Admin Audit Activity Events - Email Settings

This document lists the events and parameters for Email Settings Admin Audit activity events. You can retrieve these events by calling Activities.list() with applicationName=admin.

Email Settings

Events of this type are returned with type=EMAIL_SETTINGS.

Drop from Quarantine

The title for the event release from quarantine. This title shows the message was dropped from quarantine.

Event details
Event name DROP_FROM_QUARANTINE
Parameters
EMAIL_LOG_SEARCH_MSG_ID

string

The log search filter's email message ID.

QUARANTINE_NAME

string

The name of the quarantine.

Sample request
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/admin?eventName=DROP_FROM_QUARANTINE&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format
A message with email message id of {EMAIL_LOG_SEARCH_MSG_ID} was dropped from the {QUARANTINE_NAME} quarantine.

Email life of a message search

Email life of a message search is launched.

Event details
Event name EMAIL_LIFE_OF_A_MESSAGE
Parameters
EMAIL_LIFE_OF_A_MESSAGE_FETCH_EMAIL_DETAILS

boolean

Fetch details flag for life of a message search.

EMAIL_LOG_SEARCH_MSG_ID

string

The log search filter's email message ID.

EMAIL_LOG_SEARCH_RECIPIENT

string

The log search filter's email recipient.

Sample request
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/admin?eventName=EMAIL_LIFE_OF_A_MESSAGE&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format
Email life of a message search description
Event details
Event name EMAIL_LOG_SEARCH
Parameters
EMAIL_LOG_SEARCH_END_DATE

string

The log search filter's ending date.

EMAIL_LOG_SEARCH_MSG_ID

string

The log search filter's email message ID.

EMAIL_LOG_SEARCH_RECIPIENT

string

The log search filter's email recipient.

EMAIL_LOG_SEARCH_SENDER

string

The log search filter's email sender.

EMAIL_LOG_SEARCH_SMTP_RECIPIENT_IP

string

The log search filter's email recipient's IP address.

EMAIL_LOG_SEARCH_SMTP_SENDER_IP

string

The log search filter's email sender's IP address.

EMAIL_LOG_SEARCH_START_DATE

string

The log search filter's starting date.

Sample request
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/admin?eventName=EMAIL_LOG_SEARCH&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format
An email log search is performed for logs from {EMAIL_LOG_SEARCH_START_DATE} to {EMAIL_LOG_SEARCH_END_DATE} with a sender of [{EMAIL_LOG_SEARCH_SENDER}], a recipient of [{EMAIL_LOG_SEARCH_RECIPIENT}], and an email message id of [{EMAIL_LOG_SEARCH_MSG_ID}]

Email Restore

Event details
Event name EMAIL_UNDELETE
Parameters
END_DATE

string

The ending date.

START_DATE

string

The starting date.

USER_EMAIL

string

The user's primary email address.

Sample request
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/admin?eventName=EMAIL_UNDELETE&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format
Email restoration from {START_DATE} to {END_DATE} initiated for {USER_EMAIL}

Email Setting Change

Event details
Event name CHANGE_EMAIL_SETTING
Parameters
DOMAIN_NAME

string

The primary domain name.

GROUP_EMAIL

string

The group's primary email address.

NEW_VALUE

string

The new SETTING_NAME value that was set during this event.

OLD_VALUE

string

The previous SETTING_NAME value that was replaced during this event.

ORG_UNIT_NAME

string

The organizational unit (OU) name (path).

SETTING_NAME

string

The unique name (ID) of the setting that was changed.

Sample request
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/admin?eventName=CHANGE_EMAIL_SETTING&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format
{SETTING_NAME} for email service in your organization changed from {OLD_VALUE} to {NEW_VALUE}

Gmail Setting Change

Event details
Event name CHANGE_GMAIL_SETTING
Parameters
ENABLED_SETTING

string

Enabled setting; will be used for settings that can be enabled or disabled.

ORG_UNIT_NAME

string

The organizational unit (OU) name (path).

SETTING_DESCRIPTION

string

The setting's description.

SETTING_ENABLED

boolean

Setting enabled; will be used for settings that can be enabled or disabled.

SETTING_NAME

string

The unique name (ID) of the setting that was changed.

USER_DEFINED_SETTING_NAME

string

The name of the user-defined setting.

Sample request
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/admin?eventName=CHANGE_GMAIL_SETTING&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format
Gmail setting {SETTING_NAME} was modified

Gmail Setting Creation

Event details
Event name CREATE_GMAIL_SETTING
Parameters
ORG_UNIT_NAME

string

The organizational unit (OU) name (path).

SETTING_DESCRIPTION

string

The setting's description.

SETTING_NAME

string

The unique name (ID) of the setting that was changed.

USER_DEFINED_SETTING_NAME

string

The name of the user-defined setting.

Sample request
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/admin?eventName=CREATE_GMAIL_SETTING&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format
New gmail setting {SETTING_NAME} was added

Gmail Setting Deletion

Event details
Event name DELETE_GMAIL_SETTING
Parameters
ORG_UNIT_NAME

string

The organizational unit (OU) name (path).

SETTING_DESCRIPTION

string

The setting's description.

SETTING_NAME

string

The unique name (ID) of the setting that was changed.

USER_DEFINED_SETTING_NAME

string

The name of the user-defined setting.

Sample request
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/admin?eventName=DELETE_GMAIL_SETTING&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format
Gmail setting {SETTING_NAME} was deleted

Reject from Quarantine

The title for the event release from quarantine. This title shows the message was rejected from quarantine.

Event details
Event name REJECT_FROM_QUARANTINE
Parameters
EMAIL_LOG_SEARCH_MSG_ID

string

The log search filter's email message ID.

QUARANTINE_NAME

string

The name of the quarantine.

Sample request
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/admin?eventName=REJECT_FROM_QUARANTINE&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format
A message with email message id of {EMAIL_LOG_SEARCH_MSG_ID} was rejected with the default reject message from the {QUARANTINE_NAME} quarantine.

Release from Quarantine

The title for the event release from quarantine. This title shows the message was released from quarantine.

Event details
Event name RELEASE_FROM_QUARANTINE
Parameters
EMAIL_LOG_SEARCH_MSG_ID

string

The log search filter's email message ID.

QUARANTINE_NAME

string

The name of the quarantine.

Sample request
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/admin?eventName=RELEASE_FROM_QUARANTINE&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format
A message with email message id of {EMAIL_LOG_SEARCH_MSG_ID} was released from the {QUARANTINE_NAME} quarantine.