Admin Audit Activity Events - User Settings

Stay organized with collections Save and categorize content based on your preferences.

This document lists the events and parameters for User Settings Admin Audit activity events. You can retrieve these events by calling Activities.list() with applicationName=admin.

User Settings

Events of this type are returned with type=USER_SETTINGS.

2-step Verification Scratch Codes Deletion

Event details
Event name DELETE_2SV_SCRATCH_CODES
Parameters
USER_EMAIL

string

The user's primary email address.

Sample request
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/admin?eventName=DELETE_2SV_SCRATCH_CODES&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format
2-step verification scratch codes of the user {USER_EMAIL} deleted

2-step Verification Scratch Codes Generate

Event details
Event name GENERATE_2SV_SCRATCH_CODES
Parameters
USER_EMAIL

string

The user's primary email address.

Sample request
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/admin?eventName=GENERATE_2SV_SCRATCH_CODES&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format
New 2-step verification scratch codes generated for the user {USER_EMAIL}

3-legged OAuth Device Tokens Revoke

Event details
Event name REVOKE_3LO_DEVICE_TOKENS
Parameters
DEVICE_ID

string

The device's ID.

DEVICE_TYPE

string

The device's type.

USER_EMAIL

string

The user's primary email address.

Sample request
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/admin?eventName=REVOKE_3LO_DEVICE_TOKENS&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format
3-legged OAuth tokens issued by user {USER_EMAIL} for the device type {DEVICE_TYPE} and id {DEVICE_ID} were revoked

3-legged OAuth Token Revoke

Event details
Event name REVOKE_3LO_TOKEN
Parameters
APP_ID

string

The application ID whose access is managed by the token.

USER_EMAIL

string

The user's primary email address.

Sample request
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/admin?eventName=REVOKE_3LO_TOKEN&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format
3-legged OAuth tokens issued by user {USER_EMAIL} for application {APP_ID} were revoked

Add Recovery Email

Event details
Event name ADD_RECOVERY_EMAIL
Parameters
USER_EMAIL

string

The user's primary email address.

Sample request
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/admin?eventName=ADD_RECOVERY_EMAIL&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format
Recovery email added for {USER_EMAIL}

Add Recovery Phone

Event details
Event name ADD_RECOVERY_PHONE
Parameters
USER_EMAIL

string

The user's primary email address.

Sample request
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/admin?eventName=ADD_RECOVERY_PHONE&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format
Recovery phone added for {USER_EMAIL}

Admin Privileges Grant

Event details
Event name GRANT_ADMIN_PRIVILEGE
Parameters
USER_EMAIL

string

The user's primary email address.

Sample request
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/admin?eventName=GRANT_ADMIN_PRIVILEGE&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format
Admin privileges granted to {USER_EMAIL}

Admin Privileges Revoke

Event details
Event name REVOKE_ADMIN_PRIVILEGE
Parameters
USER_EMAIL

string

The user's primary email address.

Sample request
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/admin?eventName=REVOKE_ADMIN_PRIVILEGE&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format
Admin privileges revoked from {USER_EMAIL}

Application Specific Password Revoke

Event details
Event name REVOKE_ASP
Parameters
ASP_ID

string

The application specific password ID.

USER_EMAIL

string

The user's primary email address.

Sample request
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/admin?eventName=REVOKE_ASP&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format
Application specific password with Id {ASP_ID} issued by user {USER_EMAIL} revoked

Automatic Contact Share Change

Event details
Event name TOGGLE_AUTOMATIC_CONTACT_SHARING
Parameters
NEW_VALUE

string

The setting value, either true or false.

USER_EMAIL

string

The user's primary email address.

Sample request
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/admin?eventName=TOGGLE_AUTOMATIC_CONTACT_SHARING&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format
Automatic contact sharing for {USER_EMAIL} changed to {NEW_VALUE}

Bulk Upload

Event details
Event name BULK_UPLOAD
Parameters
BULK_UPLOAD_FAIL_USERS_NUMBER

string

The number of users who did not successfully upload to the domain.

BULK_UPLOAD_TOTAL_USERS_NUMBER

string

The number of total users being uploaded.

DOMAIN_NAME

string

The primary domain name where users are being moved.

Sample request
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/admin?eventName=BULK_UPLOAD&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format
{BULK_UPLOAD_TOTAL_USERS_NUMBER} users selected for upload to your organization. {BULK_UPLOAD_FAIL_USERS_NUMBER} out of {BULK_UPLOAD_TOTAL_USERS_NUMBER} users were not uploaded.

Bulk Upload Notification

Event details
Event name BULK_UPLOAD_NOTIFICATION_SENT
Parameters
DOMAIN_NAME

string

The primary domain name where users were uploaded.

USER_EMAIL

string

The primary email address of user who was sent notification of bulk upload event.

Sample request
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/admin?eventName=BULK_UPLOAD_NOTIFICATION_SENT&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format
Notification of bulk users upload sent to {USER_EMAIL}

Cancel User Invite

Event details
Event name CANCEL_USER_INVITE
Parameters
DOMAIN_NAME

string

The primary domain name.

USER_EMAIL

string

The primary email address of the user whose invitation is being cancelled.

Sample request
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/admin?eventName=CANCEL_USER_INVITE&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format
Invite to {USER_EMAIL} cancelled

Change Custom Attribute

Event details
Event name CHANGE_USER_CUSTOM_FIELD
Parameters
NEW_VALUE

string

The new SETTING_NAME value that was set during this event.

OLD_VALUE

string

The previous SETTING_NAME value that was replaced during this event.

USER_CUSTOM_FIELD

string

The name of the user's custom field.

USER_EMAIL

string

The user's primary email address.

Sample request
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/admin?eventName=CHANGE_USER_CUSTOM_FIELD&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format
{USER_CUSTOM_FIELD} changed for {USER_EMAIL} from {OLD_VALUE} to {NEW_VALUE}

Change External Id

Event details
Event name CHANGE_USER_EXTERNAL_ID
Parameters
NEW_VALUE

string

The new SETTING_NAME value that was set during this event.

OLD_VALUE

string

The previous SETTING_NAME value that was replaced during this event.

USER_EMAIL

string

The user's primary email address.

Sample request
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/admin?eventName=CHANGE_USER_EXTERNAL_ID&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format
External Ids changed for {USER_EMAIL} from {OLD_VALUE} to {NEW_VALUE}

Change Gender

Change here is a verb. The genders will be customizable, so this should be broader than male vs female.

Event details
Event name CHANGE_USER_GENDER
Parameters
NEW_VALUE

string

The new SETTING_NAME value that was set during this event.

OLD_VALUE

string

The previous SETTING_NAME value that was replaced during this event.

USER_EMAIL

string

The user's primary email address.

Sample request
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/admin?eventName=CHANGE_USER_GENDER&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format
Gender changed for {USER_EMAIL} from {OLD_VALUE} to {NEW_VALUE}

Change IM

Event details
Event name CHANGE_USER_IM
Parameters
NEW_VALUE

string

The new SETTING_NAME value that was set during this event.

OLD_VALUE

string

The previous SETTING_NAME value that was replaced during this event.

USER_EMAIL

string

The user's primary email address.

Sample request
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/admin?eventName=CHANGE_USER_IM&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format
IMs changed for {USER_EMAIL} from {OLD_VALUE} to {NEW_VALUE}

Change IP Whitelist

Event details
Event name ENABLE_USER_IP_WHITELIST
Parameters
NEW_VALUE

string

The new SETTING_NAME value that was set during this event.

OLD_VALUE

string

The previous SETTING_NAME value that was replaced during this event.

USER_EMAIL

string

The user's primary email address.

Sample request
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/admin?eventName=ENABLE_USER_IP_WHITELIST&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format
IP whitelist changed for {USER_EMAIL} from {OLD_VALUE} to {NEW_VALUE}

Change Keyword

Keywords are used on user profiles to help identify a user in searches. Example: find person with name 'Larry' and school 'Stanford'. 'Change' is a verb.

Event details
Event name CHANGE_USER_KEYWORD
Parameters
NEW_VALUE

string

The new SETTING_NAME value that was set during this event.

OLD_VALUE

string

The previous SETTING_NAME value that was replaced during this event.

USER_EMAIL

string

The user's primary email address.

Sample request
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/admin?eventName=CHANGE_USER_KEYWORD&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format
Keywords changed for {USER_EMAIL} from {OLD_VALUE} to {NEW_VALUE}

Change Language

Can be a predefined set of more common languages provided by Google or a custom language. 'Change' here is a verb.

Event details
Event name CHANGE_USER_LANGUAGE
Parameters
NEW_VALUE

string

The new SETTING_NAME value that was set during this event.

OLD_VALUE

string

The previous SETTING_NAME value that was replaced during this event.

USER_EMAIL

string

The user's primary email address.

Sample request
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/admin?eventName=CHANGE_USER_LANGUAGE&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format
Languages changed for {USER_EMAIL} from {OLD_VALUE} to {NEW_VALUE}

Change Location

Location is different from address in the following ways: (1) Location can be fuzzy. Example: Near Seattle. (2) Hovercards and other short user summaries display location, not address. 'Change' is a verb.

Event details
Event name CHANGE_USER_LOCATION
Parameters
NEW_VALUE

string

The new SETTING_NAME value that was set during this event.

OLD_VALUE

string

The previous SETTING_NAME value that was replaced during this event.

USER_EMAIL

string

The user's primary email address.

Sample request
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/admin?eventName=CHANGE_USER_LOCATION&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format
Locations changed for {USER_EMAIL} from {OLD_VALUE} to {NEW_VALUE}

Change Organization

Event details
Event name CHANGE_USER_ORGANIZATION
Parameters
NEW_VALUE

string

The new SETTING_NAME value that was set during this event.

OLD_VALUE

string

The previous SETTING_NAME value that was replaced during this event.

USER_EMAIL

string

The user's primary email address.

Sample request
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/admin?eventName=CHANGE_USER_ORGANIZATION&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format
Organizations changed for {USER_EMAIL} from {OLD_VALUE} to {NEW_VALUE}

Change Phone Numbers

Event details
Event name CHANGE_USER_PHONE_NUMBER
Parameters
NEW_VALUE

string

The new SETTING_NAME value that was set during this event.

OLD_VALUE

string

The previous SETTING_NAME value that was replaced during this event.

USER_EMAIL

string

The user's primary email address.

Sample request
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/admin?eventName=CHANGE_USER_PHONE_NUMBER&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format
Phone Numbers changed for {USER_EMAIL} from {OLD_VALUE} to {NEW_VALUE}

Change Recovery Email

Event details
Event name CHANGE_RECOVERY_EMAIL
Parameters
USER_EMAIL

string

The user's primary email address.

Sample request
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/admin?eventName=CHANGE_RECOVERY_EMAIL&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format
Recovery email changed for {USER_EMAIL}

Change Recovery Phone

Event details
Event name CHANGE_RECOVERY_PHONE
Parameters
USER_EMAIL

string

The user's primary email address.

Sample request
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/admin?eventName=CHANGE_RECOVERY_PHONE&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format
Recovery phone changed for {USER_EMAIL}

Change Relation

Event details
Event name CHANGE_USER_RELATION
Parameters
NEW_VALUE

string

The new SETTING_NAME value that was set during this event.

OLD_VALUE

string

The previous SETTING_NAME value that was replaced during this event.

USER_EMAIL

string

The user's primary email address.

Sample request
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/admin?eventName=CHANGE_USER_RELATION&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format
Relations changed for {USER_EMAIL} from {OLD_VALUE} to {NEW_VALUE}

Change User Address

Event details
Event name CHANGE_USER_ADDRESS
Parameters
NEW_VALUE

string

The new SETTING_NAME value that was set during this event.

OLD_VALUE

string

The previous SETTING_NAME value that was replaced during this event.

USER_EMAIL

string

The user's primary email address.

Sample request
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/admin?eventName=CHANGE_USER_ADDRESS&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format
Addresses changed for {USER_EMAIL} from {OLD_VALUE} to {NEW_VALUE}

Create an email monitor

Event details
Event name CREATE_EMAIL_MONITOR
Parameters
BEGIN_DATE_TIME

string

The start date and time for the email monitor.

EMAIL_MONITOR_DEST_EMAIL

string

The destination address of the email monitor.

EMAIL_MONITOR_LEVEL_CHAT

string

The chat email monitor level.

EMAIL_MONITOR_LEVEL_DRAFT_EMAIL

string

The draft email monitor level.

EMAIL_MONITOR_LEVEL_INCOMING_EMAIL

string

The incoming email monitor level.

EMAIL_MONITOR_LEVEL_OUTGOING_EMAIL

string

The outgoing email monitor level.

END_DATE_TIME

string

The end date and time for the email monitor.

USER_EMAIL

string

The user's primary email address.

Sample request
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/admin?eventName=CREATE_EMAIL_MONITOR&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format
Created an email monitor for {USER_EMAIL} to {EMAIL_MONITOR_DEST_EMAIL} that will expire on {END_DATE_TIME}

Data transfer request created

Event details
Event name CREATE_DATA_TRANSFER_REQUEST
Parameters
APPLICATION_NAME

string

A comma-separated application names for which data transfer is requested.

DESTINATION_USER_EMAIL

string

The new owner's primary user email to whom to transfer user data to.

USER_EMAIL

string

The user's primary email address.

Sample request
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/admin?eventName=CREATE_DATA_TRANSFER_REQUEST&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format
Data transfer request created from {USER_EMAIL} to {DESTINATION_USER_EMAIL} for apps {APPLICATION_NAME}

Delegated Admin Privileges Grant

Event details
Event name GRANT_DELEGATED_ADMIN_PRIVILEGES
Parameters
NEW_VALUE

string

The new delegated admin privilege.

USER_EMAIL

string

The user's primary email address.

Sample request
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/admin?eventName=GRANT_DELEGATED_ADMIN_PRIVILEGES&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format
{USER_EMAIL} assigned {NEW_VALUE} admin privileges

Delete account information dump

Event details
Event name DELETE_ACCOUNT_INFO_DUMP
Parameters
REQUEST_ID

string

The request ID.

USER_EMAIL

string

The user's primary email address.

Sample request
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/admin?eventName=DELETE_ACCOUNT_INFO_DUMP&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format
Deleted account and login information dump for {USER_EMAIL} and request ID {REQUEST_ID}

Delete an email monitor

Event details
Event name DELETE_EMAIL_MONITOR
Parameters
EMAIL_MONITOR_DEST_EMAIL

string

The destination address of the email monitor.

USER_EMAIL

string

The user's primary email address.

Sample request
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/admin?eventName=DELETE_EMAIL_MONITOR&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format
Deleted an email monitor for {USER_EMAIL} to {EMAIL_MONITOR_DEST_EMAIL}

Delete mailbox dump

Event details
Event name DELETE_MAILBOX_DUMP
Parameters
REQUEST_ID

string

The request ID.

USER_EMAIL

string

The user's primary email address.

Sample request
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/admin?eventName=DELETE_MAILBOX_DUMP&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format
Deleted mailbox dump for {USER_EMAIL} and request ID {REQUEST_ID}

Delete Profile Photo

Event details
Event name DELETE_PROFILE_PHOTO
Parameters
USER_EMAIL

string

The user's primary email address.

Sample request
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/admin?eventName=DELETE_PROFILE_PHOTO&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format
Profile photo of {USER_EMAIL} has been deleted

Display Name Change

Event details
Event name CHANGE_DISPLAY_NAME
Parameters
NEW_VALUE

string

The new SETTING_NAME value that was set during this event.

OLD_VALUE

string

The previous SETTING_NAME value that was replaced during this event.

USER_EMAIL

string

The user's primary email address.

Sample request
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/admin?eventName=CHANGE_DISPLAY_NAME&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format
Display name of {USER_EMAIL} changed from {OLD_VALUE} to {NEW_VALUE}

First Name Change

Event details
Event name CHANGE_FIRST_NAME
Parameters
NEW_VALUE

string

The user's new first name.

OLD_VALUE

string

The user's previous first name.

USER_EMAIL

string

The user's primary email address.

Sample request
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/admin?eventName=CHANGE_FIRST_NAME&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format
First name of {USER_EMAIL} changed from {OLD_VALUE} to {NEW_VALUE}

Gmail Account Reset

Event details
Event name GMAIL_RESET_USER
Parameters
GMAIL_RESET_REASON

string

Gmail's reason for resetting the account.

USER_EMAIL

string

The user's primary email address.

Sample request
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/admin?eventName=GMAIL_RESET_USER&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format
Gmail account of {USER_EMAIL} reset

Last Name Change

Event details
Event name CHANGE_LAST_NAME
Parameters
NEW_VALUE

string

The user's new last name.

OLD_VALUE

string

The user's previous last name.

USER_EMAIL

string

The user's primary email address.

Sample request
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/admin?eventName=CHANGE_LAST_NAME&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format
Last name of {USER_EMAIL} changed from {OLD_VALUE} to {NEW_VALUE}

Mail Routing Destination Creation

Event details
Event name MAIL_ROUTING_DESTINATION_ADDED
Parameters
NEW_VALUE

string

The new routing destination.

USER_EMAIL

string

The user's primary email address.

Sample request
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/admin?eventName=MAIL_ROUTING_DESTINATION_ADDED&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format
User {USER_EMAIL} has received the following individual mail routing destination: {NEW_VALUE}

Mail Routing Destination Deletion

Event details
Event name MAIL_ROUTING_DESTINATION_REMOVED
Parameters
OLD_VALUE

string

The previous routing destination.

USER_EMAIL

string

The user's primary email address.

Sample request
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/admin?eventName=MAIL_ROUTING_DESTINATION_REMOVED&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format
User {USER_EMAIL} has had the following individual mail routing destination removed: {OLD_VALUE}

Nickname Creation

Event details
Event name ADD_NICKNAME
Parameters
USER_EMAIL

string

The primary user email.

USER_NICKNAME

string

The user's nickname. For Admin console information, see the administration help center.

Sample request
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/admin?eventName=ADD_NICKNAME&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format
{USER_NICKNAME} created as a nickname of {USER_EMAIL}

Nickname Deletion

Event details
Event name REMOVE_NICKNAME
Parameters
USER_EMAIL

string

The user's primary email address.

USER_NICKNAME

string

The user's previous nickname.

Sample request
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/admin?eventName=REMOVE_NICKNAME&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format
{USER_NICKNAME} deleted as a nickname of {USER_EMAIL}

Password Change

Event details
Event name CHANGE_PASSWORD
Parameters
USER_EMAIL

string

The user's primary email address.

Sample request
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/admin?eventName=CHANGE_PASSWORD&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format
Password changed for {USER_EMAIL}

Password Change on Next Login

Event details
Event name CHANGE_PASSWORD_ON_NEXT_LOGIN
Parameters
NEW_VALUE

string

Indicates whether the user must change their password on their next login; can be true or false.

OLD_VALUE

string

The previous setting value; can be true or false.

USER_EMAIL

string

The user's primary email address.

Sample request
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/admin?eventName=CHANGE_PASSWORD_ON_NEXT_LOGIN&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format
Password change requirement for {USER_EMAIL} on next login changed from {OLD_VALUE} to {NEW_VALUE}

Pending Invites List Download

Event details
Event name DOWNLOAD_PENDING_INVITES_LIST
Sample request
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/admin?eventName=DOWNLOAD_PENDING_INVITES_LIST&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format
Pending Invites List was downloaded as a CSV file

Remove Recovery Email

Event details
Event name REMOVE_RECOVERY_EMAIL
Parameters
USER_EMAIL

string

The user's primary email address.

Sample request
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/admin?eventName=REMOVE_RECOVERY_EMAIL&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format
Recovery email removed for {USER_EMAIL}

Remove Recovery Phone

Event details
Event name REMOVE_RECOVERY_PHONE
Parameters
USER_EMAIL

string

The user's primary email address.

Sample request
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/admin?eventName=REMOVE_RECOVERY_PHONE&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format
Recovery phone removed for {USER_EMAIL}

Request account information

Event details
Event name REQUEST_ACCOUNT_INFO
Parameters
USER_EMAIL

string

The user's primary email address.

Sample request
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/admin?eventName=REQUEST_ACCOUNT_INFO&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format
Requested account and login information for {USER_EMAIL}

Request mailbox dump

Event details
Event name REQUEST_MAILBOX_DUMP
Parameters
BEGIN_DATE_TIME

string

The start date and time for the email monitor.

EMAIL_EXPORT_INCLUDE_DELETED

string

Indicates if deleted emails are included in the export.

EMAIL_EXPORT_PACKAGE_CONTENT

string

The contents of the mailbox package.

END_DATE_TIME

string

The end date and time for the email monitor.

SEARCH_QUERY_FOR_DUMP

string

The search query used for the dump.

USER_EMAIL

string

The user's primary email address.

Sample request
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/admin?eventName=REQUEST_MAILBOX_DUMP&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format
Requested mailbox dump for {USER_EMAIL}

Resend User Invite

Event details
Event name RESEND_USER_INVITE
Parameters
DOMAIN_NAME

string

The primary domain name.

USER_EMAIL

string

The user's primary email address.

Sample request
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/admin?eventName=RESEND_USER_INVITE&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format
Invite email to {USER_EMAIL} resent

Reset Cookies and Forced Relogin

Event details
Event name RESET_SIGNIN_COOKIES
Parameters
USER_EMAIL

string

The user's primary email address.

Sample request
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/admin?eventName=RESET_SIGNIN_COOKIES&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format
Cookies reset for {USER_EMAIL} and forced re-login

Security Key Registered For User

Event details
Event name SECURITY_KEY_REGISTERED_FOR_USER
Parameters
USER_EMAIL

string

The user's primary email address.

Sample request
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/admin?eventName=SECURITY_KEY_REGISTERED_FOR_USER&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format
Security key registered for {USER_EMAIL}

Security Key Revoke

Event details
Event name REVOKE_SECURITY_KEY
Parameters
USER_EMAIL

string

The user's primary email address.

Sample request
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/admin?eventName=REVOKE_SECURITY_KEY&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format
A security key enrolled for user {USER_EMAIL} for 2-step verification was revoked

Send User Invite

Event details
Event name USER_INVITE
Parameters
DOMAIN_NAME

string

The primary domain name.

USER_EMAIL

string

The user's primary email address.

Sample request
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/admin?eventName=USER_INVITE&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format
{USER_EMAIL} invited to join your organization

Temporary Password Viewed

Event details
Event name VIEW_TEMP_PASSWORD
Parameters
DOMAIN_NAME

string

The primary domain name.

USER_EMAIL

string

The user's primary email address.

Sample request
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/admin?eventName=VIEW_TEMP_PASSWORD&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format
Temporary password for user {USER_EMAIL} viewed by the admin

Turn off 2-step verification

Event details
Event name TURN_OFF_2_STEP_VERIFICATION
Parameters
USER_EMAIL

string

The user's primary email address.

Sample request
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/admin?eventName=TURN_OFF_2_STEP_VERIFICATION&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format
2-step verification has been turned off for the user {USER_EMAIL}

Unblock User Session

Event details
Event name UNBLOCK_USER_SESSION
Parameters
USER_EMAIL

string

The user's primary email address.

Sample request
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/admin?eventName=UNBLOCK_USER_SESSION&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format
User {USER_EMAIL} unblocked by temporarily disabling login challenge

Unmanaged Users Bulk Upload

Event details
Event name UNMANAGED_USERS_BULK_UPLOAD
Parameters
BULK_UPLOAD_FAIL_USERS_NUMBER

string

Bulk Upload Failed Users Number.

BULK_UPLOAD_TOTAL_USERS_NUMBER

string

Bulk Upload Total Users Number.

Sample request
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/admin?eventName=UNMANAGED_USERS_BULK_UPLOAD&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format
A total of {BULK_UPLOAD_TOTAL_USERS_NUMBER} unmanaged users selected for upload. {BULK_UPLOAD_FAIL_USERS_NUMBER} out of {BULK_UPLOAD_TOTAL_USERS_NUMBER} users failed to be uploaded.

Unmanaged Users List Download

Event details
Event name DOWNLOAD_UNMANAGED_USERS_LIST
Sample request
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/admin?eventName=DOWNLOAD_UNMANAGED_USERS_LIST&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format
Unmanaged Users list was downloaded as a CSV file

Update Profile Photo

Event details
Event name UPDATE_PROFILE_PHOTO
Parameters
USER_EMAIL

string

The user's primary email address.

Sample request
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/admin?eventName=UPDATE_PROFILE_PHOTO&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format
Profile photo of {USER_EMAIL} has been updated

User Advanced Protection Unenroll

Event details
Event name UNENROLL_USER_FROM_TITANIUM
Parameters
USER_EMAIL

string

The user's primary email address.

Sample request
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/admin?eventName=UNENROLL_USER_FROM_TITANIUM&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format
User {USER_EMAIL} unenrolled from Advanced Protection

User Archival

Event details
Event name ARCHIVE_USER
Parameters
USER_EMAIL

string

The user's primary email address.

Sample request
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/admin?eventName=ARCHIVE_USER&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format
{USER_EMAIL} archived

User BirthDate Change

Event details
Event name UPDATE_BIRTHDATE
Parameters
BIRTHDATE

string

The date of the user's birthday.

USER_EMAIL

string

The user's primary email address.

Sample request
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/admin?eventName=UPDATE_BIRTHDATE&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format
The birth date for {USER_EMAIL} changed to {BIRTHDATE}

User Creation

Event details
Event name CREATE_USER
Parameters
USER_EMAIL

string

The new user's primary user email.

Sample request
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/admin?eventName=CREATE_USER&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format
{USER_EMAIL} created

User Deletion

Event details
Event name DELETE_USER
Parameters
USER_EMAIL

string

The deleted user's primary user email.

Sample request
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/admin?eventName=DELETE_USER&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format
{USER_EMAIL} deleted

User Downgrade From Google+

Event details
Event name DOWNGRADE_USER_FROM_GPLUS
Parameters
USER_EMAIL

string

The user's primary email address.

Sample request
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/admin?eventName=DOWNGRADE_USER_FROM_GPLUS&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format
{USER_EMAIL} was downgraded from Google+

User Enrolled In 2-Step Verification

Event details
Event name USER_ENROLLED_IN_TWO_STEP_VERIFICATION
Parameters
USER_EMAIL

string

The user's primary email address.

Sample request
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/admin?eventName=USER_ENROLLED_IN_TWO_STEP_VERIFICATION&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format
{USER_EMAIL} enrolled in 2-step verification

User List Download

Event details
Event name DOWNLOAD_USERLIST_CSV
Sample request
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/admin?eventName=DOWNLOAD_USERLIST_CSV&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format
User list was downloaded as a CSV file

User OrgUnit Change

Event details
Event name MOVE_USER_TO_ORG_UNIT
Parameters
NEW_VALUE

string

The user's new organizational unit.

ORG_UNIT_NAME

string

The organizational unit (OU) name (path).

USER_EMAIL

string

The user's primary email address.

Sample request
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/admin?eventName=MOVE_USER_TO_ORG_UNIT&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format
{USER_EMAIL} moved from {ORG_UNIT_NAME} to {NEW_VALUE}

User Put In 2-Step Verification Grace Period

Event details
Event name USER_PUT_IN_TWO_STEP_VERIFICATION_GRACE_PERIOD
Parameters
NEW_VALUE

string

The new SETTING_NAME value that was set during this event.

USER_EMAIL

string

The user's primary email address.

Sample request
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/admin?eventName=USER_PUT_IN_TWO_STEP_VERIFICATION_GRACE_PERIOD&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format
2-step verification grace period has been enabled on {USER_EMAIL} till {NEW_VALUE}

User Rename

Event details
Event name RENAME_USER
Parameters
NEW_VALUE

string

The user's new name.

USER_EMAIL

string

The user's primary email address.

Sample request
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/admin?eventName=RENAME_USER&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format
{USER_EMAIL} renamed to {NEW_VALUE}

User Strong Auth Unenroll

Event details
Event name UNENROLL_USER_FROM_STRONG_AUTH
Parameters
USER_EMAIL

string

The user's primary email address.

Sample request
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/admin?eventName=UNENROLL_USER_FROM_STRONG_AUTH&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format
User {USER_EMAIL} unenrolled from Strong Auth

User Suspension

Event details
Event name SUSPEND_USER
Parameters
USER_EMAIL

string

The user's primary email address.

Sample request
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/admin?eventName=SUSPEND_USER&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format
{USER_EMAIL} suspended

User Unarchival

Event details
Event name UNARCHIVE_USER
Parameters
USER_EMAIL

string

The user's primary email address.

Sample request
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/admin?eventName=UNARCHIVE_USER&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format
{USER_EMAIL} unarchived

User Undeletion

Event details
Event name UNDELETE_USER
Parameters
USER_EMAIL

string

The user's primary email address.

Sample request
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/admin?eventName=UNDELETE_USER&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format
{USER_EMAIL} undeleted

User Unsuspension

Event details
Event name UNSUSPEND_USER
Parameters
USER_EMAIL

string

The user's primary email address.

Sample request
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/admin?eventName=UNSUSPEND_USER&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format
{USER_EMAIL} unsuspended

User Upgrade To Google+

Event details
Event name UPGRADE_USER_TO_GPLUS
Parameters
USER_EMAIL

string

The user's primary email address.

Sample request
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/admin?eventName=UPGRADE_USER_TO_GPLUS&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format
{USER_EMAIL} was upgraded to Google+

Users Bulk Upload

Event details
Event name USERS_BULK_UPLOAD
Parameters
BULK_UPLOAD_FAIL_USERS_NUMBER

string

The number of failures when attemping to bulk upload users.

BULK_UPLOAD_TOTAL_USERS_NUMBER

string

The total number of bulk uploaded users.

Sample request
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/admin?eventName=USERS_BULK_UPLOAD&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format
A total of {BULK_UPLOAD_TOTAL_USERS_NUMBER} users selected for upload. {BULK_UPLOAD_FAIL_USERS_NUMBER} out of {BULK_UPLOAD_TOTAL_USERS_NUMBER} users failed to be uploaded.

Users Bulk Upload Notification

Event details
Event name USERS_BULK_UPLOAD_NOTIFICATION_SENT
Parameters
USER_EMAIL

string

The user's primary email address.

Sample request
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/admin?eventName=USERS_BULK_UPLOAD_NOTIFICATION_SENT&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format
Notification of bulk users upload sent to {USER_EMAIL}