Method: activities.list

string

Represents the profile ID or the user email for which the data should be filtered. Can be all for all information, or userKey for a user's unique Google Workspace profile ID or their primary email address. Must not be a deleted user. For a deleted user, call users.list in Directory API with showDeleted=true, then use the returned ID as the userKey.

enum (ApplicationName)

Application name for which the events are to be retrieved.

string

The Internet Protocol (IP) Address of host where the event was performed. This is an additional way to filter a report's summary using the IP address of the user whose activity is being reported. This IP address may or may not reflect the user's physical location. For example, the IP address can be the user's proxy server's address or a virtual private network (VPN) address. This parameter supports both IPv4 and IPv6 address versions.

string

The unique ID of the customer to retrieve data for.

string

Sets the end of the range of time shown in the report. The date is in the RFC 3339 format, for example 2010-10-28T10:26:35.000Z. The default value is the approximate time of the API request. An API report has three basic time concepts:

• Date of the API's request for a report: When the API created and retrieved the report.
• Report's start time: The beginning of the timespan shown in the report. The startTime must be before the endTime (if specified) and the current time when the request is made, or the API returns an error.
• Report's end time: The end of the timespan shown in the report. For example, the timespan of events summarized in a report can start in April and end in May. The report itself can be requested in August.

string

The name of the event being queried by the API. Each eventName is related to a specific Google Workspace service or feature which the API organizes into types of events. An example is the Google Calendar events in the Admin console application's reports. The Calendar Settings type structure has all of the Calendar eventName activities reported by the API. When an administrator changes a Calendar setting, the API reports this activity in the Calendar Settings type and eventName parameters. For more information about eventName query strings and parameters, see the list of event names for various applications above in applicationName.

string

The filters query string is a comma-separated list composed of event parameters manipulated by relational operators. Event parameters are in the form {parameter1 name}{relational operator}{parameter1 value},{parameter2 name}{relational operator}{parameter2 value},...

These event parameters are associated with a specific eventName. An empty report is returned if the request's parameter doesn't belong to the eventName. For more information about the available eventName fields for each application and their associated parameters, go to the ApplicationName table, then click through to the Activity Events page in the Appendix for the application you want.

In the following Drive activity examples, the returned list consists of all edit events where the doc_id parameter value matches the conditions defined by the relational operator. In the first example, the request returns all edited documents with a doc_id value equal to 12345. In the second example, the report returns any edited documents where the doc_id value is not equal to 98765. The <> operator is URL-encoded in the request's query string (%3C%3E):

GET...&eventName=edit&filters=doc_id==12345
GET...&eventName=edit&filters=doc_id%3C%3E98765

A filters query supports these relational operators:

• ==—'equal to'.
• <>—'not equal to'. Must be URL-encoded (%3C%3E).
• <—'less than'. Must be URL-encoded (%3C).
• <=—'less than or equal to'. Must be URL-encoded (%3C=).
• >—'greater than'. Must be URL-encoded (%3E).
• >=—'greater than or equal to'. Must be URL-encoded (%3E=).

Note: The API doesn't accept multiple values of the same parameter. If a parameter is supplied more than once in the API request, the API only accepts the last value of that parameter. In addition, if an invalid parameter is supplied in the API request, the API ignores that parameter and returns the response corresponding to the remaining valid parameters. If no parameters are requested, all parameters are returned.

integer

Determines how many activity records are shown on each response page. For example, if the request sets maxResults=1 and the report has two activities, the report has two pages. The response's nextPageToken property has the token to the second page. The maxResults query string is optional in the request. The default value is 1000.

string

ID of the organizational unit to report on. Activity records will be shown only for users who belong to the specified organizational unit.

string

The token to specify next page. A report with multiple pages has a nextPageToken property in the response. In your follow-on request getting the next page of the report, enter the nextPageToken value in the pageToken query string.

string

Sets the beginning of the range of time shown in the report. The date is in the RFC 3339 format, for example 2010-10-28T10:26:35.000Z. The report returns all activities from startTime until endTime. The startTime must be before the endTime (if specified) and the current time when the request is made, or the API returns an error.

string

Comma separated group ids (obfuscated) on which user activities are filtered, i.e. the response will contain activities for only those users that are a part of at least one of the group ids mentioned here. Format: "id:abc123,id:xyz456"

{
  "kind": string,
  "etag": string,
  "ownerDomain": string,
  "ipAddress": string,
  "events": [
    {
      "type": string,
      "name": string,
      "parameters": [
        {
          "messageValue": {
            "parameter": [
              {
                object (NestedParameter)
              }
            ]
          },
          "name": string,
          "value": string,
          "multiValue": [
            string
          ],
          "intValue": string,
          "multiIntValue": [
            string
          ],
          "boolValue": boolean,
          "multiMessageValue": [
            {
              "parameter": [
                {
                  object (NestedParameter)
                }
              ]
            }
          ]
        }
      ]
    }
  ],
  "id": {
    "time": string,
    "uniqueQualifier": string,
    "applicationName": string,
    "customerId": string
  },
  "actor": {
    "profileId": string,
    "email": string,
    "callerType": string,
    "key": string
  }
}

string

The type of API resource. For an activity report, the value is audit#activity.

string

ETag of the entry.

string

This is the domain that is affected by the report's event. For example domain of Admin console or the Drive application's document owner.

string

IP address of the user doing the action. This is the Internet Protocol (IP) address of the user when logging into Google Workspace, which may or may not reflect the user's physical location. For example, the IP address can be the user's proxy server's address or a virtual private network (VPN) address. The API supports IPv4 and IPv6.

object

Activity events in the report.

string

Type of event. The Google Workspace service or feature that an administrator changes is identified in the type property which identifies an event using the eventName property. For a full list of the API's type categories, see the list of event names for various applications above in applicationName.

string

Name of the event. This is the specific name of the activity reported by the API. And each eventName is related to a specific Google Workspace service or feature which the API organizes into types of events.
For eventName request parameters in general:

• If no eventName is given, the report returns all possible instances of an eventName.
• When you request an eventName, the API's response returns all activities which contain that eventName.

object

Parameter value pairs for various applications. For more information about eventName parameters, see the list of event names for various applications above in applicationName.

object

Nested parameter value pairs associated with this parameter. Complex value type for a parameter are returned as a list of parameter values. For example, the address parameter may have a value as [{parameter: [{name: city, value: abc}]}]

object (NestedParameter)

Parameter values

string

The name of the parameter.

string

String value of the parameter.

string

String values of the parameter.

string (int64 format)

Integer value of the parameter.

string (int64 format)

Integer values of the parameter.

boolean

Boolean value of the parameter.

object

activities.list of messageValue objects.

object (NestedParameter)

Parameter values

object

Unique identifier for each activity record.

string

Time of occurrence of the activity. This is in UNIX epoch time in seconds.

string (int64 format)

Unique qualifier if multiple events have the same time.

string

Application name to which the event belongs. For possible values see the list of applications above in applicationName.

string

The unique identifier for a Google Workspace account.

object

User doing the action.

string

The unique Google Workspace profile ID of the actor. This value might be absent if the actor is not a Google Workspace user, or may be the number 105250506097979753968 which acts as a placeholder ID.

string

The primary email address of the actor. May be absent if there is no email address associated with the actor.

string

The type of actor.

string

Only present when callerType is KEY. Can be the consumer_key of the requestor for OAuth 2LO API requests or an identifier for robot accounts.