Admin Audit Activity Events - User Settings

This document lists the events and parameters for User Settings Admin Audit activity events. You can retrieve these events by calling Activities.list() with applicationName=admin.

User Settings

Events of this type are returned with type=USER_SETTINGS.

2-step Verification Scratch Codes Deletion

Event details
Event name	DELETE_2SV_SCRATCH_CODES
Parameters	USER_EMAIL string The user's primary email address.
Sample request	GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/admin?eventName=DELETE_2SV_SCRATCH_CODES&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format	2-step verification scratch codes of the user {USER_EMAIL} deleted

2-step Verification Scratch Codes Generate

Event details
Event name	GENERATE_2SV_SCRATCH_CODES
Parameters	USER_EMAIL string The user's primary email address.
Sample request	GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/admin?eventName=GENERATE_2SV_SCRATCH_CODES&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format	New 2-step verification scratch codes generated for the user {USER_EMAIL}

3-legged OAuth Device Tokens Revoke

Event details
Event name	REVOKE_3LO_DEVICE_TOKENS
Parameters	DEVICE_ID string The device's ID. DEVICE_TYPE string The device's type. USER_EMAIL string The user's primary email address.
Sample request	GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/admin?eventName=REVOKE_3LO_DEVICE_TOKENS&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format	3-legged OAuth tokens issued by user {USER_EMAIL} for the device type {DEVICE_TYPE} and id {DEVICE_ID} were revoked

3-legged OAuth Token Revoke

Event details
Event name	REVOKE_3LO_TOKEN
Parameters	APP_ID string The application ID whose access is managed by the token. USER_EMAIL string The user's primary email address.
Sample request	GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/admin?eventName=REVOKE_3LO_TOKEN&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format	3-legged OAuth tokens issued by user {USER_EMAIL} for application {APP_ID} were revoked

Accept User Invite

Event details
Event name	ACCEPT_USER_INVITATION
Parameters	USER_EMAIL string The user's primary email address.
Sample request	GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/admin?eventName=ACCEPT_USER_INVITATION&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format	User invitation accepted for user: {USER_EMAIL}

Add Recovery Email

Event details
Event name	ADD_RECOVERY_EMAIL
Parameters	USER_EMAIL string The user's primary email address.
Sample request	GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/admin?eventName=ADD_RECOVERY_EMAIL&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format	Recovery email added for {USER_EMAIL}

Add Recovery Phone

Event details
Event name	ADD_RECOVERY_PHONE
Parameters	USER_EMAIL string The user's primary email address.
Sample request	GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/admin?eventName=ADD_RECOVERY_PHONE&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format	Recovery phone added for {USER_EMAIL}

Admin Privileges Grant

Event details
Event name	GRANT_ADMIN_PRIVILEGE
Parameters	USER_EMAIL string The user's primary email address.
Sample request	GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/admin?eventName=GRANT_ADMIN_PRIVILEGE&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format	Admin privileges granted to {USER_EMAIL}

Admin Privileges Revoke

Event details
Event name	REVOKE_ADMIN_PRIVILEGE
Parameters	USER_EMAIL string The user's primary email address.
Sample request	GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/admin?eventName=REVOKE_ADMIN_PRIVILEGE&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format	Admin privileges revoked from {USER_EMAIL}

Application Specific Password Revoke

Event details
Event name	REVOKE_ASP
Parameters	ASP_ID string The application specific password ID. USER_EMAIL string The user's primary email address.
Sample request	GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/admin?eventName=REVOKE_ASP&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format	Application specific password with Id {ASP_ID} issued by user {USER_EMAIL} revoked

Automatic Contact Share Change

Event details
Event name	TOGGLE_AUTOMATIC_CONTACT_SHARING
Parameters	NEW_VALUE string The setting value, either true or false. USER_EMAIL string The user's primary email address.
Sample request	GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/admin?eventName=TOGGLE_AUTOMATIC_CONTACT_SHARING&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format	Automatic contact sharing for {USER_EMAIL} changed to {NEW_VALUE}

Bulk Upload

Event details
Event name	BULK_UPLOAD
Parameters	BULK_UPLOAD_FAIL_USERS_NUMBER string The number of users who did not successfully upload to the domain. BULK_UPLOAD_TOTAL_USERS_NUMBER string The number of total users being uploaded. DOMAIN_NAME string The primary domain name where users are being moved.
Sample request	GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/admin?eventName=BULK_UPLOAD&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format	{BULK_UPLOAD_TOTAL_USERS_NUMBER} users selected for upload to your organization. {BULK_UPLOAD_FAIL_USERS_NUMBER} out of {BULK_UPLOAD_TOTAL_USERS_NUMBER} users were not uploaded.

Bulk Upload Notification

Event details
Event name	BULK_UPLOAD_NOTIFICATION_SENT
Parameters	DOMAIN_NAME string The primary domain name where users were uploaded. USER_EMAIL string The primary email address of user who was sent notification of bulk upload event.
Sample request	GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/admin?eventName=BULK_UPLOAD_NOTIFICATION_SENT&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format	Notification of bulk users upload sent to {USER_EMAIL}

Cancel User Invite

Event details
Event name	CANCEL_USER_INVITE
Parameters	DOMAIN_NAME string The primary domain name. USER_EMAIL string The primary email address of the user whose invitation is being cancelled.
Sample request	GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/admin?eventName=CANCEL_USER_INVITE&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format	Invite to {USER_EMAIL} cancelled

Change Custom Attribute

Event details
Event name	CHANGE_USER_CUSTOM_FIELD
Parameters	NEW_VALUE string The new SETTING_NAME value that was set during this event. OLD_VALUE string The previous SETTING_NAME value that was replaced during this event. USER_CUSTOM_FIELD string The name of the user's custom field. USER_EMAIL string The user's primary email address.
Sample request	GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/admin?eventName=CHANGE_USER_CUSTOM_FIELD&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format	{USER_CUSTOM_FIELD} changed for {USER_EMAIL} from {OLD_VALUE} to {NEW_VALUE}

Change External Id

Event details
Event name	CHANGE_USER_EXTERNAL_ID
Parameters	NEW_VALUE string The new SETTING_NAME value that was set during this event. OLD_VALUE string The previous SETTING_NAME value that was replaced during this event. USER_EMAIL string The user's primary email address.
Sample request	GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/admin?eventName=CHANGE_USER_EXTERNAL_ID&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format	External Ids changed for {USER_EMAIL} from {OLD_VALUE} to {NEW_VALUE}

Change Gender

Change here is a verb. The genders will be customizable, so this should be broader than male vs female.

Event details
Event name	CHANGE_USER_GENDER
Parameters	NEW_VALUE string The new SETTING_NAME value that was set during this event. OLD_VALUE string The previous SETTING_NAME value that was replaced during this event. USER_EMAIL string The user's primary email address.
Sample request	GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/admin?eventName=CHANGE_USER_GENDER&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format	Gender changed for {USER_EMAIL} from {OLD_VALUE} to {NEW_VALUE}

Change IM

Event details
Event name	CHANGE_USER_IM
Parameters	NEW_VALUE string The new SETTING_NAME value that was set during this event. OLD_VALUE string The previous SETTING_NAME value that was replaced during this event. USER_EMAIL string The user's primary email address.
Sample request	GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/admin?eventName=CHANGE_USER_IM&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format	IMs changed for {USER_EMAIL} from {OLD_VALUE} to {NEW_VALUE}

Change IP Whitelist

Event details
Event name	ENABLE_USER_IP_WHITELIST
Parameters	NEW_VALUE string The new SETTING_NAME value that was set during this event. OLD_VALUE string The previous SETTING_NAME value that was replaced during this event. USER_EMAIL string The user's primary email address.
Sample request	GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/admin?eventName=ENABLE_USER_IP_WHITELIST&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format	IP whitelist changed for {USER_EMAIL} from {OLD_VALUE} to {NEW_VALUE}

Change Keyword

Keywords are used on user profiles to help identify a user in searches. Example: find person with name 'Larry' and school 'Stanford'. 'Change' is a verb.

Event details
Event name	CHANGE_USER_KEYWORD
Parameters	NEW_VALUE string The new SETTING_NAME value that was set during this event. OLD_VALUE string The previous SETTING_NAME value that was replaced during this event. USER_EMAIL string The user's primary email address.
Sample request	GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/admin?eventName=CHANGE_USER_KEYWORD&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format	Keywords changed for {USER_EMAIL} from {OLD_VALUE} to {NEW_VALUE}

Change Language

Can be a predefined set of more common languages provided by Google or a custom language. 'Change' here is a verb.

Event details
Event name	CHANGE_USER_LANGUAGE
Parameters	NEW_VALUE string The new SETTING_NAME value that was set during this event. OLD_VALUE string The previous SETTING_NAME value that was replaced during this event. USER_EMAIL string The user's primary email address.
Sample request	GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/admin?eventName=CHANGE_USER_LANGUAGE&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format	Languages changed for {USER_EMAIL} from {OLD_VALUE} to {NEW_VALUE}

Change Location

Location is different from address in the following ways: (1) Location can be fuzzy. Example: Near Seattle. (2) Hovercards and other short user summaries display location, not address. 'Change' is a verb.

Event details
Event name	CHANGE_USER_LOCATION
Parameters	NEW_VALUE string The new SETTING_NAME value that was set during this event. OLD_VALUE string The previous SETTING_NAME value that was replaced during this event. USER_EMAIL string The user's primary email address.
Sample request	GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/admin?eventName=CHANGE_USER_LOCATION&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format	Locations changed for {USER_EMAIL} from {OLD_VALUE} to {NEW_VALUE}

Change Organization

Event details
Event name	CHANGE_USER_ORGANIZATION
Parameters	NEW_VALUE string The new SETTING_NAME value that was set during this event. OLD_VALUE string The previous SETTING_NAME value that was replaced during this event. USER_EMAIL string The user's primary email address.
Sample request	GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/admin?eventName=CHANGE_USER_ORGANIZATION&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format	Organizations changed for {USER_EMAIL} from {OLD_VALUE} to {NEW_VALUE}

Change Phone Numbers

Event details
Event name	CHANGE_USER_PHONE_NUMBER
Parameters	NEW_VALUE string The new SETTING_NAME value that was set during this event. OLD_VALUE string The previous SETTING_NAME value that was replaced during this event. USER_EMAIL string The user's primary email address.
Sample request	GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/admin?eventName=CHANGE_USER_PHONE_NUMBER&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format	Phone Numbers changed for {USER_EMAIL} from {OLD_VALUE} to {NEW_VALUE}

Change Recovery Email

Event details
Event name	CHANGE_RECOVERY_EMAIL
Parameters	USER_EMAIL string The user's primary email address.
Sample request	GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/admin?eventName=CHANGE_RECOVERY_EMAIL&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format	Recovery email changed for {USER_EMAIL}

Change Recovery Phone

Event details
Event name	CHANGE_RECOVERY_PHONE
Parameters	USER_EMAIL string The user's primary email address.
Sample request	GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/admin?eventName=CHANGE_RECOVERY_PHONE&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format	Recovery phone changed for {USER_EMAIL}

Change Relation

Event details
Event name	CHANGE_USER_RELATION
Parameters	NEW_VALUE string The new SETTING_NAME value that was set during this event. OLD_VALUE string The previous SETTING_NAME value that was replaced during this event. USER_EMAIL string The user's primary email address.
Sample request	GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/admin?eventName=CHANGE_USER_RELATION&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format	Relations changed for {USER_EMAIL} from {OLD_VALUE} to {NEW_VALUE}

Change User Address

Event details
Event name	CHANGE_USER_ADDRESS
Parameters	NEW_VALUE string The new SETTING_NAME value that was set during this event. OLD_VALUE string The previous SETTING_NAME value that was replaced during this event. USER_EMAIL string The user's primary email address.
Sample request	GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/admin?eventName=CHANGE_USER_ADDRESS&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format	Addresses changed for {USER_EMAIL} from {OLD_VALUE} to {NEW_VALUE}

Create an email monitor

Event details
Event name	CREATE_EMAIL_MONITOR
Parameters	BEGIN_DATE_TIME string The start date and time for the email monitor. EMAIL_MONITOR_DEST_EMAIL string The destination address of the email monitor. EMAIL_MONITOR_LEVEL_CHAT string The chat email monitor level. EMAIL_MONITOR_LEVEL_DRAFT_EMAIL string The draft email monitor level. EMAIL_MONITOR_LEVEL_INCOMING_EMAIL string The incoming email monitor level. EMAIL_MONITOR_LEVEL_OUTGOING_EMAIL string The outgoing email monitor level. END_DATE_TIME string The end date and time for the email monitor. USER_EMAIL string The user's primary email address.
Sample request	GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/admin?eventName=CREATE_EMAIL_MONITOR&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format	Created an email monitor for {USER_EMAIL} to {EMAIL_MONITOR_DEST_EMAIL} that will expire on {END_DATE_TIME}

Data transfer request created

Event details
Event name	CREATE_DATA_TRANSFER_REQUEST
Parameters	APPLICATION_NAME string A comma-separated application names for which data transfer is requested. DESTINATION_USER_EMAIL string The new owner's primary user email to whom to transfer user data to. USER_EMAIL string The user's primary email address.
Sample request	GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/admin?eventName=CREATE_DATA_TRANSFER_REQUEST&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format	Data transfer request created from {USER_EMAIL} to {DESTINATION_USER_EMAIL} for apps {APPLICATION_NAME}

Delegated Admin Privileges Grant

Event details
Event name	GRANT_DELEGATED_ADMIN_PRIVILEGES
Parameters	NEW_VALUE string The new delegated admin privilege. USER_EMAIL string The user's primary email address.
Sample request	GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/admin?eventName=GRANT_DELEGATED_ADMIN_PRIVILEGES&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format	{USER_EMAIL} assigned {NEW_VALUE} admin privileges

Delete account information dump

Event details
Event name	DELETE_ACCOUNT_INFO_DUMP
Parameters	REQUEST_ID string The request ID. USER_EMAIL string The user's primary email address.
Sample request	GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/admin?eventName=DELETE_ACCOUNT_INFO_DUMP&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format	Deleted account and login information dump for {USER_EMAIL} and request ID {REQUEST_ID}

Delete an email monitor

Event details
Event name	DELETE_EMAIL_MONITOR
Parameters	EMAIL_MONITOR_DEST_EMAIL string The destination address of the email monitor. USER_EMAIL string The user's primary email address.
Sample request	GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/admin?eventName=DELETE_EMAIL_MONITOR&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format	Deleted an email monitor for {USER_EMAIL} to {EMAIL_MONITOR_DEST_EMAIL}

Delete mailbox dump

Event details
Event name	DELETE_MAILBOX_DUMP
Parameters	REQUEST_ID string The request ID. USER_EMAIL string The user's primary email address.
Sample request	GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/admin?eventName=DELETE_MAILBOX_DUMP&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format	Deleted mailbox dump for {USER_EMAIL} and request ID {REQUEST_ID}

Delete Profile Photo

Event details
Event name	DELETE_PROFILE_PHOTO
Parameters	USER_EMAIL string The user's primary email address.
Sample request	GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/admin?eventName=DELETE_PROFILE_PHOTO&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format	Profile photo of {USER_EMAIL} has been deleted

Display Name Added

Event details
Event name	ADD_DISPLAY_NAME
Parameters	USER_DISPLAY_NAME string User display name. USER_EMAIL string The user's primary email address.
Sample request	GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/admin?eventName=ADD_DISPLAY_NAME&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format	{USER_DISPLAY_NAME} added as a display name of {USER_EMAIL}

Display Name Change

Event details
Event name	CHANGE_DISPLAY_NAME
Parameters	NEW_VALUE string The new SETTING_NAME value that was set during this event. OLD_VALUE string The previous SETTING_NAME value that was replaced during this event. USER_EMAIL string The user's primary email address.
Sample request	GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/admin?eventName=CHANGE_DISPLAY_NAME&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format	Display name of {USER_EMAIL} changed from {OLD_VALUE} to {NEW_VALUE}

Display Name Removed

Event details
Event name	REMOVE_DISPLAY_NAME
Parameters	USER_DISPLAY_NAME string User display name. USER_EMAIL string The user's primary email address.
Sample request	GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/admin?eventName=REMOVE_DISPLAY_NAME&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format	{USER_DISPLAY_NAME} removed as a display name of {USER_EMAIL}

First Name Change

Event details
Event name	CHANGE_FIRST_NAME
Parameters	NEW_VALUE string The user's new first name. OLD_VALUE string The user's previous first name. USER_EMAIL string The user's primary email address.
Sample request	GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/admin?eventName=CHANGE_FIRST_NAME&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format	First name of {USER_EMAIL} changed from {OLD_VALUE} to {NEW_VALUE}

Gmail Account Reset

Event details
Event name	GMAIL_RESET_USER
Parameters	GMAIL_RESET_REASON string Gmail's reason for resetting the account. USER_EMAIL string The user's primary email address.
Sample request	GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/admin?eventName=GMAIL_RESET_USER&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format	Gmail account of {USER_EMAIL} reset

Last Name Change

Event details
Event name	CHANGE_LAST_NAME
Parameters	NEW_VALUE string The user's new last name. OLD_VALUE string The user's previous last name. USER_EMAIL string The user's primary email address.
Sample request	GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/admin?eventName=CHANGE_LAST_NAME&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format	Last name of {USER_EMAIL} changed from {OLD_VALUE} to {NEW_VALUE}

Mail Routing Destination Creation

Event details
Event name	MAIL_ROUTING_DESTINATION_ADDED
Parameters	NEW_VALUE string The new routing destination. USER_EMAIL string The user's primary email address.
Sample request	GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/admin?eventName=MAIL_ROUTING_DESTINATION_ADDED&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format	User {USER_EMAIL} has received the following individual mail routing destination: {NEW_VALUE}

Mail Routing Destination Deletion

Event details
Event name	MAIL_ROUTING_DESTINATION_REMOVED
Parameters	OLD_VALUE string The previous routing destination. USER_EMAIL string The user's primary email address.
Sample request	GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/admin?eventName=MAIL_ROUTING_DESTINATION_REMOVED&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format	User {USER_EMAIL} has had the following individual mail routing destination removed: {OLD_VALUE}

Nickname Creation

Event details
Event name	ADD_NICKNAME
Parameters	USER_EMAIL string The primary user email. USER_NICKNAME string The user's nickname. For Admin console information, see the administration help center.
Sample request	GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/admin?eventName=ADD_NICKNAME&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format	{USER_NICKNAME} created as a nickname of {USER_EMAIL}

Nickname Deletion

Event details
Event name	REMOVE_NICKNAME
Parameters	USER_EMAIL string The user's primary email address. USER_NICKNAME string The user's previous nickname.
Sample request	GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/admin?eventName=REMOVE_NICKNAME&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format	{USER_NICKNAME} deleted as a nickname of {USER_EMAIL}

Passkey revoked

Event details
Event name	PASSKEY_REVOKED
Parameters	enrollment_type string Describers whether the passkey was enrolled by user or created automatically. Possible values: automatically_created Passkey enrolled automatically on android device. user_created Passkey enrolled by end user. passkey_added_from string Location from where the passkey was added. passkey_added_on_timestamp integer Timestamp when the passkey was added. passkey_last_used_from string Location from where was the passkey last used. passkey_last_used_timestamp integer Timestamp when the passkey was last used. platform_or_device string Platform or device used for creating the passkey. Possible values: apple_icloud_keychain Passkey created using apple icloud keychain. bitwarden Passkey created using bitwarden. chrome_on_mac Passkey created using chrome on mac. chrome_os Passkey created using chrome os. dashlane Passkey created using dashlane. edge_on_mac Passkey created using Edge on Mac. generic_passkey Passkey type generic passkey description. generic_usb_key Passkey created using FIDO2 security key. generic_usb_up_key Passkey created using security key. google_account_passkey_on_android Passkey created using android device. google_password_manager Passkey created using google password manager. keeper Passkey created using keeper. nordpass Passkey created using nordpass. one_password Passkey created using 1Password. samsung_pass Passkey created using Samsung pass. titan_key Passkey created using titan security key. windows_hello Passkey created using windows hello. yubikey Passkey created using yubico security key. supports_passwordless boolean Whether the passkey can be used to skip password. USER_EMAIL string The user's primary email address.
Sample request	GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/admin?eventName=PASSKEY_REVOKED&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format	A passkey enrolled for user {USER_EMAIL} was revoked

Password Change

Event details
Event name	CHANGE_PASSWORD
Parameters	USER_EMAIL string The user's primary email address.
Sample request	GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/admin?eventName=CHANGE_PASSWORD&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format	Password changed for {USER_EMAIL}

Password Change on Next Login

Event details
Event name	CHANGE_PASSWORD_ON_NEXT_LOGIN
Parameters	NEW_VALUE string Indicates whether the user must change their password on their next login; can be true or false. OLD_VALUE string The previous setting value; can be true or false. USER_EMAIL string The user's primary email address.
Sample request	GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/admin?eventName=CHANGE_PASSWORD_ON_NEXT_LOGIN&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format	Password change requirement for {USER_EMAIL} on next login changed from {OLD_VALUE} to {NEW_VALUE}

Pending Invites List Download

Event details
Event name	DOWNLOAD_PENDING_INVITES_LIST
Sample request	GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/admin?eventName=DOWNLOAD_PENDING_INVITES_LIST&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format	Pending Invites List was downloaded as a CSV file

Public Key Certificate Status Updated

Event details
Event name	UPDATE_PUBLIC_KEY_CERTIFICATE_STATUS
Parameters	PUBLIC_KEY_CERTIFICATE_STATUS string Public key certificate status. USER_EMAIL string The user's primary email address. USER_IMPACTED_EMAIL string User impacted email.
Sample request	GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/admin?eventName=UPDATE_PUBLIC_KEY_CERTIFICATE_STATUS&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format	Public key certificate status updated to {PUBLIC_KEY_CERTIFICATE_STATUS} for email {USER_IMPACTED_EMAIL} of user {USER_EMAIL}

Public Key Certificate Updated

Event details
Event name	UPDATE_PUBLIC_KEY_CERTIFICATE
Parameters	USER_EMAIL string The user's primary email address. USER_IMPACTED_EMAIL string User impacted email.
Sample request	GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/admin?eventName=UPDATE_PUBLIC_KEY_CERTIFICATE&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format	Public key certificate updated for {USER_DISPLAY_NAME} email {USER_EMAIL}

Remove Recovery Email

Event details
Event name	REMOVE_RECOVERY_EMAIL
Parameters	USER_EMAIL string The user's primary email address.
Sample request	GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/admin?eventName=REMOVE_RECOVERY_EMAIL&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format	Recovery email removed for {USER_EMAIL}

Remove Recovery Phone

Event details
Event name	REMOVE_RECOVERY_PHONE
Parameters	USER_EMAIL string The user's primary email address.
Sample request	GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/admin?eventName=REMOVE_RECOVERY_PHONE&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format	Recovery phone removed for {USER_EMAIL}

Request account information

Event details
Event name	REQUEST_ACCOUNT_INFO
Parameters	USER_EMAIL string The user's primary email address.
Sample request	GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/admin?eventName=REQUEST_ACCOUNT_INFO&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format	Requested account and login information for {USER_EMAIL}

Request mailbox dump

Event details
Event name	REQUEST_MAILBOX_DUMP
Parameters	BEGIN_DATE_TIME string The start date and time for the email monitor. EMAIL_EXPORT_INCLUDE_DELETED string Indicates if deleted emails are included in the export. EMAIL_EXPORT_PACKAGE_CONTENT string The contents of the mailbox package. END_DATE_TIME string The end date and time for the email monitor. SEARCH_QUERY_FOR_DUMP string The search query used for the dump. USER_EMAIL string The user's primary email address.
Sample request	GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/admin?eventName=REQUEST_MAILBOX_DUMP&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format	Requested mailbox dump for {USER_EMAIL}

Resend User Invite

Event details
Event name	RESEND_USER_INVITE
Parameters	DOMAIN_NAME string The primary domain name. USER_EMAIL string The user's primary email address.
Sample request	GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/admin?eventName=RESEND_USER_INVITE&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format	Invite email to {USER_EMAIL} resent

Reset Cookies and Forced Relogin

Event details
Event name	RESET_SIGNIN_COOKIES
Parameters	USER_EMAIL string The user's primary email address.
Sample request	GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/admin?eventName=RESET_SIGNIN_COOKIES&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format	Cookies reset for {USER_EMAIL} and forced re-login

Security Key Registered For User

Event details
Event name	SECURITY_KEY_REGISTERED_FOR_USER
Parameters	USER_EMAIL string The user's primary email address.
Sample request	GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/admin?eventName=SECURITY_KEY_REGISTERED_FOR_USER&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format	Security key registered for {USER_EMAIL}

Security Key Revoke

Event details
Event name	REVOKE_SECURITY_KEY
Parameters	enrollment_type string Describers whether the passkey was enrolled by user or created automatically. Possible values: automatically_created Passkey enrolled automatically on android device. user_created Passkey enrolled by end user. passkey_added_from string Location from where the passkey was added. passkey_added_on_timestamp integer Timestamp when the passkey was added. passkey_last_used_from string Location from where was the passkey last used. passkey_last_used_timestamp integer Timestamp when the passkey was last used. platform_or_device string Platform or device used for creating the passkey. Possible values: apple_icloud_keychain Passkey created using apple icloud keychain. bitwarden Passkey created using bitwarden. chrome_on_mac Passkey created using chrome on mac. chrome_os Passkey created using chrome os. dashlane Passkey created using dashlane. edge_on_mac Passkey created using Edge on Mac. generic_passkey Passkey type generic passkey description. generic_usb_key Passkey created using FIDO2 security key. generic_usb_up_key Passkey created using security key. google_account_passkey_on_android Passkey created using android device. google_password_manager Passkey created using google password manager. keeper Passkey created using keeper. nordpass Passkey created using nordpass. one_password Passkey created using 1Password. samsung_pass Passkey created using Samsung pass. titan_key Passkey created using titan security key. windows_hello Passkey created using windows hello. yubikey Passkey created using yubico security key. supports_passwordless boolean Whether the passkey can be used to skip password. USER_EMAIL string The user's primary email address.
Sample request	GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/admin?eventName=REVOKE_SECURITY_KEY&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format	A security key enrolled for user {USER_EMAIL} for 2-step verification was revoked

Send User Invite

Event details
Event name	USER_INVITE
Parameters	DOMAIN_NAME string The primary domain name. USER_EMAIL string The user's primary email address.
Sample request	GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/admin?eventName=USER_INVITE&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format	{USER_EMAIL} invited to join your organization

Temporary Password Viewed

Event details
Event name	VIEW_TEMP_PASSWORD
Parameters	DOMAIN_NAME string The primary domain name. USER_EMAIL string The user's primary email address.
Sample request	GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/admin?eventName=VIEW_TEMP_PASSWORD&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format	Temporary password for user {USER_EMAIL} viewed by the admin

Turn off 2-step verification

Event details
Event name	TURN_OFF_2_STEP_VERIFICATION
Parameters	USER_EMAIL string The user's primary email address.
Sample request	GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/admin?eventName=TURN_OFF_2_STEP_VERIFICATION&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format	2-step verification has been turned off for the user {USER_EMAIL}

Unblock User Session

Event details
Event name	UNBLOCK_USER_SESSION
Parameters	USER_EMAIL string The user's primary email address.
Sample request	GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/admin?eventName=UNBLOCK_USER_SESSION&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format	User {USER_EMAIL} unblocked by temporarily disabling login challenge

Unmanaged Users Bulk Upload

Event details
Event name	UNMANAGED_USERS_BULK_UPLOAD
Parameters	BULK_UPLOAD_FAIL_USERS_NUMBER string Bulk Upload Failed Users Number. BULK_UPLOAD_TOTAL_USERS_NUMBER string Bulk Upload Total Users Number.
Sample request	GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/admin?eventName=UNMANAGED_USERS_BULK_UPLOAD&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format	A total of {BULK_UPLOAD_TOTAL_USERS_NUMBER} unmanaged users selected for upload. {BULK_UPLOAD_FAIL_USERS_NUMBER} out of {BULK_UPLOAD_TOTAL_USERS_NUMBER} users failed to be uploaded.

Unmanaged Users List Download

Event details
Event name	DOWNLOAD_UNMANAGED_USERS_LIST
Sample request	GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/admin?eventName=DOWNLOAD_UNMANAGED_USERS_LIST&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format	Unmanaged Users list was downloaded as a CSV file

Update Profile Photo

Event details
Event name	UPDATE_PROFILE_PHOTO
Parameters	USER_EMAIL string The user's primary email address.
Sample request	GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/admin?eventName=UPDATE_PROFILE_PHOTO&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format	Profile photo of {USER_EMAIL} has been updated

User Advanced Protection Unenroll

Event details
Event name	UNENROLL_USER_FROM_TITANIUM
Parameters	USER_EMAIL string The user's primary email address.
Sample request	GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/admin?eventName=UNENROLL_USER_FROM_TITANIUM&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format	User {USER_EMAIL} unenrolled from Advanced Protection

User Archival

Event details
Event name	ARCHIVE_USER
Parameters	USER_EMAIL string The user's primary email address.
Sample request	GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/admin?eventName=ARCHIVE_USER&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format	{USER_EMAIL} archived

User BirthDate Change

Event details
Event name	UPDATE_BIRTHDATE
Parameters	BIRTHDATE string The date of the user's birthday. USER_EMAIL string The user's primary email address.
Sample request	GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/admin?eventName=UPDATE_BIRTHDATE&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format	The birth date for {USER_EMAIL} changed to {BIRTHDATE}

User created passkey revoked

Event details
Event name	USER_CREATED_PASSKEY_REVOKE
Parameters	USER_EMAIL string The user's primary email address.
Sample request	GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/admin?eventName=USER_CREATED_PASSKEY_REVOKE&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format	A user created passkey enrolled for user {USER_EMAIL} was revoked

User Creation

Event details
Event name	CREATE_USER
Parameters	USER_EMAIL string The new user's primary user email.
Sample request	GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/admin?eventName=CREATE_USER&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format	{USER_EMAIL} created

User Deletion

Event details
Event name	DELETE_USER
Parameters	USER_EMAIL string The deleted user's primary user email.
Sample request	GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/admin?eventName=DELETE_USER&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format	{USER_EMAIL} deleted

User Downgrade From Google+

Event details
Event name	DOWNGRADE_USER_FROM_GPLUS
Parameters	USER_EMAIL string The user's primary email address.
Sample request	GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/admin?eventName=DOWNGRADE_USER_FROM_GPLUS&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format	{USER_EMAIL} was downgraded from Google+

User Enrolled In 2-Step Verification

Event details
Event name	USER_ENROLLED_IN_TWO_STEP_VERIFICATION
Parameters	USER_EMAIL string The user's primary email address.
Sample request	GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/admin?eventName=USER_ENROLLED_IN_TWO_STEP_VERIFICATION&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format	{USER_EMAIL} enrolled in 2-step verification

User List Download

Event details
Event name	DOWNLOAD_USERLIST_CSV
Sample request	GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/admin?eventName=DOWNLOAD_USERLIST_CSV&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format	User list was downloaded as a CSV file

User List Download

Event details
Event name	DOWNLOAD_USERLIST
Parameters	FORMAT string Format.
Sample request	GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/admin?eventName=DOWNLOAD_USERLIST&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format	User list was downloaded in {FORMAT}

User OrgUnit Change

Event details
Event name	MOVE_USER_TO_ORG_UNIT
Parameters	NEW_VALUE string The user's new organizational unit. ORG_UNIT_NAME string The organizational unit (OU) name (path). USER_EMAIL string The user's primary email address.
Sample request	GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/admin?eventName=MOVE_USER_TO_ORG_UNIT&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format	{USER_EMAIL} moved from {ORG_UNIT_NAME} to {NEW_VALUE}

User Put In 2-Step Verification Grace Period

Event details
Event name	USER_PUT_IN_TWO_STEP_VERIFICATION_GRACE_PERIOD
Parameters	NEW_VALUE string The new SETTING_NAME value that was set during this event. USER_EMAIL string The user's primary email address.
Sample request	GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/admin?eventName=USER_PUT_IN_TWO_STEP_VERIFICATION_GRACE_PERIOD&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format	2-step verification grace period has been enabled on {USER_EMAIL} till {NEW_VALUE}

User Rename

Event details
Event name	RENAME_USER
Parameters	NEW_VALUE string The user's new name. USER_EMAIL string The user's primary email address.
Sample request	GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/admin?eventName=RENAME_USER&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format	{USER_EMAIL} renamed to {NEW_VALUE}

User Strong Auth Unenroll

Event details
Event name	UNENROLL_USER_FROM_STRONG_AUTH
Parameters	USER_EMAIL string The user's primary email address.
Sample request	GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/admin?eventName=UNENROLL_USER_FROM_STRONG_AUTH&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format	User {USER_EMAIL} unenrolled from Strong Auth

User Suspension

Event details
Event name	SUSPEND_USER
Parameters	USER_EMAIL string The user's primary email address.
Sample request	GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/admin?eventName=SUSPEND_USER&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format	{USER_EMAIL} suspended

User Unarchival

Event details
Event name	UNARCHIVE_USER
Parameters	USER_EMAIL string The user's primary email address.
Sample request	GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/admin?eventName=UNARCHIVE_USER&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format	{USER_EMAIL} unarchived

User Undeletion

Event details
Event name	UNDELETE_USER
Parameters	USER_EMAIL string The user's primary email address.
Sample request	GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/admin?eventName=UNDELETE_USER&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format	{USER_EMAIL} undeleted

User Unsuspension

Event details
Event name	UNSUSPEND_USER
Parameters	USER_EMAIL string The user's primary email address.
Sample request	GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/admin?eventName=UNSUSPEND_USER&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format	{USER_EMAIL} unsuspended

User Upgrade To Google+

Event details
Event name	UPGRADE_USER_TO_GPLUS
Parameters	USER_EMAIL string The user's primary email address.
Sample request	GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/admin?eventName=UPGRADE_USER_TO_GPLUS&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format	{USER_EMAIL} was upgraded to Google+

Users Bulk Upload

Event details
Event name	USERS_BULK_UPLOAD
Parameters	BULK_UPLOAD_FAIL_USERS_NUMBER string The number of failures when attemping to bulk upload users. BULK_UPLOAD_TOTAL_USERS_NUMBER string The total number of bulk uploaded users.
Sample request	GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/admin?eventName=USERS_BULK_UPLOAD&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format	A total of {BULK_UPLOAD_TOTAL_USERS_NUMBER} users selected for upload. {BULK_UPLOAD_FAIL_USERS_NUMBER} out of {BULK_UPLOAD_TOTAL_USERS_NUMBER} users failed to be uploaded.

Users Bulk Upload Notification

Event details
Event name	USERS_BULK_UPLOAD_NOTIFICATION_SENT
Parameters	USER_EMAIL string The user's primary email address.
Sample request	GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/admin?eventName=USERS_BULK_UPLOAD_NOTIFICATION_SENT&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format	Notification of bulk users upload sent to {USER_EMAIL}