Stay organized with collections
Save and categorize content based on your preferences.
This document lists the events and parameters for
various types of
User Accounts Audit activity events. You can retrieve these events by
calling Activities.list()
with applicationName=user_accounts.
2-step verification enrollment changed
Events of this type are returned with type=2sv_change.
2-step verification disable
Event details
Event name
2sv_disable
Sample request
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/user_accounts?eventName=2sv_disable&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format
{actor} has disabled 2-step verification
2-step verification enroll
Event details
Event name
2sv_enroll
Sample request
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/user_accounts?eventName=2sv_enroll&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format
{actor} has enrolled for 2-step verification
Account password changed
Events of this type are returned with type=password_change.
Account password change
Event details
Event name
password_edit
Sample request
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/user_accounts?eventName=password_edit&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format
{actor} has changed Account password
Account recovery info changed
Account recovery information changed.
Events of this type are returned with type=recovery_info_change.
Account recovery email change
Event details
Event name
recovery_email_edit
Sample request
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/user_accounts?eventName=recovery_email_edit&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format
{actor} has changed Account recovery email
Account recovery phone change
Event details
Event name
recovery_phone_edit
Sample request
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/user_accounts?eventName=recovery_phone_edit&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format
{actor} has changed Account recovery phone
Account recovery secret question/answer change
Event details
Event name
recovery_secret_qa_edit
Sample request
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/user_accounts?eventName=recovery_secret_qa_edit&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format
{actor} has changed Account recovery secret question/answer
Advanced Protection enrollment changed
Events of this type are returned with type=titanium_change.
Advanced Protection enroll
Event details
Event name
titanium_enroll
Sample request
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/user_accounts?eventName=titanium_enroll&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format
{actor} has enrolled for Advanced Protection
Advanced Protection unenroll
Event details
Event name
titanium_unenroll
Sample request
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/user_accounts?eventName=titanium_unenroll&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format
{actor} has disabled Advanced Protection
Email forwarding settings changed
Events of this type are returned with type=email_forwarding_change.
Out of domain email forwarding enabled
Event details
Event name
email_forwarding_out_of_domain
Sample request
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/user_accounts?eventName=email_forwarding_out_of_domain&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format
{actor} has enabled out of domain email forwarding to {email_forwarding_destination_address}.