The Drive activity report provides information about your users' activities when they manage, modify, and share files on Google Drive in Google Workspace. For example, you can use the Drive activity report to get a list of all the new Drive documents created by a particular user over a specified range of dates. You can use this information to gain insight into better content management and possible data leaks. To obtain a report, you use the basic report endpoint request with report-specific parameters such as a user's email address or a specific kind of Google Drive change. Reports can include data for up to the last 180 days.
The Google Drive activity report may be used only for lawful purposes in accounts which have a license assigned.
For information about the request's query strings and the response properties, see the API Reference. For information about specific events related to Google Drive, see Drive event names.
Retrieve Google Drive events for a domain
You can use the Drive activity report to list information about your
Drive documents. For example, you can request a report listing
your account's 25 most recent Drive events, covering up to 180
days. To get this report, obtain an authorization token as described in the
authorization guide, then use
the following HTTP GET
request:
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all
/applications/drive?maxResults=25
You can see an example response to this API call.
The following example retrieves a report of all Drive events for the past 180 days, the maximum period.
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all
/applications/drive
Retrieve Google Drive events by user
To retrieve a report of Google Drive activities of a particular user, use an
HTTP GET
request with the authorization token described in the
authorization guide guide.
The userKey
field is the primary email address of the user in the report, or
all
for all users.
The following example retrieves a report listing all changes made by the specified user. For an example of an API response, see the sample JSON response.
GET https://admin.googleapis.com/admin/reports/v1/activity/users/kim@example.com
/applications/drive
Retrieve Google Drive events for shared drives
You can retrieve a report of Google Drive activities for a specific shared
drive using an HTTP GET
request with the authorization token described in the
authorization guide. Specify the
email address of the user you want to run the report on in the userKey
field,
or specify all
to run the report on all users.
The following example retrieves a report of all changes for a specific shared drive. For an example of an API response, see the sample JSON response.
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all
/applications/drive?filters=shared_drive_id==<id of shared drive>
To retrieve events for a shared drive, filter using the doc_type
. The
following example retrieves events that affect all shared drives:
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all
/applications/drive?filters=doc_type=shared_drive
To retrieve events for membership changes, specify the shared_drive_membership_change
event. The following example retrieves all member additions to shared drives:
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all
/applications/drive?evetName=shared_drive_membership_change&
filters=membership_change_type==add_to_shared_drive
Retrieve Google Drive events by event type
To retrieve a report of all instances of a specific event type, such as creating
or editing a document, use an HTTP GET
request with the authorization
token described in the authorization guide.
The userKey
field is the primary email address of the user in the report, or
all
for all users.
The following example retrieves a report of all account documentation creation activities. For an example of an API response, see the sample JSON response:
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all
/applications/drive?eventName=create
Example JSON response
When you make an HTTP GET
request to the API, a successful response returns an
HTTP 200 status code. Along with the status code, the response returns a report
for the Drive. These reports are also available in the
Admin console. For more information, see the
Google Workspace Admin help center.
For eventName
information, see the
Drive event names
reference. For more information about the request's query strings and the
response properties, see the API Reference.
{ "kind": "reports#auditActivities", "nextPageToken": "next page's token", "items": [ { "kind": "audit#activity", "id": { "time": "2014-03-17T15:39:18.460Z", "uniqQualifier": "report's unique ID", "applicationName": "drive", "customerId": "ABC123xyz" }, "actor": { "callerType": "USER", "email": "kim@example.com", "profileId": "user's unique Google Workspace profile ID", "key": "consumer key of requestor in an OAuth 2LO request" }, "ownerDomain": "domain of the source owner", "ipAddress": "user's IP address", "events": [ { "type": "access", "name": "edit", "parameters": [ { "name": "primary_event", "boolValue": true }, { "name": "owner_is_shared_drive", "boolValue": false }, { "name": "doc_id", "value": "1DWuYM3ot_sAyEQqOz0xWJ9bVMSYzOmRNeBqbgtSwuK8" }, { "name": "doc_title", "value": "Meeting notes" }, { "name": "doc_type", "value": "document" }, { "name": "owner", "value": "mary@example.com" } ] } ] }, ] }