    obsolete_api_holds_insert
    Parameters
    additional_ details

    string

    Additional details pertaining to an audit log.
    matter_ id

    string

    The Matter ID an audit pertains to.
    organizational_ unit_ name

    string

    The organizational unit name.
    query

    string

    The user inputted query for search and exports.
    resource_ name

    string

    The resource name of the action, such as hold name or saved query name.
    resource_ url

    string

    The document URL of the document view.
    target_ user

    string

    The targeted user (such as user put on hold).
    Sample request
    GET https://admin.googleapis.com /admin /reports /v1 /activity /users /all /applications / vault ?eventName= obsolete_api_holds_insert &maxResults=10 &access_token= YOUR_ACCESS_TOKEN
    Admin Console message format
    Holds inserted through the API

    Obsolete API Holds List

    The name of the Vault event: Obsolete API Holds List.

    Event details
    Event name
    obsolete_api_holds_list
    Parameters
    additional_ details

    string

    Additional details pertaining to an audit log.
    matter_ id

    string

    The Matter ID an audit pertains to.
    organizational_ unit_ name

    string

    The organizational unit name.
    query

    string

    The user inputted query for search and exports.
    resource_ name

    string

    The resource name of the action, such as hold name or saved query name.
    resource_ url

    string

    The document URL of the document view.
    target_ user

    string

    The targeted user (such as user put on hold).
    Sample request
    GET https://admin.googleapis.com /admin /reports /v1 /activity /users /all /applications / vault ?eventName= obsolete_api_holds_list &maxResults=10 &access_token= YOUR_ACCESS_TOKEN
    Admin Console message format
    Holds listed through the API

    Obsolete API Matters Delete

    The name of the Vault event: Obsolete API Matters Delete.

    Event details
    Event name
    obsolete_api_matters_delete
    Parameters
    additional_ details

    string

    Additional details pertaining to an audit log.
    matter_ id

    string

    The Matter ID an audit pertains to.
    organizational_ unit_ name

    string

    The organizational unit name.
    query

    string

    The user inputted query for search and exports.
    resource_ name

    string

    The resource name of the action, such as hold name or saved query name.
    resource_ url

    string

    The document URL of the document view.
    target_ user

    string

    The targeted user (such as user put on hold).
    Sample request
    GET https://admin.googleapis.com /admin /reports /v1 /activity /users /all /applications / vault ?eventName= obsolete_api_matters_delete &maxResults=10 &access_token= YOUR_ACCESS_TOKEN
    Admin Console message format
    Matters deleted through the API

    Obsolete API Matters Get

    The name of the Vault event: Obsolete API Matters Get.

    Event details
    Event name
    obsolete_api_matters_get
    Parameters
    additional_ details

    string

    Additional details pertaining to an audit log.
    matter_ id

    string

    The Matter ID an audit pertains to.
    organizational_ unit_ name

    string

    The organizational unit name.
    query

    string

    The user inputted query for search and exports.
    resource_ name

    string

    The resource name of the action, such as hold name or saved query name.
    resource_ url

    string

    The document URL of the document view.
    target_ user

    string

    The targeted user (such as user put on hold).
    Sample request
    GET https://admin.googleapis.com /admin /reports /v1 /activity /users /all /applications / vault ?eventName= obsolete_api_matters_get &maxResults=10 &access_token= YOUR_ACCESS_TOKEN
    Admin Console message format
    Matter details retrieved through the API

    Obsolete API Matters Insert

    The name of the Vault event: Obsolete API Matters Insert.

    Event details
    Event name
    obsolete_api_matters_insert
    Parameters
    additional_ details

    string

    Additional details pertaining to an audit log.
    matter_ id

    string

    The Matter ID an audit pertains to.
    organizational_ unit_ name

    string

    The organizational unit name.
    query

    string

    The user inputted query for search and exports.
    resource_ name

    string

    The resource name of the action, such as hold name or saved query name.
    resource_ url

    string

    The document URL of the document view.
    target_ user

    string

    The targeted user (such as user put on hold).
    Sample request
    GET https://admin.googleapis.com /admin /reports /v1 /activity /users /all /applications / vault ?eventName= obsolete_api_matters_insert &maxResults=10 &access_token= YOUR_ACCESS_TOKEN
    Admin Console message format
    Matters inserted through the API

    Obsolete API Matters List

    The name of the Vault event: Obsolete API Matters List.

    Event details
    Event name
    obsolete_api_matters_list
    Parameters
    additional_ details

    string

    Additional details pertaining to an audit log.
    matter_ id

    string

    The Matter ID an audit pertains to.
    organizational_ unit_ name

    string

    The organizational unit name.
    query

    string

    The user inputted query for search and exports.
    resource_ name

    string

    The resource name of the action, such as hold name or saved query name.
    resource_ url

    string

    The document URL of the document view.
    target_ user

    string

    The targeted user (such as user put on hold).
    Sample request
    GET https://admin.googleapis.com /admin /reports /v1 /activity /users /all /applications / vault ?eventName= obsolete_api_matters_list &maxResults=10 &access_token= YOUR_ACCESS_TOKEN
    Admin Console message format
    Matters listed through the API

    Obsolete API Matters Update

    The name of the Vault event: Obsolete API Matters Update.

    Event details
    Event name
    obsolete_api_matters_update
    Parameters
    additional_ details

    string

    Additional details pertaining to an audit log.
    matter_ id

    string

    The Matter ID an audit pertains to.
    organizational_ unit_ name

    string

    The organizational unit name.
    query

    string

    The user inputted query for search and exports.
    resource_ name

    string

    The resource name of the action, such as hold name or saved query name.
    resource_ url

    string

    The document URL of the document view.
    target_ user

    string

    The targeted user (such as user put on hold).
    Sample request
    GET https://admin.googleapis.com /admin /reports /v1 /activity /users /all /applications / vault ?eventName= obsolete_api_matters_update &maxResults=10 &access_token= YOUR_ACCESS_TOKEN
    Admin Console message format
    A matter updated through the API

    Obsolete Preview Retention Rule Count

    The name of the Vault event: Obsolete Preview Retention Rule Count.

    Event details
    Event name
    obsolete_preview_retention_rule_count
    Parameters
    additional_ details

    string

    Additional details pertaining to an audit log.
    matter_ id

    string

    The Matter ID an audit pertains to.
    organizational_ unit_ name

    string

    The organizational unit name.
    query

    string

    The user inputted query for search and exports.
    resource_ name

    string

    The resource name of the action, such as hold name or saved query name.
    resource_ url

    string

    The document URL of the document view.
    target_ user

    string

    The targeted user (such as user put on hold).
    Sample request
    GET https://admin.googleapis.com /admin /reports /v1 /activity /users /all /applications / vault ?eventName= obsolete_preview_retention_rule_count &maxResults=10 &access_token= YOUR_ACCESS_TOKEN
    Admin Console message format
    User previewed retention rule count

    Preview Retention Rule

    The name of the Vault event: Preview Retention Rule.

    Event details
    Event name
    preview_retention_rule
    Parameters
    additional_ details

    string

    Additional details pertaining to an audit log.
    matter_ id

    string

    The Matter ID an audit pertains to.
    organizational_ unit_ name

    string

    The organizational unit name.
    query

    string

    The user inputted query for search and exports.
    resource_ name

    string

    The resource name of the action, such as hold name or saved query name.
    resource_ url

    string

    The document URL of the document view.
    target_ user

    string

    The targeted user (such as user put on hold).
    Sample request
    GET https://admin.googleapis.com /admin /reports /v1 /activity /users /all /applications / vault ?eventName= preview_retention_rule &maxResults=10 &access_token= YOUR_ACCESS_TOKEN
    Admin Console message format
    User previewed retention rule

    Remove Collaborator Begin

    The name of the Vault event: Remove Collaborator Begin.

    Event details
    Event name
    remove_collaborator_begin
    Parameters
    additional_ details

    string

    Additional details pertaining to an audit log.
    matter_ id

    string

    The Matter ID an audit pertains to.
    organizational_ unit_ name

    string

    The organizational unit name.
    query

    string

    The user inputted query for search and exports.
    resource_ name

    string

    The resource name of the action, such as hold name or saved query name.
    resource_ url

    string

    The document URL of the document view.
    target_ user

    string

    The targeted user (such as user put on hold).
    Sample request
    GET https://admin.googleapis.com /admin /reports /v1 /activity /users /all /applications / vault ?eventName= remove_collaborator_begin &maxResults=10 &access_token= YOUR_ACCESS_TOKEN
    Admin Console message format
    Collaborator removal began

    Remove Collaborator End

    The name of the Vault event: Remove Collaborator End.

    Event details
    Event name
    remove_collaborator_end
    Parameters
    additional_ details

    string

    Additional details pertaining to an audit log.
    matter_ id

    string

    The Matter ID an audit pertains to.
    organizational_ unit_ name

    string

    The organizational unit name.
    query

    string

    The user inputted query for search and exports.
    resource_ name

    string

    The resource name of the action, such as hold name or saved query name.
    resource_ url

    string

    The document URL of the document view.
    target_ user

    string

    The targeted user (such as user put on hold).
    Sample request
    GET https://admin.googleapis.com /admin /reports /v1 /activity /users /all /applications / vault ?eventName= remove_collaborator_end &maxResults=10 &access_token= YOUR_ACCESS_TOKEN
    Admin Console message format
    Collaborator removal ended

    Remove Litigation Hold Begin

    The name of the Vault event: Remove Litigation Hold Begin.

    Event details
    Event name
    remove_litigation_hold_begin
    Parameters
    additional_ details

    string

    Additional details pertaining to an audit log.
    matter_ id

    string

    The Matter ID an audit pertains to.
    organizational_ unit_ name

    string

    The organizational unit name.
    query

    string

    The user inputted query for search and exports.
    resource_ name

    string

    The resource name of the action, such as hold name or saved query name.
    resource_ url

    string

    The document URL of the document view.
    target_ user

    string

    The targeted user (such as user put on hold).
    Sample request
    GET https://admin.googleapis.com /admin /reports /v1 /activity /users /all /applications / vault ?eventName= remove_litigation_hold_begin &maxResults=10 &access_token= YOUR_ACCESS_TOKEN
    Admin Console message format
    Litigation hold removal began

    Remove Litigation Hold End

    The name of the Vault event: Remove Litigation Hold End.

    Event details
    Event name
    remove_litigation_hold_end
    Parameters
    additional_ details

    string

    Additional details pertaining to an audit log.
    matter_ id

    string

    The Matter ID an audit pertains to.
    organizational_ unit_ name

    string

    The organizational unit name.
    query

    string

    The user inputted query for search and exports.
    resource_ name

    string

    The resource name of the action, such as hold name or saved query name.
    resource_ url

    string

    The document URL of the document view.
    target_ user

    string

    The targeted user (such as user put on hold).
    Sample request
    GET https://admin.googleapis.com /admin /reports /v1 /activity /users /all /applications / vault ?eventName= remove_litigation_hold_end &maxResults=10 &access_token= YOUR_ACCESS_TOKEN
    Admin Console message format
    Litigation hold removal ended

    Reopen Investigation Begin

    The name of the Vault event: Reopen Investigation Begin.

    Event details
    Event name
    reopen_investigation_begin
    Parameters
    additional_ details

    string

    Additional details pertaining to an audit log.
    matter_ id

    string

    The Matter ID an audit pertains to.
    organizational_ unit_ name

    string

    The organizational unit name.
    query

    string

    The user inputted query for search and exports.
    resource_ name

    string

    The resource name of the action, such as hold name or saved query name.
    resource_ url

    string

    The document URL of the document view.
    target_ user

    string

    The targeted user (such as user put on hold).
    Sample request
    GET https://admin.googleapis.com /admin /reports /v1 /activity /users /all /applications / vault ?eventName= reopen_investigation_begin &maxResults=10 &access_token= YOUR_ACCESS_TOKEN
    Admin Console message format
    Investigation reopening began

    Reopen Investigation End

    The name of the Vault event: Reopen Investigation End.

    Event details
    Event name
    reopen_investigation_end
    Parameters
    additional_ details

    string

    Additional details pertaining to an audit log.
    matter_ id

    string

    The Matter ID an audit pertains to.
    organizational_ unit_ name

    string

    The organizational unit name.
    query

    string

    The user inputted query for search and exports.
    resource_ name

    string

    The resource name of the action, such as hold name or saved query name.
    resource_ url

    string

    The document URL of the document view.
    target_ user

    string

    The targeted user (such as user put on hold).
    Sample request
    GET https://admin.googleapis.com /admin /reports /v1 /activity /users /all /applications / vault ?eventName= reopen_investigation_end &maxResults=10 &access_token= YOUR_ACCESS_TOKEN
    Admin Console message format
    Investigation reopening ended

    Restore Investigation Begin

    The name of the Vault event: Restore Investigation Begin.

    Event details
    Event name
    restore_investigation_begin
    Parameters
    additional_ details

    string

    Additional details pertaining to an audit log.
    matter_ id

    string

    The Matter ID an audit pertains to.
    organizational_ unit_ name

    string

    The organizational unit name.
    query

    string

    The user inputted query for search and exports.
    resource_ name

    string

    The resource name of the action, such as hold name or saved query name.
    resource_ url

    string

    The document URL of the document view.
    target_ user

    string

    The targeted user (such as user put on hold).
    Sample request
    GET https://admin.googleapis.com /admin /reports /v1 /activity /users /all /applications / vault ?eventName= restore_investigation_begin &maxResults=10 &access_token= YOUR_ACCESS_TOKEN
    Admin Console message format
    Investigation restoration began

    Restore Investigation End

    The name of the Vault event: Restore Investigation End.

    Event details
    Event name
    restore_investigation_end
    Parameters
    additional_ details

    string

    Additional details pertaining to an audit log.
    matter_ id

    string

    The Matter ID an audit pertains to.
    organizational_ unit_ name

    string

    The organizational unit name.
    query

    string

    The user inputted query for search and exports.
    resource_ name

    string

    The resource name of the action, such as hold name or saved query name.
    resource_ url

    string

    The document URL of the document view.
    target_ user

    string

    The targeted user (such as user put on hold).
    Sample request
    GET https://admin.googleapis.com /admin /reports /v1 /activity /users /all /applications / vault ?eventName= restore_investigation_end &maxResults=10 &access_token= YOUR_ACCESS_TOKEN
    Admin Console message format
    Investigation restoration ended

    The name of the Vault event: Search.

    Event details
    Event name
    search
    Parameters
    additional_ details

    string

    Additional details pertaining to an audit log.
    matter_ id

    string

    The Matter ID an audit pertains to.
    organizational_ unit_ name

    string

    The organizational unit name.
    query

    string

    The user inputted query for search and exports.
    resource_ name

    string

    The resource name of the action, such as hold name or saved query name.
    resource_ url

    string

    The document URL of the document view.
    target_ user

    string

    The targeted user (such as user put on hold).
    Sample request
    GET https://admin.googleapis.com /admin /reports /v1 /activity /users /all /applications / vault ?eventName= search &maxResults=10 &access_token= YOUR_ACCESS_TOKEN
    Admin Console message format
    User performed a search

    Search Count

    The name of the Vault event: Search Count.

    Event details
    Event name
    search_count
    Parameters
    additional_ details

    string

    Additional details pertaining to an audit log.
    matter_ id

    string

    The Matter ID an audit pertains to.
    organizational_ unit_ name

    string

    The organizational unit name.
    query

    string

    The user inputted query for search and exports.
    resource_ name

    string

    The resource name of the action, such as hold name or saved query name.
    resource_ url

    string

    The document URL of the document view.
    target_ user

    string

    The targeted user (such as user put on hold).
    Sample request
    GET https://admin.googleapis.com /admin /reports /v1 /activity /users /all /applications / vault ?eventName= search_count &maxResults=10 &access_token= YOUR_ACCESS_TOKEN
    Admin Console message format
    User ran a count search

    Update Investigation Details Begin

    The name of the Vault event: Update Investigation Details Begin.

    Event details
    Event name
    update_investigation_details_begin
    Parameters
    additional_ details

    string

    Additional details pertaining to an audit log.
    matter_ id

    string

    The Matter ID an audit pertains to.
    organizational_ unit_ name

    string

    The organizational unit name.
    query

    string

    The user inputted query for search and exports.
    resource_ name

    string

    The resource name of the action, such as hold name or saved query name.
    resource_ url

    string

    The document URL of the document view.
    target_ user

    string

    The targeted user (such as user put on hold).
    Sample request
    GET https://admin.googleapis.com /admin /reports /v1 /activity /users /all /applications / vault ?eventName= update_investigation_details_begin &maxResults=10 &access_token= YOUR_ACCESS_TOKEN
    Admin Console message format
    Investigation details update began

    Update Investigation Details End

    The name of the Vault event: Update Investigation Details End.

    Event details
    Event name
    update_investigation_details_end
    Parameters
    additional_ details

    string

    Additional details pertaining to an audit log.
    matter_ id

    string

    The Matter ID an audit pertains to.
    organizational_ unit_ name

    string

    The organizational unit name.
    query

    string

    The user inputted query for search and exports.
    resource_ name

    string

    The resource name of the action, such as hold name or saved query name.
    resource_ url

    string

    The document URL of the document view.
    target_ user

    string

    The targeted user (such as user put on hold).
    Sample request
    GET https://admin.googleapis.com /admin /reports /v1 /activity /users /all /applications / vault ?eventName= update_investigation_details_end &maxResults=10 &access_token= YOUR_ACCESS_TOKEN
    Admin Console message format
    Investigation details update ended

    Update Preservation Rule Add Holds Begin

    The name of the Vault event: Update Preservation Rule Add Holds Begin.

    Event details
    Event name
    update_preservation_rule_add_holds_begin
    Parameters
    additional_ details

    string

    Additional details pertaining to an audit log.
    matter_ id

    string

    The Matter ID an audit pertains to.
    organizational_ unit_ name

    string

    The organizational unit name.
    query

    string

    The user inputted query for search and exports.
    resource_ name

    string

    The resource name of the action, such as hold name or saved query name.
    resource_ url

    string

    The document URL of the document view.
    target_ user

    string

    The targeted user (such as user put on hold).
    Sample request
    GET https://admin.googleapis.com /admin /reports /v1 /activity /users /all /applications / vault ?eventName= update_preservation_rule_add_holds_begin &maxResults=10 &access_token= YOUR_ACCESS_TOKEN
    Admin Console message format
    Preservation rule addition update began

    Update Preservation Rule Add Holds End

    The name of the Vault event: Update Preservation Rule Add Holds End.

    Event details
    Event name
    update_preservation_rule_add_holds_end
    Parameters
    additional_ details

    string

    Additional details pertaining to an audit log.
    matter_ id

    string

    The Matter ID an audit pertains to.
    organizational_ unit_ name

    string

    The organizational unit name.
    query

    string

    The user inputted query for search and exports.
    resource_ name

    string

    The resource name of the action, such as hold name or saved query name.
    resource_ url

    string

    The document URL of the document view.
    target_ user

    string

    The targeted user (such as user put on hold).
    Sample request
    GET https://admin.googleapis.com /admin /reports /v1 /activity /users /all /applications / vault ?eventName= update_preservation_rule_add_holds_end &maxResults=10 &access_token= YOUR_ACCESS_TOKEN
    Admin Console message format
    Preservation rule addition update ended

    Update Preservation Rule Query Begin

    The name of the Vault event: Update Preservation Rule Query Begin.

    Event details
    Event name
    update_preservation_rule_query_begin
    Parameters
    additional_ details

    string

    Additional details pertaining to an audit log.
    matter_ id

    string

    The Matter ID an audit pertains to.
    organizational_ unit_ name

    string

    The organizational unit name.
    query

    string

    The user inputted query for search and exports.
    resource_ name

    string

    The resource name of the action, such as hold name or saved query name.
    resource_ url

    string

    The document URL of the document view.
    target_ user

    string

    The targeted user (such as user put on hold).
    Sample request
    GET https://admin.googleapis.com /admin /reports /v1 /activity /users /all /applications / vault ?eventName= update_preservation_rule_query_begin &maxResults=10 &access_token= YOUR_ACCESS_TOKEN
    Admin Console message format
    Preservation rule query update began

    Update Preservation Rule Query End

    The name of the Vault event: Update Preservation Rule Query End.

    Event details
    Event name
    update_preservation_rule_query_end
    Parameters
    additional_ details

    string

    Additional details pertaining to an audit log.
    matter_ id

    string

    The Matter ID an audit pertains to.
    organizational_ unit_ name

    string

    The organizational unit name.
    query

    string

    The user inputted query for search and exports.
    resource_ name

    string

    The resource name of the action, such as hold name or saved query name.
    resource_ url

    string

    The document URL of the document view.
    target_ user

    string

    The targeted user (such as user put on hold).
    Sample request
    GET https://admin.googleapis.com /admin /reports /v1 /activity /users /all /applications / vault ?eventName= update_preservation_rule_query_end &maxResults=10 &access_token= YOUR_ACCESS_TOKEN
    Admin Console message format
    Preservation rule query update ended

    Update Preservation Rule Remove Holds Begin

    The name of the Vault event: Update Preservation Rule Remove Holds Begin.

    Event details
    Event name
    update_preservation_rule_remove_holds_begin
    Parameters
    additional_ details

    string

    Additional details pertaining to an audit log.
    matter_ id

    string

    The Matter ID an audit pertains to.
    organizational_ unit_ name

    string

    The organizational unit name.
    query

    string

    The user inputted query for search and exports.
    resource_ name

    string

    The resource name of the action, such as hold name or saved query name.
    resource_ url

    string

    The document URL of the document view.
    target_ user

    string

    The targeted user (such as user put on hold).
    Sample request
    GET https://admin.googleapis.com /admin /reports /v1 /activity /users /all /applications / vault ?eventName= update_preservation_rule_remove_holds_begin &maxResults=10 &access_token= YOUR_ACCESS_TOKEN
    Admin Console message format
    Preservation rule removal update began

    Update Preservation Rule Remove Holds End

    The name of the Vault event: Update Preservation Rule Remove Holds End.

    Event details
    Event name
    update_preservation_rule_remove_holds_end
    Parameters
    additional_ details

    string

    Additional details pertaining to an audit log.
    matter_ id

    string

    The Matter ID an audit pertains to.
    organizational_ unit_ name

    string

    The organizational unit name.
    query

    string

    The user inputted query for search and exports.
    resource_ name

    string

    The resource name of the action, such as hold name or saved query name.
    resource_ url

    string

    The document URL of the document view.
    target_ user

    string

    The targeted user (such as user put on hold).
    Sample request
    GET https://admin.googleapis.com /admin /reports /v1 /activity /users /all /applications / vault ?eventName= update_preservation_rule_remove_holds_end &maxResults=10 &access_token= YOUR_ACCESS_TOKEN
    Admin Console message format
    Preservation rule removal update ended

    Update Retention Rule Begin

    The name of the Vault event: Update Retention Rule Begin.

    Event details
    Event name
    update_retention_rule_begin
    Parameters
    additional_ details

    string

    Additional details pertaining to an audit log.
    matter_ id

    string

    The Matter ID an audit pertains to.
    organizational_ unit_ name

    string

    The organizational unit name.
    query

    string

    The user inputted query for search and exports.
    resource_ name

    string

    The resource name of the action, such as hold name or saved query name.
    resource_ url

    string

    The document URL of the document view.
    target_ user

    string

    The targeted user (such as user put on hold).
    Sample request
    GET https://admin.googleapis.com /admin /reports /v1 /activity /users /all /applications / vault ?eventName= update_retention_rule_begin &maxResults=10 &access_token= YOUR_ACCESS_TOKEN
    Admin Console message format
    Retention rule update began

    Update Retention Rule End

    The name of the Vault event: Update Retention Rule End.

    Event details
    Event name
    update_retention_rule_end
    Parameters
    additional_ details

    string

    Additional details pertaining to an audit log.
    matter_ id

    string

    The Matter ID an audit pertains to.
    organizational_ unit_ name

    string

    The organizational unit name.
    query

    string

    The user inputted query for search and exports.
    resource_ name

    string

    The resource name of the action, such as hold name or saved query name.
    resource_ url

    string

    The document URL of the document view.
    target_ user

    string

    The targeted user (such as user put on hold).
    Sample request
    GET https://admin.googleapis.com /admin /reports /v1 /activity /users /all /applications / vault ?eventName= update_retention_rule_end &maxResults=10 &access_token= YOUR_ACCESS_TOKEN
    Admin Console message format
    Retention rule update ended

    Update Retention Settings

    The name of the Vault event: Update Retention Settings.

    Event details
    Event name
    update_retention_settings
    Parameters
    additional_ details

    string

    Additional details pertaining to an audit log.
    matter_ id

    string

    The Matter ID an audit pertains to.
    organizational_ unit_ name

    string

    The organizational unit name.
    query

    string

    The user inputted query for search and exports.
    resource_ name

    string

    The resource name of the action, such as hold name or saved query name.
    resource_ url

    string

    The document URL of the document view.
    target_ user

    string

    The targeted user (such as user put on hold).
    Sample request
    GET https://admin.googleapis.com /admin /reports /v1 /activity /users /all /applications / vault ?eventName= update_retention_settings &maxResults=10 &access_token= YOUR_ACCESS_TOKEN
    Admin Console message format
    User updated retention settings

    Update Saved Query Details Begin

    The name of the Vault event: Update Saved Query Details Begin.

    Event details
    Event name
    update_saved_query_details_begin
    Parameters
    additional_ details

    string

    Additional details pertaining to an audit log.
    matter_ id

    string

    The Matter ID an audit pertains to.
    organizational_ unit_ name

    string

    The organizational unit name.
    query

    string

    The user inputted query for search and exports.
    resource_ name

    string

    The resource name of the action, such as hold name or saved query name.
    resource_ url

    string

    The document URL of the document view.
    target_ user

    string

    The targeted user (such as user put on hold).
    Sample request
    GET https://admin.googleapis.com /admin /reports /v1 /activity /users /all /applications / vault ?eventName= update_saved_query_details_begin &maxResults=10 &access_token= YOUR_ACCESS_TOKEN
    Admin Console message format
    Saved query details update began

    Update Saved Query Details End

    The name of the Vault event: Update Saved Query Details End.

    Event details
    Event name
    update_saved_query_details_end
    Parameters
    additional_ details

    string

    Additional details pertaining to an audit log.
    matter_ id

    string

    The Matter ID an audit pertains to.
    organizational_ unit_ name

    string

    The organizational unit name.
    query

    string

    The user inputted query for search and exports.
    resource_ name

    string

    The resource name of the action, such as hold name or saved query name.
    resource_ url

    string

    The document URL of the document view.
    target_ user

    string

    The targeted user (such as user put on hold).
    Sample request
    GET https://admin.googleapis.com /admin /reports /v1 /activity /users /all /applications / vault ?eventName= update_saved_query_details_end &maxResults=10 &access_token= YOUR_ACCESS_TOKEN
    Admin Console message format
    Saved query details update ended

    View Cross Matter Litigation Hold Report

    The name of the Vault event: View Cross Matter Litigation Hold Report.

    Event details
    Event name
    view_cross_matter_litigation_hold_report
    Parameters
    additional_ details

    string

    Additional details pertaining to an audit log.
    matter_ id

    string

    The Matter ID an audit pertains to.
    organizational_ unit_ name

    string

    The organizational unit name.
    query

    string

    The user inputted query for search and exports.
    resource_ name

    string

    The resource name of the action, such as hold name or saved query name.
    resource_ url

    string

    The document URL of the document view.
    target_ user

    string

    The targeted user (such as user put on hold).
    Sample request
    GET https://admin.googleapis.com /admin /reports /v1 /activity /users /all /applications / vault ?eventName= view_cross_matter_litigation_hold_report &maxResults=10 &access_token= YOUR_ACCESS_TOKEN
    Admin Console message format
    User viewed a cross matter litigation hold report

    View Custodian Litigation Hold Report

    The name of the Vault event: View Custodian Litigation Hold Report.

    Event details
    Event name
    view_custodian_litigation_hold_report
    Parameters
    additional_ details

    string

    Additional details pertaining to an audit log.
    matter_ id

    string

    The Matter ID an audit pertains to.
    organizational_ unit_ name

    string

    The organizational unit name.
    query

    string

    The user inputted query for search and exports.
    resource_ name

    string

    The resource name of the action, such as hold name or saved query name.
    resource_ url

    string

    The document URL of the document view.
    target_ user

    string

    The targeted user (such as user put on hold).
    Sample request
    GET https://admin.googleapis.com /admin /reports /v1 /activity /users /all /applications / vault ?eventName= view_custodian_litigation_hold_report &maxResults=10 &access_token= YOUR_ACCESS_TOKEN
    Admin Console message format
    User viewed a custodian litigation hold report

    View Document

    The name of the Vault event: View Document.

    Event details
    Event name
    view_document
    Parameters
    additional_ details

    string

    Additional details pertaining to an audit log.
    matter_ id

    string

    The Matter ID an audit pertains to.
    organizational_ unit_ name

    string

    The organizational unit name.
    query

    string

    The user inputted query for search and exports.
    resource_ name

    string

    The resource name of the action, such as hold name or saved query name.
    resource_ url

    string

    The document URL of the document view.
    target_ user

    string

    The targeted user (such as user put on hold).
    Sample request
    GET https://admin.googleapis.com /admin /reports /v1 /activity /users /all /applications / vault ?eventName= view_document &maxResults=10 &access_token= YOUR_ACCESS_TOKEN
    Admin Console message format
    User viewed a document

    View Document Information

    The name of the Vault event: View Document Information.

    Event details
    Event name
    view_document_information
    Parameters
    additional_ details

    string

    Additional details pertaining to an audit log.
    matter_ id

    string

    The Matter ID an audit pertains to.
    organizational_ unit_ name

    string

    The organizational unit name.
    query

    string

    The user inputted query for search and exports.
    resource_ name

    string

    The resource name of the action, such as hold name or saved query name.
    resource_ url

    string

    The document URL of the document view.
    target_ user

    string

    The targeted user (such as user put on hold).
    Sample request
    GET https://admin.googleapis.com /admin /reports /v1 /activity /users /all /applications / vault ?eventName= view_document_information &maxResults=10 &access_token= YOUR_ACCESS_TOKEN
    Admin Console message format
    User viewed a document’s information

    View External Document

    The name of the Vault event: View External Document.

    Event details
    Event name
    view_external_document
    Parameters
    additional_ details

    string

    Additional details pertaining to an audit log.
    matter_ id

    string

    The Matter ID an audit pertains to.
    organizational_ unit_ name

    string

    The organizational unit name.
    query

    string

    The user inputted query for search and exports.
    resource_ name

    string

    The resource name of the action, such as hold name or saved query name.
    resource_ url

    string

    The document URL of the document view.
    target_ user

    string

    The targeted user (such as user put on hold).
    Sample request
    GET https://admin.googleapis.com /admin /reports /v1 /activity /users /all /applications / vault ?eventName= view_external_document &maxResults=10 &access_token= YOUR_ACCESS_TOKEN
    Admin Console message format
    User viewed an external document

    View Investigation

    The name of the Vault event: View Investigation.

    Event details
    Event name
    view_investigation
    Parameters
    additional_ details

    string

    Additional details pertaining to an audit log.
    matter_ id

    string

    The Matter ID an audit pertains to.
    organizational_ unit_ name

    string

    The organizational unit name.
    query

    string

    The user inputted query for search and exports.
    resource_ name

    string

    The resource name of the action, such as hold name or saved query name.
    resource_ url

    string

    The document URL of the document view.
    target_ user

    string

    The targeted user (such as user put on hold).
    Sample request
    GET https://admin.googleapis.com /admin /reports /v1 /activity /users /all /applications / vault ?eventName= view_investigation &maxResults=10 &access_token= YOUR_ACCESS_TOKEN
    Admin Console message format
    User viewed a matter

    View Matter Audit Log

    The name of the Vault event: View Matter Audit Log.

    Event details
    Event name
    view_matter_audit_log
    Parameters
    additional_ details

    string

    Additional details pertaining to an audit log.
    matter_ id

    string

    The Matter ID an audit pertains to.
    organizational_ unit_ name

    string

    The organizational unit name.
    query

    string

    The user inputted query for search and exports.
    resource_ name

    string

    The resource name of the action, such as hold name or saved query name.
    resource_ url

    string

    The document URL of the document view.
    target_ user

    string

    The targeted user (such as user put on hold).
    Sample request
    GET https://admin.googleapis.com /admin /reports /v1 /activity /users /all /applications / vault ?eventName= view_matter_audit_log &maxResults=10 &access_token= YOUR_ACCESS_TOKEN
    Admin Console message format
    User viewed a matter’s log events

    View Per Matter Litigation Hold Report

    The name of the Vault event: View Per Matter Litigation Hold Report.

    Event details
    Event name
    view_per_matter_litigation_hold_report
    Parameters
    additional_ details

    string

    Additional details pertaining to an audit log.
    matter_ id

    string

    The Matter ID an audit pertains to.
    organizational_ unit_ name

    string

    The organizational unit name.
    query

    string

    The user inputted query for search and exports.
    resource_ name

    string

    The resource name of the action, such as hold name or saved query name.
    resource_ url

    string

    The document URL of the document view.
    target_ user

    string

    The targeted user (such as user put on hold).
    Sample request
    GET https://admin.googleapis.com /admin /reports /v1 /activity /users /all /applications / vault ?eventName= view_per_matter_litigation_hold_report &maxResults=10 &access_token= YOUR_ACCESS_TOKEN
    Admin Console message format
    User viewed a matter litigation hold report

    View Retention Policy

    The name of the Vault event: View Retention Policy.

    Event details
    Event name
    view_retention_policy
    Parameters
    additional_ details

    string

    Additional details pertaining to an audit log.
    matter_ id

    string

    The Matter ID an audit pertains to.
    organizational_ unit_ name

    string

    The organizational unit name.
    query

    string

    The user inputted query for search and exports.
    resource_ name

    string

    The resource name of the action, such as hold name or saved query name.
    resource_ url

    string

    The document URL of the document view.
    target_ user

    string

    The targeted user (such as user put on hold).
    Sample request
    GET https://admin.googleapis.com /admin /reports /v1 /activity /users /all /applications / vault ?eventName= view_retention_policy &maxResults=10 &access_token= YOUR_ACCESS_TOKEN
    Admin Console message format
    User viewed retention policy

    View Retention Settings

    The name of the Vault event: View Retention Settings.

    Event details
    Event name
    view_retention_settings
    Parameters
    additional_ details

    string

    Additional details pertaining to an audit log.
    matter_ id

    string

    The Matter ID an audit pertains to.
    organizational_ unit_ name

    string

    The organizational unit name.
    query

    string

    The user inputted query for search and exports.
    resource_ name

    string

    The resource name of the action, such as hold name or saved query name.
    resource_ url

    string

    The document URL of the document view.
    target_ user

    string

    The targeted user (such as user put on hold).
    Sample request
    GET https://admin.googleapis.com /admin /reports /v1 /activity /users /all /applications / vault ?eventName= view_retention_settings &maxResults=10 &access_token= YOUR_ACCESS_TOKEN
    Admin Console message format
    User viewed retention settings

    View System Audit Log

    The name of the Vault event: View System Audit Log.

    Event details
    Event name
    view_system_audit_log
    Parameters
    additional_ details

    string

    Additional details pertaining to an audit log.
    matter_ id

    string

    The Matter ID an audit pertains to.
    organizational_ unit_ name

    string

    The organizational unit name.
    query

    string

    The user inputted query for search and exports.
    resource_ name

    string

    The resource name of the action, such as hold name or saved query name.
    resource_ url

    string

    The document URL of the document view.
    target_ user

    string

    The targeted user (such as user put on hold).
    Sample request
    GET https://admin.googleapis.com /admin /reports /v1 /activity /users /all /applications / vault ?eventName= view_system_audit_log &maxResults=10 &access_token= YOUR_ACCESS_TOKEN
    Admin Console message format
    User viewed the system’s log events
    Design a Mobile Site
    View Site in Mobile | Classic
    Share by: