This document lists the events and parameters for
various types of
User Accounts Audit activity events. You can retrieve these events by
calling Activities.list()
with applicationName=user_accounts.
2-step verification enrollment changed
Events of this type are returned with type=2sv_change.
2-step verification disable
| Event details |
| Event name |
2sv_disable |
| Sample request |
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/user_accounts?eventName=2sv_disable&maxResults=10&access_token=YOUR_ACCESS_TOKEN
|
| Admin Console message format |
{actor} has disabled 2-step verification
|
2-step verification enroll
| Event details |
| Event name |
2sv_enroll |
| Sample request |
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/user_accounts?eventName=2sv_enroll&maxResults=10&access_token=YOUR_ACCESS_TOKEN
|
| Admin Console message format |
{actor} has enrolled for 2-step verification
|
Account password changed
Events of this type are returned with type=password_change.
Account password change
| Event details |
| Event name |
password_edit |
| Sample request |
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/user_accounts?eventName=password_edit&maxResults=10&access_token=YOUR_ACCESS_TOKEN
|
| Admin Console message format |
{actor} has changed Account password
|
Account recovery info changed
Account recovery information changed.
Events of this type are returned with type=recovery_info_change.
Account recovery email change
| Event details |
| Event name |
recovery_email_edit |
| Sample request |
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/user_accounts?eventName=recovery_email_edit&maxResults=10&access_token=YOUR_ACCESS_TOKEN
|
| Admin Console message format |
{actor} has changed Account recovery email
|
Account recovery phone change
| Event details |
| Event name |
recovery_phone_edit |
| Sample request |
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/user_accounts?eventName=recovery_phone_edit&maxResults=10&access_token=YOUR_ACCESS_TOKEN
|
| Admin Console message format |
{actor} has changed Account recovery phone
|
Account recovery secret question/answer change
| Event details |
| Event name |
recovery_secret_qa_edit |
| Sample request |
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/user_accounts?eventName=recovery_secret_qa_edit&maxResults=10&access_token=YOUR_ACCESS_TOKEN
|
| Admin Console message format |
{actor} has changed Account recovery secret question/answer
|
Advanced Protection enrollment changed
Events of this type are returned with type=titanium_change.
Advanced Protection enroll
| Event details |
| Event name |
titanium_enroll |
| Sample request |
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/user_accounts?eventName=titanium_enroll&maxResults=10&access_token=YOUR_ACCESS_TOKEN
|
| Admin Console message format |
{actor} has enrolled for Advanced Protection
|
Advanced Protection unenroll
| Event details |
| Event name |
titanium_unenroll |
| Sample request |
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/user_accounts?eventName=titanium_unenroll&maxResults=10&access_token=YOUR_ACCESS_TOKEN
|
| Admin Console message format |
{actor} has disabled Advanced Protection
|
Email forwarding settings changed
Events of this type are returned with type=email_forwarding_change.
Out of domain email forwarding enabled
| Event details |
| Event name |
email_forwarding_out_of_domain |
| Sample request |
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/user_accounts?eventName=email_forwarding_out_of_domain&maxResults=10&access_token=YOUR_ACCESS_TOKEN
|
| Admin Console message format |
{actor} has enabled out of domain email forwarding to {email_forwarding_destination_address}.
|
