This document lists the events and parameters for
various types of
Vault Audit activity events. You can retrieve these events by
calling Activities.list()
with applicationName=vault.
Event Type: User Action
User Action Event Type.
Events of this type are returned with type=user_action.
Add Collaborator Begin
The name of the Vault event: Add Collaborator Begin.
| Event details |
| Event name |
add_collaborator_begin |
| Parameters |
additional_details |
string
Additional details pertaining to an audit log.
|
matter_id |
string
The Matter ID an audit pertains to.
|
organizational_unit_name |
string
The organizational unit name.
|
query |
string
The user inputted query for search and exports.
|
resource_name |
string
The resource name of the action, such as hold name or saved query name.
|
resource_url |
string
The document URL of the document view.
|
target_user |
string
The targeted user (such as user put on hold).
|
|
| Sample request |
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/vault?eventName=add_collaborator_begin&maxResults=10&access_token=YOUR_ACCESS_TOKEN
|
| Admin Console message format |
Collaborator addition began
|
Add Collaborator End
The name of the Vault event: Add Collaborator End.
| Event details |
| Event name |
add_collaborator_end |
| Parameters |
additional_details |
string
Additional details pertaining to an audit log.
|
matter_id |
string
The Matter ID an audit pertains to.
|
organizational_unit_name |
string
The organizational unit name.
|
query |
string
The user inputted query for search and exports.
|
resource_name |
string
The resource name of the action, such as hold name or saved query name.
|
resource_url |
string
The document URL of the document view.
|
target_user |
string
The targeted user (such as user put on hold).
|
|
| Sample request |
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/vault?eventName=add_collaborator_end&maxResults=10&access_token=YOUR_ACCESS_TOKEN
|
| Admin Console message format |
Collaborator addition ended
|
Add Litigation Hold Begin
The name of the Vault event: Add Litigation Hold Begin.
| Event details |
| Event name |
add_litigation_hold_begin |
| Parameters |
additional_details |
string
Additional details pertaining to an audit log.
|
matter_id |
string
The Matter ID an audit pertains to.
|
organizational_unit_name |
string
The organizational unit name.
|
query |
string
The user inputted query for search and exports.
|
resource_name |
string
The resource name of the action, such as hold name or saved query name.
|
resource_url |
string
The document URL of the document view.
|
target_user |
string
The targeted user (such as user put on hold).
|
|
| Sample request |
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/vault?eventName=add_litigation_hold_begin&maxResults=10&access_token=YOUR_ACCESS_TOKEN
|
| Admin Console message format |
Litigation hold addition began
|
Add Litigation Hold End
The name of the Vault event: Add Litigation Hold End.
| Event details |
| Event name |
add_litigation_hold_end |
| Parameters |
additional_details |
string
Additional details pertaining to an audit log.
|
matter_id |
string
The Matter ID an audit pertains to.
|
organizational_unit_name |
string
The organizational unit name.
|
query |
string
The user inputted query for search and exports.
|
resource_name |
string
The resource name of the action, such as hold name or saved query name.
|
resource_url |
string
The document URL of the document view.
|
target_user |
string
The targeted user (such as user put on hold).
|
|
| Sample request |
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/vault?eventName=add_litigation_hold_end&maxResults=10&access_token=YOUR_ACCESS_TOKEN
|
| Admin Console message format |
Litigation hold addition ended
|
Add Preservation Rule Begin
The name of the Vault event: Add Preservation Rule Begin.
| Event details |
| Event name |
add_preservation_rule_begin |
| Parameters |
additional_details |
string
Additional details pertaining to an audit log.
|
matter_id |
string
The Matter ID an audit pertains to.
|
organizational_unit_name |
string
The organizational unit name.
|
query |
string
The user inputted query for search and exports.
|
resource_name |
string
The resource name of the action, such as hold name or saved query name.
|
resource_url |
string
The document URL of the document view.
|
target_user |
string
The targeted user (such as user put on hold).
|
|
| Sample request |
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/vault?eventName=add_preservation_rule_begin&maxResults=10&access_token=YOUR_ACCESS_TOKEN
|
| Admin Console message format |
Preservation rule addition began
|
Add Preservation Rule End
The name of the Vault event: Add Preservation Rule End.
| Event details |
| Event name |
add_preservation_rule_end |
| Parameters |
additional_details |
string
Additional details pertaining to an audit log.
|
matter_id |
string
The Matter ID an audit pertains to.
|
organizational_unit_name |
string
The organizational unit name.
|
query |
string
The user inputted query for search and exports.
|
resource_name |
string
The resource name of the action, such as hold name or saved query name.
|
resource_url |
string
The document URL of the document view.
|
target_user |
string
The targeted user (such as user put on hold).
|
|
| Sample request |
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/vault?eventName=add_preservation_rule_end&maxResults=10&access_token=YOUR_ACCESS_TOKEN
|
| Admin Console message format |
Preservation rule addition ended
|
Add Retention Rule Begin
The name of the Vault event: Add Retention Rule Begin.
| Event details |
| Event name |
add_retention_rule_begin |
| Parameters |
additional_details |
string
Additional details pertaining to an audit log.
|
matter_id |
string
The Matter ID an audit pertains to.
|
organizational_unit_name |
string
The organizational unit name.
|
query |
string
The user inputted query for search and exports.
|
resource_name |
string
The resource name of the action, such as hold name or saved query name.
|
resource_url |
string
The document URL of the document view.
|
target_user |
string
The targeted user (such as user put on hold).
|
|
| Sample request |
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/vault?eventName=add_retention_rule_begin&maxResults=10&access_token=YOUR_ACCESS_TOKEN
|
| Admin Console message format |
Retention rule addition began
|
Add Retention Rule End
The name of the Vault event: Add Retention Rule End.
| Event details |
| Event name |
add_retention_rule_end |
| Parameters |
additional_details |
string
Additional details pertaining to an audit log.
|
matter_id |
string
The Matter ID an audit pertains to.
|
organizational_unit_name |
string
The organizational unit name.
|
query |
string
The user inputted query for search and exports.
|
resource_name |
string
The resource name of the action, such as hold name or saved query name.
|
resource_url |
string
The document URL of the document view.
|
target_user |
string
The targeted user (such as user put on hold).
|
|
| Sample request |
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/vault?eventName=add_retention_rule_end&maxResults=10&access_token=YOUR_ACCESS_TOKEN
|
| Admin Console message format |
Retention rule addition ended
|
Cancel Accelerated Deletion Begin
The name of the Vault event: Cancel Accelerated Deletion Begin.
| Event details |
| Event name |
cancel_accelerated_deletion_begin |
| Parameters |
additional_details |
string
Additional details pertaining to an audit log.
|
matter_id |
string
The Matter ID an audit pertains to.
|
organizational_unit_name |
string
The organizational unit name.
|
query |
string
The user inputted query for search and exports.
|
resource_name |
string
The resource name of the action, such as hold name or saved query name.
|
resource_url |
string
The document URL of the document view.
|
target_user |
string
The targeted user (such as user put on hold).
|
|
| Sample request |
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/vault?eventName=cancel_accelerated_deletion_begin&maxResults=10&access_token=YOUR_ACCESS_TOKEN
|
| Admin Console message format |
Accelerated deletion cancellation began
|
Cancel Accelerated Deletion End
The name of the Vault event: Cancel Accelerated Deletion End.
| Event details |
| Event name |
cancel_accelerated_deletion_end |
| Parameters |
additional_details |
string
Additional details pertaining to an audit log.
|
matter_id |
string
The Matter ID an audit pertains to.
|
organizational_unit_name |
string
The organizational unit name.
|
query |
string
The user inputted query for search and exports.
|
resource_name |
string
The resource name of the action, such as hold name or saved query name.
|
resource_url |
string
The document URL of the document view.
|
target_user |
string
The targeted user (such as user put on hold).
|
|
| Sample request |
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/vault?eventName=cancel_accelerated_deletion_end&maxResults=10&access_token=YOUR_ACCESS_TOKEN
|
| Admin Console message format |
Accelerated deletion cancellation ended
|
Close Investigation Begin
The name of the Vault event: Close Investigation Begin.
| Event details |
| Event name |
close_investigation_begin |
| Parameters |
additional_details |
string
Additional details pertaining to an audit log.
|
matter_id |
string
The Matter ID an audit pertains to.
|
organizational_unit_name |
string
The organizational unit name.
|
query |
string
The user inputted query for search and exports.
|
resource_name |
string
The resource name of the action, such as hold name or saved query name.
|
resource_url |
string
The document URL of the document view.
|
target_user |
string
The targeted user (such as user put on hold).
|
|
| Sample request |
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/vault?eventName=close_investigation_begin&maxResults=10&access_token=YOUR_ACCESS_TOKEN
|
| Admin Console message format |
Investigation closure began
|
Close Investigation End
The name of the Vault event: Close Investigation End.
| Event details |
| Event name |
close_investigation_end |
| Parameters |
additional_details |
string
Additional details pertaining to an audit log.
|
matter_id |
string
The Matter ID an audit pertains to.
|
organizational_unit_name |
string
The organizational unit name.
|
query |
string
The user inputted query for search and exports.
|
resource_name |
string
The resource name of the action, such as hold name or saved query name.
|
resource_url |
string
The document URL of the document view.
|
target_user |
string
The targeted user (such as user put on hold).
|
|
| Sample request |
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/vault?eventName=close_investigation_end&maxResults=10&access_token=YOUR_ACCESS_TOKEN
|
| Admin Console message format |
Investigation closure ended
|
Convert Saved Query To Collection Begin
The name of the Vault event: Convert Saved Query To Collection Begin.
| Event details |
| Event name |
convert_saved_query_to_collection_begin |
| Parameters |
additional_details |
string
Additional details pertaining to an audit log.
|
matter_id |
string
The Matter ID an audit pertains to.
|
organizational_unit_name |
string
The organizational unit name.
|
query |
string
The user inputted query for search and exports.
|
resource_name |
string
The resource name of the action, such as hold name or saved query name.
|
resource_url |
string
The document URL of the document view.
|
target_user |
string
The targeted user (such as user put on hold).
|
|
| Sample request |
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/vault?eventName=convert_saved_query_to_collection_begin&maxResults=10&access_token=YOUR_ACCESS_TOKEN
|
| Admin Console message format |
Saved query to collection conversion began
|
Convert Saved Query To Collection End
The name of the Vault event: Convert Saved Query To Collection End.
| Event details |
| Event name |
convert_saved_query_to_collection_end |
| Parameters |
additional_details |
string
Additional details pertaining to an audit log.
|
matter_id |
string
The Matter ID an audit pertains to.
|
organizational_unit_name |
string
The organizational unit name.
|
query |
string
The user inputted query for search and exports.
|
resource_name |
string
The resource name of the action, such as hold name or saved query name.
|
resource_url |
string
The document URL of the document view.
|
target_user |
string
The targeted user (such as user put on hold).
|
|
| Sample request |
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/vault?eventName=convert_saved_query_to_collection_end&maxResults=10&access_token=YOUR_ACCESS_TOKEN
|
| Admin Console message format |
Saved query to collection conversion ended
|
Create Accelerated Deletion Begin
The name of the Vault event: Create Accelerated Deletion Begin.
| Event details |
| Event name |
create_accelerated_deletion_begin |
| Parameters |
additional_details |
string
Additional details pertaining to an audit log.
|
matter_id |
string
The Matter ID an audit pertains to.
|
organizational_unit_name |
string
The organizational unit name.
|
query |
string
The user inputted query for search and exports.
|
resource_name |
string
The resource name of the action, such as hold name or saved query name.
|
resource_url |
string
The document URL of the document view.
|
target_user |
string
The targeted user (such as user put on hold).
|
|
| Sample request |
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/vault?eventName=create_accelerated_deletion_begin&maxResults=10&access_token=YOUR_ACCESS_TOKEN
|
| Admin Console message format |
Accelerated deletion request creation began
|
Create Accelerated Deletion End
The name of the Vault event: Create Accelerated Deletion End.
| Event details |
| Event name |
create_accelerated_deletion_end |
| Parameters |
additional_details |
string
Additional details pertaining to an audit log.
|
matter_id |
string
The Matter ID an audit pertains to.
|
organizational_unit_name |
string
The organizational unit name.
|
query |
string
The user inputted query for search and exports.
|
resource_name |
string
The resource name of the action, such as hold name or saved query name.
|
resource_url |
string
The document URL of the document view.
|
target_user |
string
The targeted user (such as user put on hold).
|
|
| Sample request |
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/vault?eventName=create_accelerated_deletion_end&maxResults=10&access_token=YOUR_ACCESS_TOKEN
|
| Admin Console message format |
Accelerated deletion request creation ended
|
Create Export Begin
The name of the Vault event: Create Export Begin.
| Event details |
| Event name |
create_export_begin |
| Parameters |
additional_details |
string
Additional details pertaining to an audit log.
|
matter_id |
string
The Matter ID an audit pertains to.
|
organizational_unit_name |
string
The organizational unit name.
|
query |
string
The user inputted query for search and exports.
|
resource_name |
string
The resource name of the action, such as hold name or saved query name.
|
resource_url |
string
The document URL of the document view.
|
target_user |
string
The targeted user (such as user put on hold).
|
|
| Sample request |
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/vault?eventName=create_export_begin&maxResults=10&access_token=YOUR_ACCESS_TOKEN
|
| Admin Console message format |
Export creation began
|
Create Export End
The name of the Vault event: Create Export End.
| Event details |
| Event name |
create_export_end |
| Parameters |
additional_details |
string
Additional details pertaining to an audit log.
|
matter_id |
string
The Matter ID an audit pertains to.
|
organizational_unit_name |
string
The organizational unit name.
|
query |
string
The user inputted query for search and exports.
|
resource_name |
string
The resource name of the action, such as hold name or saved query name.
|
resource_url |
string
The document URL of the document view.
|
target_user |
string
The targeted user (such as user put on hold).
|
|
| Sample request |
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/vault?eventName=create_export_end&maxResults=10&access_token=YOUR_ACCESS_TOKEN
|
| Admin Console message format |
Export creation ended
|
Create Investigation Begin
The name of the Vault event: Create Investigation Begin.
| Event details |
| Event name |
create_investigation_begin |
| Parameters |
additional_details |
string
Additional details pertaining to an audit log.
|
matter_id |
string
The Matter ID an audit pertains to.
|
organizational_unit_name |
string
The organizational unit name.
|
query |
string
The user inputted query for search and exports.
|
resource_name |
string
The resource name of the action, such as hold name or saved query name.
|
resource_url |
string
The document URL of the document view.
|
target_user |
string
The targeted user (such as user put on hold).
|
|
| Sample request |
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/vault?eventName=create_investigation_begin&maxResults=10&access_token=YOUR_ACCESS_TOKEN
|
| Admin Console message format |
Investigation creation began
|
Create Investigation End
The name of the Vault event: Create Investigation End.
| Event details |
| Event name |
create_investigation_end |
| Parameters |
additional_details |
string
Additional details pertaining to an audit log.
|
matter_id |
string
The Matter ID an audit pertains to.
|
organizational_unit_name |
string
The organizational unit name.
|
query |
string
The user inputted query for search and exports.
|
resource_name |
string
The resource name of the action, such as hold name or saved query name.
|
resource_url |
string
The document URL of the document view.
|
target_user |
string
The targeted user (such as user put on hold).
|
|
| Sample request |
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/vault?eventName=create_investigation_end&maxResults=10&access_token=YOUR_ACCESS_TOKEN
|
| Admin Console message format |
Investigation creation ended
|
Create Saved Query Begin
The name of the Vault event: Create Saved Query Begin.
| Event details |
| Event name |
create_saved_query_begin |
| Parameters |
additional_details |
string
Additional details pertaining to an audit log.
|
matter_id |
string
The Matter ID an audit pertains to.
|
organizational_unit_name |
string
The organizational unit name.
|
query |
string
The user inputted query for search and exports.
|
resource_name |
string
The resource name of the action, such as hold name or saved query name.
|
resource_url |
string
The document URL of the document view.
|
target_user |
string
The targeted user (such as user put on hold).
|
|
| Sample request |
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/vault?eventName=create_saved_query_begin&maxResults=10&access_token=YOUR_ACCESS_TOKEN
|
| Admin Console message format |
Saved query creation began
|
Create Saved Query End
The name of the Vault event: Create Saved Query End.
| Event details |
| Event name |
create_saved_query_end |
| Parameters |
additional_details |
string
Additional details pertaining to an audit log.
|
matter_id |
string
The Matter ID an audit pertains to.
|
organizational_unit_name |
string
The organizational unit name.
|
query |
string
The user inputted query for search and exports.
|
resource_name |
string
The resource name of the action, such as hold name or saved query name.
|
resource_url |
string
The document URL of the document view.
|
target_user |
string
The targeted user (such as user put on hold).
|
|
| Sample request |
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/vault?eventName=create_saved_query_end&maxResults=10&access_token=YOUR_ACCESS_TOKEN
|
| Admin Console message format |
Saved query creation ended
|
Delete Export Begin
The name of the Vault event: Delete Export Begin.
| Event details |
| Event name |
delete_export_begin |
| Parameters |
additional_details |
string
Additional details pertaining to an audit log.
|
matter_id |
string
The Matter ID an audit pertains to.
|
organizational_unit_name |
string
The organizational unit name.
|
query |
string
The user inputted query for search and exports.
|
resource_name |
string
The resource name of the action, such as hold name or saved query name.
|
resource_url |
string
The document URL of the document view.
|
target_user |
string
The targeted user (such as user put on hold).
|
|
| Sample request |
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/vault?eventName=delete_export_begin&maxResults=10&access_token=YOUR_ACCESS_TOKEN
|
| Admin Console message format |
Export deletion began
|
Delete Export End
The name of the Vault event: Delete Export End.
| Event details |
| Event name |
delete_export_end |
| Parameters |
additional_details |
string
Additional details pertaining to an audit log.
|
matter_id |
string
The Matter ID an audit pertains to.
|
organizational_unit_name |
string
The organizational unit name.
|
query |
string
The user inputted query for search and exports.
|
resource_name |
string
The resource name of the action, such as hold name or saved query name.
|
resource_url |
string
The document URL of the document view.
|
target_user |
string
The targeted user (such as user put on hold).
|
|
| Sample request |
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/vault?eventName=delete_export_end&maxResults=10&access_token=YOUR_ACCESS_TOKEN
|
| Admin Console message format |
Export deletion ended
|
Delete Export Fail
The name of the Vault event: Delete Export Fail.
| Event details |
| Event name |
delete_export_fail |
| Parameters |
additional_details |
string
Additional details pertaining to an audit log.
|
matter_id |
string
The Matter ID an audit pertains to.
|
organizational_unit_name |
string
The organizational unit name.
|
query |
string
The user inputted query for search and exports.
|
resource_name |
string
The resource name of the action, such as hold name or saved query name.
|
resource_url |
string
The document URL of the document view.
|
target_user |
string
The targeted user (such as user put on hold).
|
|
| Sample request |
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/vault?eventName=delete_export_fail&maxResults=10&access_token=YOUR_ACCESS_TOKEN
|
| Admin Console message format |
Export deletion failed
|
Delete Investigation Begin
The name of the Vault event: Delete Investigation Begin.
| Event details |
| Event name |
delete_investigation_begin |
| Parameters |
additional_details |
string
Additional details pertaining to an audit log.
|
matter_id |
string
The Matter ID an audit pertains to.
|
organizational_unit_name |
string
The organizational unit name.
|
query |
string
The user inputted query for search and exports.
|
resource_name |
string
The resource name of the action, such as hold name or saved query name.
|
resource_url |
string
The document URL of the document view.
|
target_user |
string
The targeted user (such as user put on hold).
|
|
| Sample request |
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/vault?eventName=delete_investigation_begin&maxResults=10&access_token=YOUR_ACCESS_TOKEN
|
| Admin Console message format |
Investigation deletion began
|
Delete Investigation End
The name of the Vault event: Delete Investigation End.
| Event details |
| Event name |
delete_investigation_end |
| Parameters |
additional_details |
string
Additional details pertaining to an audit log.
|
matter_id |
string
The Matter ID an audit pertains to.
|
organizational_unit_name |
string
The organizational unit name.
|
query |
string
The user inputted query for search and exports.
|
resource_name |
string
The resource name of the action, such as hold name or saved query name.
|
resource_url |
string
The document URL of the document view.
|
target_user |
string
The targeted user (such as user put on hold).
|
|
| Sample request |
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/vault?eventName=delete_investigation_end&maxResults=10&access_token=YOUR_ACCESS_TOKEN
|
| Admin Console message format |
Investigation deletion ended
|
Delete Preservation Rule Begin
The name of the Vault event: Delete Preservation Rule Begin.
| Event details |
| Event name |
delete_preservation_rule_begin |
| Parameters |
additional_details |
string
Additional details pertaining to an audit log.
|
matter_id |
string
The Matter ID an audit pertains to.
|
organizational_unit_name |
string
The organizational unit name.
|
query |
string
The user inputted query for search and exports.
|
resource_name |
string
The resource name of the action, such as hold name or saved query name.
|
resource_url |
string
The document URL of the document view.
|
target_user |
string
The targeted user (such as user put on hold).
|
|
| Sample request |
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/vault?eventName=delete_preservation_rule_begin&maxResults=10&access_token=YOUR_ACCESS_TOKEN
|
| Admin Console message format |
Preservation rule deletion began
|
Delete Preservation Rule End
The name of the Vault event: Delete Preservation Rule End.
| Event details |
| Event name |
delete_preservation_rule_end |
| Parameters |
additional_details |
string
Additional details pertaining to an audit log.
|
matter_id |
string
The Matter ID an audit pertains to.
|
organizational_unit_name |
string
The organizational unit name.
|
query |
string
The user inputted query for search and exports.
|
resource_name |
string
The resource name of the action, such as hold name or saved query name.
|
resource_url |
string
The document URL of the document view.
|
target_user |
string
The targeted user (such as user put on hold).
|
|
| Sample request |
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/vault?eventName=delete_preservation_rule_end&maxResults=10&access_token=YOUR_ACCESS_TOKEN
|
| Admin Console message format |
Preservation rule deletion ended
|
Delete Retention Rule Begin
The name of the Vault event: Delete Retention Rule Begin.
| Event details |
| Event name |
delete_retention_rule_begin |
| Parameters |
additional_details |
string
Additional details pertaining to an audit log.
|
matter_id |
string
The Matter ID an audit pertains to.
|
organizational_unit_name |
string
The organizational unit name.
|
query |
string
The user inputted query for search and exports.
|
resource_name |
string
The resource name of the action, such as hold name or saved query name.
|
resource_url |
string
The document URL of the document view.
|
target_user |
string
The targeted user (such as user put on hold).
|
|
| Sample request |
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/vault?eventName=delete_retention_rule_begin&maxResults=10&access_token=YOUR_ACCESS_TOKEN
|
| Admin Console message format |
Retention rule deletion began
|
Delete Retention Rule End
The name of the Vault event: Delete Retention Rule End.
| Event details |
| Event name |
delete_retention_rule_end |
| Parameters |
additional_details |
string
Additional details pertaining to an audit log.
|
matter_id |
string
The Matter ID an audit pertains to.
|
organizational_unit_name |
string
The organizational unit name.
|
query |
string
The user inputted query for search and exports.
|
resource_name |
string
The resource name of the action, such as hold name or saved query name.
|
resource_url |
string
The document URL of the document view.
|
target_user |
string
The targeted user (such as user put on hold).
|
|
| Sample request |
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/vault?eventName=delete_retention_rule_end&maxResults=10&access_token=YOUR_ACCESS_TOKEN
|
| Admin Console message format |
Retention rule deletion ended
|
Delete Saved Query Begin
The name of the Vault event: Delete Saved Query Begin.
| Event details |
| Event name |
delete_saved_query_begin |
| Parameters |
additional_details |
string
Additional details pertaining to an audit log.
|
matter_id |
string
The Matter ID an audit pertains to.
|
organizational_unit_name |
string
The organizational unit name.
|
query |
string
The user inputted query for search and exports.
|
resource_name |
string
The resource name of the action, such as hold name or saved query name.
|
resource_url |
string
The document URL of the document view.
|
target_user |
string
The targeted user (such as user put on hold).
|
|
| Sample request |
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/vault?eventName=delete_saved_query_begin&maxResults=10&access_token=YOUR_ACCESS_TOKEN
|
| Admin Console message format |
Saved query deletion began
|
Delete Saved Query End
The name of the Vault event: Delete Saved Query End.
| Event details |
| Event name |
delete_saved_query_end |
| Parameters |
additional_details |
string
Additional details pertaining to an audit log.
|
matter_id |
string
The Matter ID an audit pertains to.
|
organizational_unit_name |
string
The organizational unit name.
|
query |
string
The user inputted query for search and exports.
|
resource_name |
string
The resource name of the action, such as hold name or saved query name.
|
resource_url |
string
The document URL of the document view.
|
target_user |
string
The targeted user (such as user put on hold).
|
|
| Sample request |
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/vault?eventName=delete_saved_query_end&maxResults=10&access_token=YOUR_ACCESS_TOKEN
|
| Admin Console message format |
Saved query deletion ended
|
Deletion Search
The name of the Vault event: Deletion Search.
| Event details |
| Event name |
deletion_search |
| Parameters |
additional_details |
string
Additional details pertaining to an audit log.
|
matter_id |
string
The Matter ID an audit pertains to.
|
organizational_unit_name |
string
The organizational unit name.
|
query |
string
The user inputted query for search and exports.
|
resource_name |
string
The resource name of the action, such as hold name or saved query name.
|
resource_url |
string
The document URL of the document view.
|
target_user |
string
The targeted user (such as user put on hold).
|
|
| Sample request |
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/vault?eventName=deletion_search&maxResults=10&access_token=YOUR_ACCESS_TOKEN
|
| Admin Console message format |
User performed a deletion search
|
Download Count Per Account CSV
The name of the Vault event: Download Count Per Account CSV.
| Event details |
| Event name |
download_count_per_account_csv |
| Parameters |
additional_details |
string
Additional details pertaining to an audit log.
|
matter_id |
string
The Matter ID an audit pertains to.
|
organizational_unit_name |
string
The organizational unit name.
|
query |
string
The user inputted query for search and exports.
|
resource_name |
string
The resource name of the action, such as hold name or saved query name.
|
resource_url |
string
The document URL of the document view.
|
target_user |
string
The targeted user (such as user put on hold).
|
|
| Sample request |
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/vault?eventName=download_count_per_account_csv&maxResults=10&access_token=YOUR_ACCESS_TOKEN
|
| Admin Console message format |
User downloaded count CSV results
|
Download Cross Matter Litigation Hold Report
The name of the Vault event: Download Cross Matter Litigation Hold Report.
| Event details |
| Event name |
download_cross_matter_litigation_hold_report |
| Parameters |
additional_details |
string
Additional details pertaining to an audit log.
|
matter_id |
string
The Matter ID an audit pertains to.
|
organizational_unit_name |
string
The organizational unit name.
|
query |
string
The user inputted query for search and exports.
|
resource_name |
string
The resource name of the action, such as hold name or saved query name.
|
resource_url |
string
The document URL of the document view.
|
target_user |
string
The targeted user (such as user put on hold).
|
|
| Sample request |
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/vault?eventName=download_cross_matter_litigation_hold_report&maxResults=10&access_token=YOUR_ACCESS_TOKEN
|
| Admin Console message format |
User downloaded cross matter litigation hold report
|
Download Per Matter Litigation Hold Report
The name of the Vault event: Download Per Matter Litigation Hold Report.
| Event details |
| Event name |
download_per_matter_litigation_hold_report |
| Parameters |
additional_details |
string
Additional details pertaining to an audit log.
|
matter_id |
string
The Matter ID an audit pertains to.
|
organizational_unit_name |
string
The organizational unit name.
|
query |
string
The user inputted query for search and exports.
|
resource_name |
string
The resource name of the action, such as hold name or saved query name.
|
resource_url |
string
The document URL of the document view.
|
target_user |
string
The targeted user (such as user put on hold).
|
|
| Sample request |
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/vault?eventName=download_per_matter_litigation_hold_report&maxResults=10&access_token=YOUR_ACCESS_TOKEN
|
| Admin Console message format |
User downloaded per matter litigation hold report
|
Export
The name of the Vault event: Export.
| Event details |
| Event name |
export |
| Parameters |
additional_details |
string
Additional details pertaining to an audit log.
|
matter_id |
string
The Matter ID an audit pertains to.
|
organizational_unit_name |
string
The organizational unit name.
|
query |
string
The user inputted query for search and exports.
|
resource_name |
string
The resource name of the action, such as hold name or saved query name.
|
resource_url |
string
The document URL of the document view.
|
target_user |
string
The targeted user (such as user put on hold).
|
|
| Sample request |
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/vault?eventName=export&maxResults=10&access_token=YOUR_ACCESS_TOKEN
|
| Admin Console message format |
User performed an export
|
Export File Download
The name of the Vault event: Export File Download.
| Event details |
| Event name |
export_file_download |
| Parameters |
additional_details |
string
Additional details pertaining to an audit log.
|
matter_id |
string
The Matter ID an audit pertains to.
|
organizational_unit_name |
string
The organizational unit name.
|
query |
string
The user inputted query for search and exports.
|
resource_name |
string
The resource name of the action, such as hold name or saved query name.
|
resource_url |
string
The document URL of the document view.
|
target_user |
string
The targeted user (such as user put on hold).
|
|
| Sample request |
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/vault?eventName=export_file_download&maxResults=10&access_token=YOUR_ACCESS_TOKEN
|
| Admin Console message format |
User downloaded an export file
|
Get Count Operation
The name of the Vault event: Get Count Operation.
| Event details |
| Event name |
get_count_operation |
| Parameters |
additional_details |
string
Additional details pertaining to an audit log.
|
matter_id |
string
The Matter ID an audit pertains to.
|
organizational_unit_name |
string
The organizational unit name.
|
query |
string
The user inputted query for search and exports.
|
resource_name |
string
The resource name of the action, such as hold name or saved query name.
|
resource_url |
string
The document URL of the document view.
|
target_user |
string
The targeted user (such as user put on hold).
|
|
| Sample request |
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/vault?eventName=get_count_operation&maxResults=10&access_token=YOUR_ACCESS_TOKEN
|
| Admin Console message format |
User viewed search count
|
Legacy Export Download
The name of the Vault event: Legacy Export Download.
| Event details |
| Event name |
legacy_export_download |
| Parameters |
additional_details |
string
Additional details pertaining to an audit log.
|
matter_id |
string
The Matter ID an audit pertains to.
|
organizational_unit_name |
string
The organizational unit name.
|
query |
string
The user inputted query for search and exports.
|
resource_name |
string
The resource name of the action, such as hold name or saved query name.
|
resource_url |
string
The document URL of the document view.
|
target_user |
string
The targeted user (such as user put on hold).
|
|
| Sample request |
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/vault?eventName=legacy_export_download&maxResults=10&access_token=YOUR_ACCESS_TOKEN
|
| Admin Console message format |
User downloaded a legacy export
|
Modify Default Retention Period Begin
The name of the Vault event: Modify Default Retention Period Begin.
| Event details |
| Event name |
modify_default_retention_period_begin |
| Parameters |
additional_details |
string
Additional details pertaining to an audit log.
|
matter_id |
string
The Matter ID an audit pertains to.
|
organizational_unit_name |
string
The organizational unit name.
|
query |
string
The user inputted query for search and exports.
|
resource_name |
string
The resource name of the action, such as hold name or saved query name.
|
resource_url |
string
The document URL of the document view.
|
target_user |
string
The targeted user (such as user put on hold).
|
|
| Sample request |
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/vault?eventName=modify_default_retention_period_begin&maxResults=10&access_token=YOUR_ACCESS_TOKEN
|
| Admin Console message format |
Default retention period modification began
|
Modify Default Retention Period End
The name of the Vault event: Modify Default Retention Period End.
| Event details |
| Event name |
modify_default_retention_period_end |
| Parameters |
additional_details |
string
Additional details pertaining to an audit log.
|
matter_id |
string
The Matter ID an audit pertains to.
|
organizational_unit_name |
string
The organizational unit name.
|
query |
string
The user inputted query for search and exports.
|
resource_name |
string
The resource name of the action, such as hold name or saved query name.
|
resource_url |
string
The document URL of the document view.
|
target_user |
string
The targeted user (such as user put on hold).
|
|
| Sample request |
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/vault?eventName=modify_default_retention_period_end&maxResults=10&access_token=YOUR_ACCESS_TOKEN
|
| Admin Console message format |
Default retention period modification ended
|
Obsolete API Exports List
The name of the Vault event: Obsolete API Exports List.
| Event details |
| Event name |
obsolete_api_exports_list |
| Parameters |
additional_details |
string
Additional details pertaining to an audit log.
|
matter_id |
string
The Matter ID an audit pertains to.
|
organizational_unit_name |
string
The organizational unit name.
|
query |
string
The user inputted query for search and exports.
|
resource_name |
string
The resource name of the action, such as hold name or saved query name.
|
resource_url |
string
The document URL of the document view.
|
target_user |
string
The targeted user (such as user put on hold).
|
|
| Sample request |
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/vault?eventName=obsolete_api_exports_list&maxResults=10&access_token=YOUR_ACCESS_TOKEN
|
| Admin Console message format |
Exports listed through the API
|
Obsolete API Holds Insert
The name of the Vault event: Obsolete API Holds Insert.
| Event details |
| Event name |
obsolete_api_holds_insert |
| Parameters |
additional_details |
string
Additional details pertaining to an audit log.
|
matter_id |
string
The Matter ID an audit pertains to.
|
organizational_unit_name |
string
The organizational unit name.
|
query |
string
The user inputted query for search and exports.
|
resource_name |
string
The resource name of the action, such as hold name or saved query name.
|
resource_url |
string
The document URL of the document view.
|
target_user |
string
The targeted user (such as user put on hold).
|
|
| Sample request |
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/vault?eventName=obsolete_api_holds_insert&maxResults=10&access_token=YOUR_ACCESS_TOKEN
|
| Admin Console message format |
Holds inserted through the API
|
Obsolete API Holds List
The name of the Vault event: Obsolete API Holds List.
| Event details |
| Event name |
obsolete_api_holds_list |
| Parameters |
additional_details |
string
Additional details pertaining to an audit log.
|
matter_id |
string
The Matter ID an audit pertains to.
|
organizational_unit_name |
string
The organizational unit name.
|
query |
string
The user inputted query for search and exports.
|
resource_name |
string
The resource name of the action, such as hold name or saved query name.
|
resource_url |
string
The document URL of the document view.
|
target_user |
string
The targeted user (such as user put on hold).
|
|
| Sample request |
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/vault?eventName=obsolete_api_holds_list&maxResults=10&access_token=YOUR_ACCESS_TOKEN
|
| Admin Console message format |
Holds listed through the API
|
Obsolete API Matters Delete
The name of the Vault event: Obsolete API Matters Delete.
| Event details |
| Event name |
obsolete_api_matters_delete |
| Parameters |
additional_details |
string
Additional details pertaining to an audit log.
|
matter_id |
string
The Matter ID an audit pertains to.
|
organizational_unit_name |
string
The organizational unit name.
|
query |
string
The user inputted query for search and exports.
|
resource_name |
string
The resource name of the action, such as hold name or saved query name.
|
resource_url |
string
The document URL of the document view.
|
target_user |
string
The targeted user (such as user put on hold).
|
|
| Sample request |
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/vault?eventName=obsolete_api_matters_delete&maxResults=10&access_token=YOUR_ACCESS_TOKEN
|
| Admin Console message format |
Matters deleted through the API
|
Obsolete API Matters Get
The name of the Vault event: Obsolete API Matters Get.
| Event details |
| Event name |
obsolete_api_matters_get |
| Parameters |
additional_details |
string
Additional details pertaining to an audit log.
|
matter_id |
string
The Matter ID an audit pertains to.
|
organizational_unit_name |
string
The organizational unit name.
|
query |
string
The user inputted query for search and exports.
|
resource_name |
string
The resource name of the action, such as hold name or saved query name.
|
resource_url |
string
The document URL of the document view.
|
target_user |
string
The targeted user (such as user put on hold).
|
|
| Sample request |
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/vault?eventName=obsolete_api_matters_get&maxResults=10&access_token=YOUR_ACCESS_TOKEN
|
| Admin Console message format |
Matter details retrieved through the API
|
Obsolete API Matters Insert
The name of the Vault event: Obsolete API Matters Insert.
| Event details |
| Event name |
obsolete_api_matters_insert |
| Parameters |
additional_details |
string
Additional details pertaining to an audit log.
|
matter_id |
string
The Matter ID an audit pertains to.
|
organizational_unit_name |
string
The organizational unit name.
|
query |
string
The user inputted query for search and exports.
|
resource_name |
string
The resource name of the action, such as hold name or saved query name.
|
resource_url |
string
The document URL of the document view.
|
target_user |
string
The targeted user (such as user put on hold).
|
|
| Sample request |
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/vault?eventName=obsolete_api_matters_insert&maxResults=10&access_token=YOUR_ACCESS_TOKEN
|
| Admin Console message format |
Matters inserted through the API
|
Obsolete API Matters List
The name of the Vault event: Obsolete API Matters List.
| Event details |
| Event name |
obsolete_api_matters_list |
| Parameters |
additional_details |
string
Additional details pertaining to an audit log.
|
matter_id |
string
The Matter ID an audit pertains to.
|
organizational_unit_name |
string
The organizational unit name.
|
query |
string
The user inputted query for search and exports.
|
resource_name |
string
The resource name of the action, such as hold name or saved query name.
|
resource_url |
string
The document URL of the document view.
|
target_user |
string
The targeted user (such as user put on hold).
|
|
| Sample request |
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/vault?eventName=obsolete_api_matters_list&maxResults=10&access_token=YOUR_ACCESS_TOKEN
|
| Admin Console message format |
Matters listed through the API
|
Obsolete API Matters Update
The name of the Vault event: Obsolete API Matters Update.
| Event details |
| Event name |
obsolete_api_matters_update |
| Parameters |
additional_details |
string
Additional details pertaining to an audit log.
|
matter_id |
string
The Matter ID an audit pertains to.
|
organizational_unit_name |
string
The organizational unit name.
|
query |
string
The user inputted query for search and exports.
|
resource_name |
string
The resource name of the action, such as hold name or saved query name.
|
resource_url |
string
The document URL of the document view.
|
target_user |
string
The targeted user (such as user put on hold).
|
|
| Sample request |
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/vault?eventName=obsolete_api_matters_update&maxResults=10&access_token=YOUR_ACCESS_TOKEN
|
| Admin Console message format |
A matter updated through the API
|
Obsolete Preview Retention Rule Count
The name of the Vault event: Obsolete Preview Retention Rule Count.
| Event details |
| Event name |
obsolete_preview_retention_rule_count |
| Parameters |
additional_details |
string
Additional details pertaining to an audit log.
|
matter_id |
string
The Matter ID an audit pertains to.
|
organizational_unit_name |
string
The organizational unit name.
|
query |
string
The user inputted query for search and exports.
|
resource_name |
string
The resource name of the action, such as hold name or saved query name.
|
resource_url |
string
The document URL of the document view.
|
target_user |
string
The targeted user (such as user put on hold).
|
|
| Sample request |
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/vault?eventName=obsolete_preview_retention_rule_count&maxResults=10&access_token=YOUR_ACCESS_TOKEN
|
| Admin Console message format |
User previewed retention rule count
|
Preview Retention Rule
The name of the Vault event: Preview Retention Rule.
| Event details |
| Event name |
preview_retention_rule |
| Parameters |
additional_details |
string
Additional details pertaining to an audit log.
|
matter_id |
string
The Matter ID an audit pertains to.
|
organizational_unit_name |
string
The organizational unit name.
|
query |
string
The user inputted query for search and exports.
|
resource_name |
string
The resource name of the action, such as hold name or saved query name.
|
resource_url |
string
The document URL of the document view.
|
target_user |
string
The targeted user (such as user put on hold).
|
|
| Sample request |
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/vault?eventName=preview_retention_rule&maxResults=10&access_token=YOUR_ACCESS_TOKEN
|
| Admin Console message format |
User previewed retention rule
|
Remove Collaborator Begin
The name of the Vault event: Remove Collaborator Begin.
| Event details |
| Event name |
remove_collaborator_begin |
| Parameters |
additional_details |
string
Additional details pertaining to an audit log.
|
matter_id |
string
The Matter ID an audit pertains to.
|
organizational_unit_name |
string
The organizational unit name.
|
query |
string
The user inputted query for search and exports.
|
resource_name |
string
The resource name of the action, such as hold name or saved query name.
|
resource_url |
string
The document URL of the document view.
|
target_user |
string
The targeted user (such as user put on hold).
|
|
| Sample request |
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/vault?eventName=remove_collaborator_begin&maxResults=10&access_token=YOUR_ACCESS_TOKEN
|
| Admin Console message format |
Collaborator removal began
|
Remove Collaborator End
The name of the Vault event: Remove Collaborator End.
| Event details |
| Event name |
remove_collaborator_end |
| Parameters |
additional_details |
string
Additional details pertaining to an audit log.
|
matter_id |
string
The Matter ID an audit pertains to.
|
organizational_unit_name |
string
The organizational unit name.
|
query |
string
The user inputted query for search and exports.
|
resource_name |
string
The resource name of the action, such as hold name or saved query name.
|
resource_url |
string
The document URL of the document view.
|
target_user |
string
The targeted user (such as user put on hold).
|
|
| Sample request |
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/vault?eventName=remove_collaborator_end&maxResults=10&access_token=YOUR_ACCESS_TOKEN
|
| Admin Console message format |
Collaborator removal ended
|
Remove Litigation Hold Begin
The name of the Vault event: Remove Litigation Hold Begin.
| Event details |
| Event name |
remove_litigation_hold_begin |
| Parameters |
additional_details |
string
Additional details pertaining to an audit log.
|
matter_id |
string
The Matter ID an audit pertains to.
|
organizational_unit_name |
string
The organizational unit name.
|
query |
string
The user inputted query for search and exports.
|
resource_name |
string
The resource name of the action, such as hold name or saved query name.
|
resource_url |
string
The document URL of the document view.
|
target_user |
string
The targeted user (such as user put on hold).
|
|
| Sample request |
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/vault?eventName=remove_litigation_hold_begin&maxResults=10&access_token=YOUR_ACCESS_TOKEN
|
| Admin Console message format |
Litigation hold removal began
|
Remove Litigation Hold End
The name of the Vault event: Remove Litigation Hold End.
| Event details |
| Event name |
remove_litigation_hold_end |
| Parameters |
additional_details |
string
Additional details pertaining to an audit log.
|
matter_id |
string
The Matter ID an audit pertains to.
|
organizational_unit_name |
string
The organizational unit name.
|
query |
string
The user inputted query for search and exports.
|
resource_name |
string
The resource name of the action, such as hold name or saved query name.
|
resource_url |
string
The document URL of the document view.
|
target_user |
string
The targeted user (such as user put on hold).
|
|
| Sample request |
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/vault?eventName=remove_litigation_hold_end&maxResults=10&access_token=YOUR_ACCESS_TOKEN
|
| Admin Console message format |
Litigation hold removal ended
|
Reopen Investigation Begin
The name of the Vault event: Reopen Investigation Begin.
| Event details |
| Event name |
reopen_investigation_begin |
| Parameters |
additional_details |
string
Additional details pertaining to an audit log.
|
matter_id |
string
The Matter ID an audit pertains to.
|
organizational_unit_name |
string
The organizational unit name.
|
query |
string
The user inputted query for search and exports.
|
resource_name |
string
The resource name of the action, such as hold name or saved query name.
|
resource_url |
string
The document URL of the document view.
|
target_user |
string
The targeted user (such as user put on hold).
|
|
| Sample request |
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/vault?eventName=reopen_investigation_begin&maxResults=10&access_token=YOUR_ACCESS_TOKEN
|
| Admin Console message format |
Investigation reopening began
|
Reopen Investigation End
The name of the Vault event: Reopen Investigation End.
| Event details |
| Event name |
reopen_investigation_end |
| Parameters |
additional_details |
string
Additional details pertaining to an audit log.
|
matter_id |
string
The Matter ID an audit pertains to.
|
organizational_unit_name |
string
The organizational unit name.
|
query |
string
The user inputted query for search and exports.
|
resource_name |
string
The resource name of the action, such as hold name or saved query name.
|
resource_url |
string
The document URL of the document view.
|
target_user |
string
The targeted user (such as user put on hold).
|
|
| Sample request |
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/vault?eventName=reopen_investigation_end&maxResults=10&access_token=YOUR_ACCESS_TOKEN
|
| Admin Console message format |
Investigation reopening ended
|
Restore Investigation Begin
The name of the Vault event: Restore Investigation Begin.
| Event details |
| Event name |
restore_investigation_begin |
| Parameters |
additional_details |
string
Additional details pertaining to an audit log.
|
matter_id |
string
The Matter ID an audit pertains to.
|
organizational_unit_name |
string
The organizational unit name.
|
query |
string
The user inputted query for search and exports.
|
resource_name |
string
The resource name of the action, such as hold name or saved query name.
|
resource_url |
string
The document URL of the document view.
|
target_user |
string
The targeted user (such as user put on hold).
|
|
| Sample request |
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/vault?eventName=restore_investigation_begin&maxResults=10&access_token=YOUR_ACCESS_TOKEN
|
| Admin Console message format |
Investigation restoration began
|
Restore Investigation End
The name of the Vault event: Restore Investigation End.
| Event details |
| Event name |
restore_investigation_end |
| Parameters |
additional_details |
string
Additional details pertaining to an audit log.
|
matter_id |
string
The Matter ID an audit pertains to.
|
organizational_unit_name |
string
The organizational unit name.
|
query |
string
The user inputted query for search and exports.
|
resource_name |
string
The resource name of the action, such as hold name or saved query name.
|
resource_url |
string
The document URL of the document view.
|
target_user |
string
The targeted user (such as user put on hold).
|
|
| Sample request |
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/vault?eventName=restore_investigation_end&maxResults=10&access_token=YOUR_ACCESS_TOKEN
|
| Admin Console message format |
Investigation restoration ended
|
Search
The name of the Vault event: Search.
| Event details |
| Event name |
search |
| Parameters |
additional_details |
string
Additional details pertaining to an audit log.
|
matter_id |
string
The Matter ID an audit pertains to.
|
organizational_unit_name |
string
The organizational unit name.
|
query |
string
The user inputted query for search and exports.
|
resource_name |
string
The resource name of the action, such as hold name or saved query name.
|
resource_url |
string
The document URL of the document view.
|
target_user |
string
The targeted user (such as user put on hold).
|
|
| Sample request |
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/vault?eventName=search&maxResults=10&access_token=YOUR_ACCESS_TOKEN
|
| Admin Console message format |
User performed a search
|
Search Count
The name of the Vault event: Search Count.
| Event details |
| Event name |
search_count |
| Parameters |
additional_details |
string
Additional details pertaining to an audit log.
|
matter_id |
string
The Matter ID an audit pertains to.
|
organizational_unit_name |
string
The organizational unit name.
|
query |
string
The user inputted query for search and exports.
|
resource_name |
string
The resource name of the action, such as hold name or saved query name.
|
resource_url |
string
The document URL of the document view.
|
target_user |
string
The targeted user (such as user put on hold).
|
|
| Sample request |
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/vault?eventName=search_count&maxResults=10&access_token=YOUR_ACCESS_TOKEN
|
| Admin Console message format |
User ran a count search
|
Update Investigation Details Begin
The name of the Vault event: Update Investigation Details Begin.
| Event details |
| Event name |
update_investigation_details_begin |
| Parameters |
additional_details |
string
Additional details pertaining to an audit log.
|
matter_id |
string
The Matter ID an audit pertains to.
|
organizational_unit_name |
string
The organizational unit name.
|
query |
string
The user inputted query for search and exports.
|
resource_name |
string
The resource name of the action, such as hold name or saved query name.
|
resource_url |
string
The document URL of the document view.
|
target_user |
string
The targeted user (such as user put on hold).
|
|
| Sample request |
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/vault?eventName=update_investigation_details_begin&maxResults=10&access_token=YOUR_ACCESS_TOKEN
|
| Admin Console message format |
Investigation details update began
|
Update Investigation Details End
The name of the Vault event: Update Investigation Details End.
| Event details |
| Event name |
update_investigation_details_end |
| Parameters |
additional_details |
string
Additional details pertaining to an audit log.
|
matter_id |
string
The Matter ID an audit pertains to.
|
organizational_unit_name |
string
The organizational unit name.
|
query |
string
The user inputted query for search and exports.
|
resource_name |
string
The resource name of the action, such as hold name or saved query name.
|
resource_url |
string
The document URL of the document view.
|
target_user |
string
The targeted user (such as user put on hold).
|
|
| Sample request |
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/vault?eventName=update_investigation_details_end&maxResults=10&access_token=YOUR_ACCESS_TOKEN
|
| Admin Console message format |
Investigation details update ended
|
Update Preservation Rule Add Holds Begin
The name of the Vault event: Update Preservation Rule Add Holds Begin.
| Event details |
| Event name |
update_preservation_rule_add_holds_begin |
| Parameters |
additional_details |
string
Additional details pertaining to an audit log.
|
matter_id |
string
The Matter ID an audit pertains to.
|
organizational_unit_name |
string
The organizational unit name.
|
query |
string
The user inputted query for search and exports.
|
resource_name |
string
The resource name of the action, such as hold name or saved query name.
|
resource_url |
string
The document URL of the document view.
|
target_user |
string
The targeted user (such as user put on hold).
|
|
| Sample request |
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/vault?eventName=update_preservation_rule_add_holds_begin&maxResults=10&access_token=YOUR_ACCESS_TOKEN
|
| Admin Console message format |
Preservation rule addition update began
|
Update Preservation Rule Add Holds End
The name of the Vault event: Update Preservation Rule Add Holds End.
| Event details |
| Event name |
update_preservation_rule_add_holds_end |
| Parameters |
additional_details |
string
Additional details pertaining to an audit log.
|
matter_id |
string
The Matter ID an audit pertains to.
|
organizational_unit_name |
string
The organizational unit name.
|
query |
string
The user inputted query for search and exports.
|
resource_name |
string
The resource name of the action, such as hold name or saved query name.
|
resource_url |
string
The document URL of the document view.
|
target_user |
string
The targeted user (such as user put on hold).
|
|
| Sample request |
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/vault?eventName=update_preservation_rule_add_holds_end&maxResults=10&access_token=YOUR_ACCESS_TOKEN
|
| Admin Console message format |
Preservation rule addition update ended
|
Update Preservation Rule Query Begin
The name of the Vault event: Update Preservation Rule Query Begin.
| Event details |
| Event name |
update_preservation_rule_query_begin |
| Parameters |
additional_details |
string
Additional details pertaining to an audit log.
|
matter_id |
string
The Matter ID an audit pertains to.
|
organizational_unit_name |
string
The organizational unit name.
|
query |
string
The user inputted query for search and exports.
|
resource_name |
string
The resource name of the action, such as hold name or saved query name.
|
resource_url |
string
The document URL of the document view.
|
target_user |
string
The targeted user (such as user put on hold).
|
|
| Sample request |
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/vault?eventName=update_preservation_rule_query_begin&maxResults=10&access_token=YOUR_ACCESS_TOKEN
|
| Admin Console message format |
Preservation rule query update began
|
Update Preservation Rule Query End
The name of the Vault event: Update Preservation Rule Query End.
| Event details |
| Event name |
update_preservation_rule_query_end |
| Parameters |
additional_details |
string
Additional details pertaining to an audit log.
|
matter_id |
string
The Matter ID an audit pertains to.
|
organizational_unit_name |
string
The organizational unit name.
|
query |
string
The user inputted query for search and exports.
|
resource_name |
string
The resource name of the action, such as hold name or saved query name.
|
resource_url |
string
The document URL of the document view.
|
target_user |
string
The targeted user (such as user put on hold).
|
|
| Sample request |
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/vault?eventName=update_preservation_rule_query_end&maxResults=10&access_token=YOUR_ACCESS_TOKEN
|
| Admin Console message format |
Preservation rule query update ended
|
Update Preservation Rule Remove Holds Begin
The name of the Vault event: Update Preservation Rule Remove Holds Begin.
| Event details |
| Event name |
update_preservation_rule_remove_holds_begin |
| Parameters |
additional_details |
string
Additional details pertaining to an audit log.
|
matter_id |
string
The Matter ID an audit pertains to.
|
organizational_unit_name |
string
The organizational unit name.
|
query |
string
The user inputted query for search and exports.
|
resource_name |
string
The resource name of the action, such as hold name or saved query name.
|
resource_url |
string
The document URL of the document view.
|
target_user |
string
The targeted user (such as user put on hold).
|
|
| Sample request |
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/vault?eventName=update_preservation_rule_remove_holds_begin&maxResults=10&access_token=YOUR_ACCESS_TOKEN
|
| Admin Console message format |
Preservation rule removal update began
|
Update Preservation Rule Remove Holds End
The name of the Vault event: Update Preservation Rule Remove Holds End.
| Event details |
| Event name |
update_preservation_rule_remove_holds_end |
| Parameters |
additional_details |
string
Additional details pertaining to an audit log.
|
matter_id |
string
The Matter ID an audit pertains to.
|
organizational_unit_name |
string
The organizational unit name.
|
query |
string
The user inputted query for search and exports.
|
resource_name |
string
The resource name of the action, such as hold name or saved query name.
|
resource_url |
string
The document URL of the document view.
|
target_user |
string
The targeted user (such as user put on hold).
|
|
| Sample request |
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/vault?eventName=update_preservation_rule_remove_holds_end&maxResults=10&access_token=YOUR_ACCESS_TOKEN
|
| Admin Console message format |
Preservation rule removal update ended
|
Update Retention Rule Begin
The name of the Vault event: Update Retention Rule Begin.
| Event details |
| Event name |
update_retention_rule_begin |
| Parameters |
additional_details |
string
Additional details pertaining to an audit log.
|
matter_id |
string
The Matter ID an audit pertains to.
|
organizational_unit_name |
string
The organizational unit name.
|
query |
string
The user inputted query for search and exports.
|
resource_name |
string
The resource name of the action, such as hold name or saved query name.
|
resource_url |
string
The document URL of the document view.
|
target_user |
string
The targeted user (such as user put on hold).
|
|
| Sample request |
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/vault?eventName=update_retention_rule_begin&maxResults=10&access_token=YOUR_ACCESS_TOKEN
|
| Admin Console message format |
Retention rule update began
|
Update Retention Rule End
The name of the Vault event: Update Retention Rule End.
| Event details |
| Event name |
update_retention_rule_end |
| Parameters |
additional_details |
string
Additional details pertaining to an audit log.
|
matter_id |
string
The Matter ID an audit pertains to.
|
organizational_unit_name |
string
The organizational unit name.
|
query |
string
The user inputted query for search and exports.
|
resource_name |
string
The resource name of the action, such as hold name or saved query name.
|
resource_url |
string
The document URL of the document view.
|
target_user |
string
The targeted user (such as user put on hold).
|
|
| Sample request |
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/vault?eventName=update_retention_rule_end&maxResults=10&access_token=YOUR_ACCESS_TOKEN
|
| Admin Console message format |
Retention rule update ended
|
Update Retention Settings
The name of the Vault event: Update Retention Settings.
| Event details |
| Event name |
update_retention_settings |
| Parameters |
additional_details |
string
Additional details pertaining to an audit log.
|
matter_id |
string
The Matter ID an audit pertains to.
|
organizational_unit_name |
string
The organizational unit name.
|
query |
string
The user inputted query for search and exports.
|
resource_name |
string
The resource name of the action, such as hold name or saved query name.
|
resource_url |
string
The document URL of the document view.
|
target_user |
string
The targeted user (such as user put on hold).
|
|
| Sample request |
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/vault?eventName=update_retention_settings&maxResults=10&access_token=YOUR_ACCESS_TOKEN
|
| Admin Console message format |
User updated retention settings
|
Update Saved Query Details Begin
The name of the Vault event: Update Saved Query Details Begin.
| Event details |
| Event name |
update_saved_query_details_begin |
| Parameters |
additional_details |
string
Additional details pertaining to an audit log.
|
matter_id |
string
The Matter ID an audit pertains to.
|
organizational_unit_name |
string
The organizational unit name.
|
query |
string
The user inputted query for search and exports.
|
resource_name |
string
The resource name of the action, such as hold name or saved query name.
|
resource_url |
string
The document URL of the document view.
|
target_user |
string
The targeted user (such as user put on hold).
|
|
| Sample request |
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/vault?eventName=update_saved_query_details_begin&maxResults=10&access_token=YOUR_ACCESS_TOKEN
|
| Admin Console message format |
Saved query details update began
|
Update Saved Query Details End
The name of the Vault event: Update Saved Query Details End.
| Event details |
| Event name |
update_saved_query_details_end |
| Parameters |
additional_details |
string
Additional details pertaining to an audit log.
|
matter_id |
string
The Matter ID an audit pertains to.
|
organizational_unit_name |
string
The organizational unit name.
|
query |
string
The user inputted query for search and exports.
|
resource_name |
string
The resource name of the action, such as hold name or saved query name.
|
resource_url |
string
The document URL of the document view.
|
target_user |
string
The targeted user (such as user put on hold).
|
|
| Sample request |
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/vault?eventName=update_saved_query_details_end&maxResults=10&access_token=YOUR_ACCESS_TOKEN
|
| Admin Console message format |
Saved query details update ended
|
View Cross Matter Litigation Hold Report
The name of the Vault event: View Cross Matter Litigation Hold Report.
| Event details |
| Event name |
view_cross_matter_litigation_hold_report |
| Parameters |
additional_details |
string
Additional details pertaining to an audit log.
|
matter_id |
string
The Matter ID an audit pertains to.
|
organizational_unit_name |
string
The organizational unit name.
|
query |
string
The user inputted query for search and exports.
|
resource_name |
string
The resource name of the action, such as hold name or saved query name.
|
resource_url |
string
The document URL of the document view.
|
target_user |
string
The targeted user (such as user put on hold).
|
|
| Sample request |
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/vault?eventName=view_cross_matter_litigation_hold_report&maxResults=10&access_token=YOUR_ACCESS_TOKEN
|
| Admin Console message format |
User viewed a cross matter litigation hold report
|
View Custodian Litigation Hold Report
The name of the Vault event: View Custodian Litigation Hold Report.
| Event details |
| Event name |
view_custodian_litigation_hold_report |
| Parameters |
additional_details |
string
Additional details pertaining to an audit log.
|
matter_id |
string
The Matter ID an audit pertains to.
|
organizational_unit_name |
string
The organizational unit name.
|
query |
string
The user inputted query for search and exports.
|
resource_name |
string
The resource name of the action, such as hold name or saved query name.
|
resource_url |
string
The document URL of the document view.
|
target_user |
string
The targeted user (such as user put on hold).
|
|
| Sample request |
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/vault?eventName=view_custodian_litigation_hold_report&maxResults=10&access_token=YOUR_ACCESS_TOKEN
|
| Admin Console message format |
User viewed a custodian litigation hold report
|
View Document
The name of the Vault event: View Document.
| Event details |
| Event name |
view_document |
| Parameters |
additional_details |
string
Additional details pertaining to an audit log.
|
matter_id |
string
The Matter ID an audit pertains to.
|
organizational_unit_name |
string
The organizational unit name.
|
query |
string
The user inputted query for search and exports.
|
resource_name |
string
The resource name of the action, such as hold name or saved query name.
|
resource_url |
string
The document URL of the document view.
|
target_user |
string
The targeted user (such as user put on hold).
|
|
| Sample request |
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/vault?eventName=view_document&maxResults=10&access_token=YOUR_ACCESS_TOKEN
|
| Admin Console message format |
User viewed a document
|
The name of the Vault event: View Document Information.
| Event details |
| Event name |
view_document_information |
| Parameters |
additional_details |
string
Additional details pertaining to an audit log.
|
matter_id |
string
The Matter ID an audit pertains to.
|
organizational_unit_name |
string
The organizational unit name.
|
query |
string
The user inputted query for search and exports.
|
resource_name |
string
The resource name of the action, such as hold name or saved query name.
|
resource_url |
string
The document URL of the document view.
|
target_user |
string
The targeted user (such as user put on hold).
|
|
| Sample request |
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/vault?eventName=view_document_information&maxResults=10&access_token=YOUR_ACCESS_TOKEN
|
| Admin Console message format |
User viewed a document’s information
|
View External Document
The name of the Vault event: View External Document.
| Event details |
| Event name |
view_external_document |
| Parameters |
additional_details |
string
Additional details pertaining to an audit log.
|
matter_id |
string
The Matter ID an audit pertains to.
|
organizational_unit_name |
string
The organizational unit name.
|
query |
string
The user inputted query for search and exports.
|
resource_name |
string
The resource name of the action, such as hold name or saved query name.
|
resource_url |
string
The document URL of the document view.
|
target_user |
string
The targeted user (such as user put on hold).
|
|
| Sample request |
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/vault?eventName=view_external_document&maxResults=10&access_token=YOUR_ACCESS_TOKEN
|
| Admin Console message format |
User viewed an external document
|
View Investigation
The name of the Vault event: View Investigation.
| Event details |
| Event name |
view_investigation |
| Parameters |
additional_details |
string
Additional details pertaining to an audit log.
|
matter_id |
string
The Matter ID an audit pertains to.
|
organizational_unit_name |
string
The organizational unit name.
|
query |
string
The user inputted query for search and exports.
|
resource_name |
string
The resource name of the action, such as hold name or saved query name.
|
resource_url |
string
The document URL of the document view.
|
target_user |
string
The targeted user (such as user put on hold).
|
|
| Sample request |
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/vault?eventName=view_investigation&maxResults=10&access_token=YOUR_ACCESS_TOKEN
|
| Admin Console message format |
User viewed a matter
|
View Matter Audit Log
The name of the Vault event: View Matter Audit Log.
| Event details |
| Event name |
view_matter_audit_log |
| Parameters |
additional_details |
string
Additional details pertaining to an audit log.
|
matter_id |
string
The Matter ID an audit pertains to.
|
organizational_unit_name |
string
The organizational unit name.
|
query |
string
The user inputted query for search and exports.
|
resource_name |
string
The resource name of the action, such as hold name or saved query name.
|
resource_url |
string
The document URL of the document view.
|
target_user |
string
The targeted user (such as user put on hold).
|
|
| Sample request |
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/vault?eventName=view_matter_audit_log&maxResults=10&access_token=YOUR_ACCESS_TOKEN
|
| Admin Console message format |
User viewed a matter’s log events
|
View Per Matter Litigation Hold Report
The name of the Vault event: View Per Matter Litigation Hold Report.
| Event details |
| Event name |
view_per_matter_litigation_hold_report |
| Parameters |
additional_details |
string
Additional details pertaining to an audit log.
|
matter_id |
string
The Matter ID an audit pertains to.
|
organizational_unit_name |
string
The organizational unit name.
|
query |
string
The user inputted query for search and exports.
|
resource_name |
string
The resource name of the action, such as hold name or saved query name.
|
resource_url |
string
The document URL of the document view.
|
target_user |
string
The targeted user (such as user put on hold).
|
|
| Sample request |
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/vault?eventName=view_per_matter_litigation_hold_report&maxResults=10&access_token=YOUR_ACCESS_TOKEN
|
| Admin Console message format |
User viewed a matter litigation hold report
|
View Retention Policy
The name of the Vault event: View Retention Policy.
| Event details |
| Event name |
view_retention_policy |
| Parameters |
additional_details |
string
Additional details pertaining to an audit log.
|
matter_id |
string
The Matter ID an audit pertains to.
|
organizational_unit_name |
string
The organizational unit name.
|
query |
string
The user inputted query for search and exports.
|
resource_name |
string
The resource name of the action, such as hold name or saved query name.
|
resource_url |
string
The document URL of the document view.
|
target_user |
string
The targeted user (such as user put on hold).
|
|
| Sample request |
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/vault?eventName=view_retention_policy&maxResults=10&access_token=YOUR_ACCESS_TOKEN
|
| Admin Console message format |
User viewed retention policy
|
View Retention Settings
The name of the Vault event: View Retention Settings.
| Event details |
| Event name |
view_retention_settings |
| Parameters |
additional_details |
string
Additional details pertaining to an audit log.
|
matter_id |
string
The Matter ID an audit pertains to.
|
organizational_unit_name |
string
The organizational unit name.
|
query |
string
The user inputted query for search and exports.
|
resource_name |
string
The resource name of the action, such as hold name or saved query name.
|
resource_url |
string
The document URL of the document view.
|
target_user |
string
The targeted user (such as user put on hold).
|
|
| Sample request |
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/vault?eventName=view_retention_settings&maxResults=10&access_token=YOUR_ACCESS_TOKEN
|
| Admin Console message format |
User viewed retention settings
|
View System Audit Log
The name of the Vault event: View System Audit Log.
| Event details |
| Event name |
view_system_audit_log |
| Parameters |
additional_details |
string
Additional details pertaining to an audit log.
|
matter_id |
string
The Matter ID an audit pertains to.
|
organizational_unit_name |
string
The organizational unit name.
|
query |
string
The user inputted query for search and exports.
|
resource_name |
string
The resource name of the action, such as hold name or saved query name.
|
resource_url |
string
The document URL of the document view.
|
target_user |
string
The targeted user (such as user put on hold).
|
|
| Sample request |
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/vault?eventName=view_system_audit_log&maxResults=10&access_token=YOUR_ACCESS_TOKEN
|
| Admin Console message format |
User viewed the system’s log events
|
