Vault Audit Activity Events

This document lists the events and parameters for various types of Vault Audit activity events. You can retrieve these events by calling Activities.list() with applicationName=vault.

Event Type: User Action

User Action Event Type. Events of this type are returned with type=user_action.

Add Collaborator Begin

The name of the Vault event: Add Collaborator Begin.

Event details
Event name add_collaborator_begin
Parameters
additional_details

string

Additional details pertaining to an audit log.

matter_id

string

The Matter ID an audit pertains to.

organizational_unit_name

string

The organizational unit name.

query

string

The user inputted query for search and exports.

resource_name

string

The resource name of the action, such as hold name or saved query name.

resource_url

string

The document URL of the document view.

target_user

string

The targeted user (such as user put on hold).

Sample request
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/vault?eventName=add_collaborator_begin&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format
Collaborator addition began

Add Collaborator End

The name of the Vault event: Add Collaborator End.

Event details
Event name add_collaborator_end
Parameters
additional_details

string

Additional details pertaining to an audit log.

matter_id

string

The Matter ID an audit pertains to.

organizational_unit_name

string

The organizational unit name.

query

string

The user inputted query for search and exports.

resource_name

string

The resource name of the action, such as hold name or saved query name.

resource_url

string

The document URL of the document view.

target_user

string

The targeted user (such as user put on hold).

Sample request
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/vault?eventName=add_collaborator_end&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format
Collaborator addition ended

Add Litigation Hold Begin

The name of the Vault event: Add Litigation Hold Begin.

Event details
Event name add_litigation_hold_begin
Parameters
additional_details

string

Additional details pertaining to an audit log.

matter_id

string

The Matter ID an audit pertains to.

organizational_unit_name

string

The organizational unit name.

query

string

The user inputted query for search and exports.

resource_name

string

The resource name of the action, such as hold name or saved query name.

resource_url

string

The document URL of the document view.

target_user

string

The targeted user (such as user put on hold).

Sample request
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/vault?eventName=add_litigation_hold_begin&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format
Litigation hold addition began

Add Litigation Hold End

The name of the Vault event: Add Litigation Hold End.

Event details
Event name add_litigation_hold_end
Parameters
additional_details

string

Additional details pertaining to an audit log.

matter_id

string

The Matter ID an audit pertains to.

organizational_unit_name

string

The organizational unit name.

query

string

The user inputted query for search and exports.

resource_name

string

The resource name of the action, such as hold name or saved query name.

resource_url

string

The document URL of the document view.

target_user

string

The targeted user (such as user put on hold).

Sample request
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/vault?eventName=add_litigation_hold_end&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format
Litigation hold addition ended

Add Preservation Rule Begin

The name of the Vault event: Add Preservation Rule Begin.

Event details
Event name add_preservation_rule_begin
Parameters
additional_details

string

Additional details pertaining to an audit log.

matter_id

string

The Matter ID an audit pertains to.

organizational_unit_name

string

The organizational unit name.

query

string

The user inputted query for search and exports.

resource_name

string

The resource name of the action, such as hold name or saved query name.

resource_url

string

The document URL of the document view.

target_user

string

The targeted user (such as user put on hold).

Sample request
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/vault?eventName=add_preservation_rule_begin&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format
Preservation rule addition began

Add Preservation Rule End

The name of the Vault event: Add Preservation Rule End.

Event details
Event name add_preservation_rule_end
Parameters
additional_details

string

Additional details pertaining to an audit log.

matter_id

string

The Matter ID an audit pertains to.

organizational_unit_name

string

The organizational unit name.

query

string

The user inputted query for search and exports.

resource_name

string

The resource name of the action, such as hold name or saved query name.

resource_url

string

The document URL of the document view.

target_user

string

The targeted user (such as user put on hold).

Sample request
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/vault?eventName=add_preservation_rule_end&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format
Preservation rule addition ended

Add Retention Rule Begin

The name of the Vault event: Add Retention Rule Begin.

Event details
Event name add_retention_rule_begin
Parameters
additional_details

string

Additional details pertaining to an audit log.

matter_id

string

The Matter ID an audit pertains to.

organizational_unit_name

string

The organizational unit name.

query

string

The user inputted query for search and exports.

resource_name

string

The resource name of the action, such as hold name or saved query name.

resource_url

string

The document URL of the document view.

target_user

string

The targeted user (such as user put on hold).

Sample request
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/vault?eventName=add_retention_rule_begin&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format
Retention rule addition began

Add Retention Rule End

The name of the Vault event: Add Retention Rule End.

Event details
Event name add_retention_rule_end
Parameters
additional_details

string

Additional details pertaining to an audit log.

matter_id

string

The Matter ID an audit pertains to.

organizational_unit_name

string

The organizational unit name.

query

string

The user inputted query for search and exports.

resource_name

string

The resource name of the action, such as hold name or saved query name.

resource_url

string

The document URL of the document view.

target_user

string

The targeted user (such as user put on hold).

Sample request
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/vault?eventName=add_retention_rule_end&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format
Retention rule addition ended

Cancel Accelerated Deletion Begin

The name of the Vault event: Cancel Accelerated Deletion Begin.

Event details
Event name cancel_accelerated_deletion_begin
Parameters
additional_details

string

Additional details pertaining to an audit log.

matter_id

string

The Matter ID an audit pertains to.

organizational_unit_name

string

The organizational unit name.

query

string

The user inputted query for search and exports.

resource_name

string

The resource name of the action, such as hold name or saved query name.

resource_url

string

The document URL of the document view.

target_user

string

The targeted user (such as user put on hold).

Sample request
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/vault?eventName=cancel_accelerated_deletion_begin&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format
Accelerated deletion cancellation began

Cancel Accelerated Deletion End

The name of the Vault event: Cancel Accelerated Deletion End.

Event details
Event name cancel_accelerated_deletion_end
Parameters
additional_details

string

Additional details pertaining to an audit log.

matter_id

string

The Matter ID an audit pertains to.

organizational_unit_name

string

The organizational unit name.

query

string

The user inputted query for search and exports.

resource_name

string

The resource name of the action, such as hold name or saved query name.

resource_url

string

The document URL of the document view.

target_user

string

The targeted user (such as user put on hold).

Sample request
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/vault?eventName=cancel_accelerated_deletion_end&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format
Accelerated deletion cancellation ended

Close Investigation Begin

The name of the Vault event: Close Investigation Begin.

Event details
Event name close_investigation_begin
Parameters
additional_details

string

Additional details pertaining to an audit log.

matter_id

string

The Matter ID an audit pertains to.

organizational_unit_name

string

The organizational unit name.

query

string

The user inputted query for search and exports.

resource_name

string

The resource name of the action, such as hold name or saved query name.

resource_url

string

The document URL of the document view.

target_user

string

The targeted user (such as user put on hold).

Sample request
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/vault?eventName=close_investigation_begin&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format
Investigation closure began

Close Investigation End

The name of the Vault event: Close Investigation End.

Event details
Event name close_investigation_end
Parameters
additional_details

string

Additional details pertaining to an audit log.

matter_id

string

The Matter ID an audit pertains to.

organizational_unit_name

string

The organizational unit name.

query

string

The user inputted query for search and exports.

resource_name

string

The resource name of the action, such as hold name or saved query name.

resource_url

string

The document URL of the document view.

target_user

string

The targeted user (such as user put on hold).

Sample request
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/vault?eventName=close_investigation_end&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format
Investigation closure ended

Convert Saved Query To Collection Begin

The name of the Vault event: Convert Saved Query To Collection Begin.

Event details
Event name convert_saved_query_to_collection_begin
Parameters
additional_details

string

Additional details pertaining to an audit log.

matter_id

string

The Matter ID an audit pertains to.

organizational_unit_name

string

The organizational unit name.

query

string

The user inputted query for search and exports.

resource_name

string

The resource name of the action, such as hold name or saved query name.

resource_url

string

The document URL of the document view.

target_user

string

The targeted user (such as user put on hold).

Sample request
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/vault?eventName=convert_saved_query_to_collection_begin&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format
Saved query to collection conversion began

Convert Saved Query To Collection End

The name of the Vault event: Convert Saved Query To Collection End.

Event details
Event name convert_saved_query_to_collection_end
Parameters
additional_details

string

Additional details pertaining to an audit log.

matter_id

string

The Matter ID an audit pertains to.

organizational_unit_name

string

The organizational unit name.

query

string

The user inputted query for search and exports.

resource_name

string

The resource name of the action, such as hold name or saved query name.

resource_url

string

The document URL of the document view.

target_user

string

The targeted user (such as user put on hold).

Sample request
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/vault?eventName=convert_saved_query_to_collection_end&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format
Saved query to collection conversion ended

Create Accelerated Deletion Begin

The name of the Vault event: Create Accelerated Deletion Begin.

Event details
Event name create_accelerated_deletion_begin
Parameters
additional_details

string

Additional details pertaining to an audit log.

matter_id

string

The Matter ID an audit pertains to.

organizational_unit_name

string

The organizational unit name.

query

string

The user inputted query for search and exports.

resource_name

string

The resource name of the action, such as hold name or saved query name.

resource_url

string

The document URL of the document view.

target_user

string

The targeted user (such as user put on hold).

Sample request
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/vault?eventName=create_accelerated_deletion_begin&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format
Accelerated deletion request creation began

Create Accelerated Deletion End

The name of the Vault event: Create Accelerated Deletion End.

Event details
Event name create_accelerated_deletion_end
Parameters
additional_details

string

Additional details pertaining to an audit log.

matter_id

string

The Matter ID an audit pertains to.

organizational_unit_name

string

The organizational unit name.

query

string

The user inputted query for search and exports.

resource_name

string

The resource name of the action, such as hold name or saved query name.

resource_url

string

The document URL of the document view.

target_user

string

The targeted user (such as user put on hold).

Sample request
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/vault?eventName=create_accelerated_deletion_end&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format
Accelerated deletion request creation ended

Create Export Begin

The name of the Vault event: Create Export Begin.

Event details
Event name create_export_begin
Parameters
additional_details

string

Additional details pertaining to an audit log.

matter_id

string

The Matter ID an audit pertains to.

organizational_unit_name

string

The organizational unit name.

query

string

The user inputted query for search and exports.

resource_name

string

The resource name of the action, such as hold name or saved query name.

resource_url

string

The document URL of the document view.

target_user

string

The targeted user (such as user put on hold).

Sample request
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/vault?eventName=create_export_begin&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format
Export creation began

Create Export End

The name of the Vault event: Create Export End.

Event details
Event name create_export_end
Parameters
additional_details

string

Additional details pertaining to an audit log.

matter_id

string

The Matter ID an audit pertains to.

organizational_unit_name

string

The organizational unit name.

query

string

The user inputted query for search and exports.

resource_name

string

The resource name of the action, such as hold name or saved query name.

resource_url

string

The document URL of the document view.

target_user

string

The targeted user (such as user put on hold).

Sample request
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/vault?eventName=create_export_end&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format
Export creation ended

Create Investigation Begin

The name of the Vault event: Create Investigation Begin.

Event details
Event name create_investigation_begin
Parameters
additional_details

string

Additional details pertaining to an audit log.

matter_id

string

The Matter ID an audit pertains to.

organizational_unit_name

string

The organizational unit name.

query

string

The user inputted query for search and exports.

resource_name

string

The resource name of the action, such as hold name or saved query name.

resource_url

string

The document URL of the document view.

target_user

string

The targeted user (such as user put on hold).

Sample request
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/vault?eventName=create_investigation_begin&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format
Investigation creation began

Create Investigation End

The name of the Vault event: Create Investigation End.

Event details
Event name create_investigation_end
Parameters
additional_details

string

Additional details pertaining to an audit log.

matter_id

string

The Matter ID an audit pertains to.

organizational_unit_name

string

The organizational unit name.

query

string

The user inputted query for search and exports.

resource_name

string

The resource name of the action, such as hold name or saved query name.

resource_url

string

The document URL of the document view.

target_user

string

The targeted user (such as user put on hold).

Sample request
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/vault?eventName=create_investigation_end&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format
Investigation creation ended

Create Saved Query Begin

The name of the Vault event: Create Saved Query Begin.

Event details
Event name create_saved_query_begin
Parameters
additional_details

string

Additional details pertaining to an audit log.

matter_id

string

The Matter ID an audit pertains to.

organizational_unit_name

string

The organizational unit name.

query

string

The user inputted query for search and exports.

resource_name

string

The resource name of the action, such as hold name or saved query name.

resource_url

string

The document URL of the document view.

target_user

string

The targeted user (such as user put on hold).

Sample request
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/vault?eventName=create_saved_query_begin&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format
Saved query creation began

Create Saved Query End

The name of the Vault event: Create Saved Query End.

Event details
Event name create_saved_query_end
Parameters
additional_details

string

Additional details pertaining to an audit log.

matter_id

string

The Matter ID an audit pertains to.

organizational_unit_name

string

The organizational unit name.

query

string

The user inputted query for search and exports.

resource_name

string

The resource name of the action, such as hold name or saved query name.

resource_url

string

The document URL of the document view.

target_user

string

The targeted user (such as user put on hold).

Sample request
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/vault?eventName=create_saved_query_end&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format
Saved query creation ended

Delete Export Begin

The name of the Vault event: Delete Export Begin.

Event details
Event name delete_export_begin
Parameters
additional_details

string

Additional details pertaining to an audit log.

matter_id

string

The Matter ID an audit pertains to.

organizational_unit_name

string

The organizational unit name.

query

string

The user inputted query for search and exports.

resource_name

string

The resource name of the action, such as hold name or saved query name.

resource_url

string

The document URL of the document view.

target_user

string

The targeted user (such as user put on hold).

Sample request
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/vault?eventName=delete_export_begin&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format
Export deletion began

Delete Export End

The name of the Vault event: Delete Export End.

Event details
Event name delete_export_end
Parameters
additional_details

string

Additional details pertaining to an audit log.

matter_id

string

The Matter ID an audit pertains to.

organizational_unit_name

string

The organizational unit name.

query

string

The user inputted query for search and exports.

resource_name

string

The resource name of the action, such as hold name or saved query name.

resource_url

string

The document URL of the document view.

target_user

string

The targeted user (such as user put on hold).

Sample request
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/vault?eventName=delete_export_end&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format
Export deletion ended

Delete Export Fail

The name of the Vault event: Delete Export Fail.

Event details
Event name delete_export_fail
Parameters
additional_details

string

Additional details pertaining to an audit log.

matter_id

string

The Matter ID an audit pertains to.

organizational_unit_name

string

The organizational unit name.

query

string

The user inputted query for search and exports.

resource_name

string

The resource name of the action, such as hold name or saved query name.

resource_url

string

The document URL of the document view.

target_user

string

The targeted user (such as user put on hold).

Sample request
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/vault?eventName=delete_export_fail&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format
Export deletion failed

Delete Investigation Begin

The name of the Vault event: Delete Investigation Begin.

Event details
Event name delete_investigation_begin
Parameters
additional_details

string

Additional details pertaining to an audit log.

matter_id

string

The Matter ID an audit pertains to.

organizational_unit_name

string

The organizational unit name.

query

string

The user inputted query for search and exports.

resource_name

string

The resource name of the action, such as hold name or saved query name.

resource_url

string

The document URL of the document view.

target_user

string

The targeted user (such as user put on hold).

Sample request
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/vault?eventName=delete_investigation_begin&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format
Investigation deletion began

Delete Investigation End

The name of the Vault event: Delete Investigation End.

Event details
Event name delete_investigation_end
Parameters
additional_details

string

Additional details pertaining to an audit log.

matter_id

string

The Matter ID an audit pertains to.

organizational_unit_name

string

The organizational unit name.

query

string

The user inputted query for search and exports.

resource_name

string

The resource name of the action, such as hold name or saved query name.

resource_url

string

The document URL of the document view.

target_user

string

The targeted user (such as user put on hold).

Sample request
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/vault?eventName=delete_investigation_end&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format
Investigation deletion ended

Delete Preservation Rule Begin

The name of the Vault event: Delete Preservation Rule Begin.

Event details
Event name delete_preservation_rule_begin
Parameters
additional_details

string

Additional details pertaining to an audit log.

matter_id

string

The Matter ID an audit pertains to.

organizational_unit_name

string

The organizational unit name.

query

string

The user inputted query for search and exports.

resource_name

string

The resource name of the action, such as hold name or saved query name.

resource_url

string

The document URL of the document view.

target_user

string

The targeted user (such as user put on hold).

Sample request
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/vault?eventName=delete_preservation_rule_begin&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format
Preservation rule deletion began

Delete Preservation Rule End

The name of the Vault event: Delete Preservation Rule End.

Event details
Event name delete_preservation_rule_end
Parameters
additional_details

string

Additional details pertaining to an audit log.

matter_id

string

The Matter ID an audit pertains to.

organizational_unit_name

string

The organizational unit name.

query

string

The user inputted query for search and exports.

resource_name

string

The resource name of the action, such as hold name or saved query name.

resource_url

string

The document URL of the document view.

target_user

string

The targeted user (such as user put on hold).

Sample request
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/vault?eventName=delete_preservation_rule_end&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format
Preservation rule deletion ended

Delete Retention Rule Begin

The name of the Vault event: Delete Retention Rule Begin.

Event details
Event name delete_retention_rule_begin
Parameters
additional_details

string

Additional details pertaining to an audit log.

matter_id

string

The Matter ID an audit pertains to.

organizational_unit_name

string

The organizational unit name.

query

string

The user inputted query for search and exports.

resource_name

string

The resource name of the action, such as hold name or saved query name.

resource_url

string

The document URL of the document view.

target_user

string

The targeted user (such as user put on hold).

Sample request
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/vault?eventName=delete_retention_rule_begin&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format
Retention rule deletion began

Delete Retention Rule End

The name of the Vault event: Delete Retention Rule End.

Event details
Event name delete_retention_rule_end
Parameters
additional_details

string

Additional details pertaining to an audit log.

matter_id

string

The Matter ID an audit pertains to.

organizational_unit_name

string

The organizational unit name.

query

string

The user inputted query for search and exports.

resource_name

string

The resource name of the action, such as hold name or saved query name.

resource_url

string

The document URL of the document view.

target_user

string

The targeted user (such as user put on hold).

Sample request
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/vault?eventName=delete_retention_rule_end&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format
Retention rule deletion ended

Delete Saved Query Begin

The name of the Vault event: Delete Saved Query Begin.

Event details
Event name delete_saved_query_begin
Parameters
additional_details

string

Additional details pertaining to an audit log.

matter_id

string

The Matter ID an audit pertains to.

organizational_unit_name

string

The organizational unit name.

query

string

The user inputted query for search and exports.

resource_name

string

The resource name of the action, such as hold name or saved query name.

resource_url

string

The document URL of the document view.

target_user

string

The targeted user (such as user put on hold).

Sample request
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/vault?eventName=delete_saved_query_begin&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format
Saved query deletion began

Delete Saved Query End

The name of the Vault event: Delete Saved Query End.

Event details
Event name delete_saved_query_end
Parameters
additional_details

string

Additional details pertaining to an audit log.

matter_id

string

The Matter ID an audit pertains to.

organizational_unit_name

string

The organizational unit name.

query

string

The user inputted query for search and exports.

resource_name

string

The resource name of the action, such as hold name or saved query name.

resource_url

string

The document URL of the document view.

target_user

string

The targeted user (such as user put on hold).

Sample request
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/vault?eventName=delete_saved_query_end&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format
Saved query deletion ended

The name of the Vault event: Deletion Search.

Event details
Event name deletion_search
Parameters
additional_details

string

Additional details pertaining to an audit log.

matter_id

string

The Matter ID an audit pertains to.

organizational_unit_name

string

The organizational unit name.

query

string

The user inputted query for search and exports.

resource_name

string

The resource name of the action, such as hold name or saved query name.

resource_url

string

The document URL of the document view.

target_user

string

The targeted user (such as user put on hold).

Sample request
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/vault?eventName=deletion_search&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format
User performed a deletion search

Download Count Per Account CSV

The name of the Vault event: Download Count Per Account CSV.

Event details
Event name download_count_per_account_csv
Parameters
additional_details

string

Additional details pertaining to an audit log.

matter_id

string

The Matter ID an audit pertains to.

organizational_unit_name

string

The organizational unit name.

query

string

The user inputted query for search and exports.

resource_name

string

The resource name of the action, such as hold name or saved query name.

resource_url

string

The document URL of the document view.

target_user

string

The targeted user (such as user put on hold).

Sample request
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/vault?eventName=download_count_per_account_csv&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format
User downloaded count CSV results

Download Cross Matter Litigation Hold Report

The name of the Vault event: Download Cross Matter Litigation Hold Report.

Event details
Event name download_cross_matter_litigation_hold_report
Parameters
additional_details

string

Additional details pertaining to an audit log.

matter_id

string

The Matter ID an audit pertains to.

organizational_unit_name

string

The organizational unit name.

query

string

The user inputted query for search and exports.

resource_name

string

The resource name of the action, such as hold name or saved query name.

resource_url

string

The document URL of the document view.

target_user

string

The targeted user (such as user put on hold).

Sample request
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/vault?eventName=download_cross_matter_litigation_hold_report&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format
User downloaded cross matter litigation hold report

Download Per Matter Litigation Hold Report

The name of the Vault event: Download Per Matter Litigation Hold Report.

Event details
Event name download_per_matter_litigation_hold_report
Parameters
additional_details

string

Additional details pertaining to an audit log.

matter_id

string

The Matter ID an audit pertains to.

organizational_unit_name

string

The organizational unit name.

query

string

The user inputted query for search and exports.

resource_name

string

The resource name of the action, such as hold name or saved query name.

resource_url

string

The document URL of the document view.

target_user

string

The targeted user (such as user put on hold).

Sample request
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/vault?eventName=download_per_matter_litigation_hold_report&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format
User downloaded per matter litigation hold report

Export

The name of the Vault event: Export.

Event details
Event name export
Parameters
additional_details

string

Additional details pertaining to an audit log.

matter_id

string

The Matter ID an audit pertains to.

organizational_unit_name

string

The organizational unit name.

query

string

The user inputted query for search and exports.

resource_name

string

The resource name of the action, such as hold name or saved query name.

resource_url

string

The document URL of the document view.

target_user

string

The targeted user (such as user put on hold).

Sample request
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/vault?eventName=export&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format
User performed an export

Export File Download

The name of the Vault event: Export File Download.

Event details
Event name export_file_download
Parameters
additional_details

string

Additional details pertaining to an audit log.

matter_id

string

The Matter ID an audit pertains to.

organizational_unit_name

string

The organizational unit name.

query

string

The user inputted query for search and exports.

resource_name

string

The resource name of the action, such as hold name or saved query name.

resource_url

string

The document URL of the document view.

target_user

string

The targeted user (such as user put on hold).

Sample request
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/vault?eventName=export_file_download&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format
User downloaded an export file

Get Count Operation

The name of the Vault event: Get Count Operation.

Event details
Event name get_count_operation
Parameters
additional_details

string

Additional details pertaining to an audit log.

matter_id

string

The Matter ID an audit pertains to.

organizational_unit_name

string

The organizational unit name.

query

string

The user inputted query for search and exports.

resource_name

string

The resource name of the action, such as hold name or saved query name.

resource_url

string

The document URL of the document view.

target_user

string

The targeted user (such as user put on hold).

Sample request
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/vault?eventName=get_count_operation&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format
User viewed search count

Legacy Export Download

The name of the Vault event: Legacy Export Download.

Event details
Event name legacy_export_download
Parameters
additional_details

string

Additional details pertaining to an audit log.

matter_id

string

The Matter ID an audit pertains to.

organizational_unit_name

string

The organizational unit name.

query

string

The user inputted query for search and exports.

resource_name

string

The resource name of the action, such as hold name or saved query name.

resource_url

string

The document URL of the document view.

target_user

string

The targeted user (such as user put on hold).

Sample request
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/vault?eventName=legacy_export_download&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format
User downloaded a legacy export

Modify Default Retention Period Begin

The name of the Vault event: Modify Default Retention Period Begin.

Event details
Event name modify_default_retention_period_begin
Parameters
additional_details

string

Additional details pertaining to an audit log.

matter_id

string

The Matter ID an audit pertains to.

organizational_unit_name

string

The organizational unit name.

query

string

The user inputted query for search and exports.

resource_name

string

The resource name of the action, such as hold name or saved query name.

resource_url

string

The document URL of the document view.

target_user

string

The targeted user (such as user put on hold).

Sample request
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/vault?eventName=modify_default_retention_period_begin&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format
Default retention period modification began

Modify Default Retention Period End

The name of the Vault event: Modify Default Retention Period End.

Event details
Event name modify_default_retention_period_end
Parameters
additional_details

string

Additional details pertaining to an audit log.

matter_id

string

The Matter ID an audit pertains to.

organizational_unit_name

string

The organizational unit name.

query

string

The user inputted query for search and exports.

resource_name

string

The resource name of the action, such as hold name or saved query name.

resource_url

string

The document URL of the document view.

target_user

string

The targeted user (such as user put on hold).

Sample request
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/vault?eventName=modify_default_retention_period_end&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format
Default retention period modification ended

Obsolete API Exports List

The name of the Vault event: Obsolete API Exports List.

Event details
Event name obsolete_api_exports_list
Parameters
additional_details

string

Additional details pertaining to an audit log.

matter_id

string

The Matter ID an audit pertains to.

organizational_unit_name

string

The organizational unit name.

query

string

The user inputted query for search and exports.

resource_name

string

The resource name of the action, such as hold name or saved query name.

resource_url

string

The document URL of the document view.

target_user

string

The targeted user (such as user put on hold).

Sample request
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/vault?eventName=obsolete_api_exports_list&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format
Exports listed through the API

Obsolete API Holds Insert

The name of the Vault event: Obsolete API Holds Insert.

Event details
Event name obsolete_api_holds_insert
Parameters
additional_details

string

Additional details pertaining to an audit log.

matter_id

string

The Matter ID an audit pertains to.

organizational_unit_name

string

The organizational unit name.

query

string

The user inputted query for search and exports.

resource_name

string

The resource name of the action, such as hold name or saved query name.

resource_url

string

The document URL of the document view.

target_user

string

The targeted user (such as user put on hold).

Sample request
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/vault?eventName=obsolete_api_holds_insert&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format
Holds inserted through the API

Obsolete API Holds List

The name of the Vault event: Obsolete API Holds List.

Event details
Event name obsolete_api_holds_list
Parameters
additional_details

string

Additional details pertaining to an audit log.

matter_id

string

The Matter ID an audit pertains to.

organizational_unit_name

string

The organizational unit name.

query

string

The user inputted query for search and exports.

resource_name

string

The resource name of the action, such as hold name or saved query name.

resource_url

string

The document URL of the document view.

target_user

string

The targeted user (such as user put on hold).

Sample request
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/vault?eventName=obsolete_api_holds_list&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format
Holds listed through the API

Obsolete API Matters Delete

The name of the Vault event: Obsolete API Matters Delete.

Event details
Event name obsolete_api_matters_delete
Parameters
additional_details

string

Additional details pertaining to an audit log.

matter_id

string

The Matter ID an audit pertains to.

organizational_unit_name

string

The organizational unit name.

query

string

The user inputted query for search and exports.

resource_name

string

The resource name of the action, such as hold name or saved query name.

resource_url

string

The document URL of the document view.

target_user

string

The targeted user (such as user put on hold).

Sample request
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/vault?eventName=obsolete_api_matters_delete&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format
Matters deleted through the API

Obsolete API Matters Get

The name of the Vault event: Obsolete API Matters Get.

Event details
Event name obsolete_api_matters_get
Parameters
additional_details

string

Additional details pertaining to an audit log.

matter_id

string

The Matter ID an audit pertains to.

organizational_unit_name

string

The organizational unit name.

query

string

The user inputted query for search and exports.

resource_name

string

The resource name of the action, such as hold name or saved query name.

resource_url

string

The document URL of the document view.

target_user

string

The targeted user (such as user put on hold).

Sample request
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/vault?eventName=obsolete_api_matters_get&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format
Matter details retrieved through the API

Obsolete API Matters Insert

The name of the Vault event: Obsolete API Matters Insert.

Event details
Event name obsolete_api_matters_insert
Parameters
additional_details

string

Additional details pertaining to an audit log.

matter_id

string

The Matter ID an audit pertains to.

organizational_unit_name

string

The organizational unit name.

query

string

The user inputted query for search and exports.

resource_name

string

The resource name of the action, such as hold name or saved query name.

resource_url

string

The document URL of the document view.

target_user

string

The targeted user (such as user put on hold).

Sample request
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/vault?eventName=obsolete_api_matters_insert&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format
Matters inserted through the API

Obsolete API Matters List

The name of the Vault event: Obsolete API Matters List.

Event details
Event name obsolete_api_matters_list
Parameters
additional_details

string

Additional details pertaining to an audit log.

matter_id

string

The Matter ID an audit pertains to.

organizational_unit_name

string

The organizational unit name.

query

string

The user inputted query for search and exports.

resource_name

string

The resource name of the action, such as hold name or saved query name.

resource_url

string

The document URL of the document view.

target_user

string

The targeted user (such as user put on hold).

Sample request
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/vault?eventName=obsolete_api_matters_list&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format
Matters listed through the API

Obsolete API Matters Update

The name of the Vault event: Obsolete API Matters Update.

Event details
Event name obsolete_api_matters_update
Parameters
additional_details

string

Additional details pertaining to an audit log.

matter_id

string

The Matter ID an audit pertains to.

organizational_unit_name

string

The organizational unit name.

query

string

The user inputted query for search and exports.

resource_name

string

The resource name of the action, such as hold name or saved query name.

resource_url

string

The document URL of the document view.

target_user

string

The targeted user (such as user put on hold).

Sample request
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/vault?eventName=obsolete_api_matters_update&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format
A matter updated through the API

Obsolete Preview Retention Rule Count

The name of the Vault event: Obsolete Preview Retention Rule Count.

Event details
Event name obsolete_preview_retention_rule_count
Parameters
additional_details

string

Additional details pertaining to an audit log.

matter_id

string

The Matter ID an audit pertains to.

organizational_unit_name

string

The organizational unit name.

query

string

The user inputted query for search and exports.

resource_name

string

The resource name of the action, such as hold name or saved query name.

resource_url

string

The document URL of the document view.

target_user

string

The targeted user (such as user put on hold).

Sample request
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/vault?eventName=obsolete_preview_retention_rule_count&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format
User previewed retention rule count

Preview Retention Rule

The name of the Vault event: Preview Retention Rule.

Event details
Event name preview_retention_rule
Parameters
additional_details

string

Additional details pertaining to an audit log.

matter_id

string

The Matter ID an audit pertains to.

organizational_unit_name

string

The organizational unit name.

query

string

The user inputted query for search and exports.

resource_name

string

The resource name of the action, such as hold name or saved query name.

resource_url

string

The document URL of the document view.

target_user

string

The targeted user (such as user put on hold).

Sample request
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/vault?eventName=preview_retention_rule&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format
User previewed retention rule

Remove Collaborator Begin

The name of the Vault event: Remove Collaborator Begin.

Event details
Event name remove_collaborator_begin
Parameters
additional_details

string

Additional details pertaining to an audit log.

matter_id

string

The Matter ID an audit pertains to.

organizational_unit_name

string

The organizational unit name.

query

string

The user inputted query for search and exports.

resource_name

string

The resource name of the action, such as hold name or saved query name.

resource_url

string

The document URL of the document view.

target_user

string

The targeted user (such as user put on hold).

Sample request
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/vault?eventName=remove_collaborator_begin&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format
Collaborator removal began

Remove Collaborator End

The name of the Vault event: Remove Collaborator End.

Event details
Event name remove_collaborator_end
Parameters
additional_details

string

Additional details pertaining to an audit log.

matter_id

string

The Matter ID an audit pertains to.

organizational_unit_name

string

The organizational unit name.

query

string

The user inputted query for search and exports.

resource_name

string

The resource name of the action, such as hold name or saved query name.

resource_url

string

The document URL of the document view.

target_user

string

The targeted user (such as user put on hold).

Sample request
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/vault?eventName=remove_collaborator_end&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format
Collaborator removal ended

Remove Litigation Hold Begin

The name of the Vault event: Remove Litigation Hold Begin.

Event details
Event name remove_litigation_hold_begin
Parameters
additional_details

string

Additional details pertaining to an audit log.

matter_id

string

The Matter ID an audit pertains to.

organizational_unit_name

string

The organizational unit name.

query

string

The user inputted query for search and exports.

resource_name

string

The resource name of the action, such as hold name or saved query name.

resource_url

string

The document URL of the document view.

target_user

string

The targeted user (such as user put on hold).

Sample request
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/vault?eventName=remove_litigation_hold_begin&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format
Litigation hold removal began

Remove Litigation Hold End

The name of the Vault event: Remove Litigation Hold End.

Event details
Event name remove_litigation_hold_end
Parameters
additional_details

string

Additional details pertaining to an audit log.

matter_id

string

The Matter ID an audit pertains to.

organizational_unit_name

string

The organizational unit name.

query

string

The user inputted query for search and exports.

resource_name

string

The resource name of the action, such as hold name or saved query name.

resource_url

string

The document URL of the document view.

target_user

string

The targeted user (such as user put on hold).

Sample request
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/vault?eventName=remove_litigation_hold_end&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format
Litigation hold removal ended

Reopen Investigation Begin

The name of the Vault event: Reopen Investigation Begin.

Event details
Event name reopen_investigation_begin
Parameters
additional_details

string

Additional details pertaining to an audit log.

matter_id

string

The Matter ID an audit pertains to.

organizational_unit_name

string

The organizational unit name.

query

string

The user inputted query for search and exports.

resource_name

string

The resource name of the action, such as hold name or saved query name.

resource_url

string

The document URL of the document view.

target_user

string

The targeted user (such as user put on hold).

Sample request
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/vault?eventName=reopen_investigation_begin&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format
Investigation reopening began

Reopen Investigation End

The name of the Vault event: Reopen Investigation End.

Event details
Event name reopen_investigation_end
Parameters
additional_details

string

Additional details pertaining to an audit log.

matter_id

string

The Matter ID an audit pertains to.

organizational_unit_name

string

The organizational unit name.

query

string

The user inputted query for search and exports.

resource_name

string

The resource name of the action, such as hold name or saved query name.

resource_url

string

The document URL of the document view.

target_user

string

The targeted user (such as user put on hold).

Sample request
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/vault?eventName=reopen_investigation_end&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format
Investigation reopening ended

Restore Investigation Begin

The name of the Vault event: Restore Investigation Begin.

Event details
Event name restore_investigation_begin
Parameters
additional_details

string

Additional details pertaining to an audit log.

matter_id

string

The Matter ID an audit pertains to.

organizational_unit_name

string

The organizational unit name.

query

string

The user inputted query for search and exports.

resource_name

string

The resource name of the action, such as hold name or saved query name.

resource_url

string

The document URL of the document view.

target_user

string

The targeted user (such as user put on hold).

Sample request
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/vault?eventName=restore_investigation_begin&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format
Investigation restoration began

Restore Investigation End

The name of the Vault event: Restore Investigation End.

Event details
Event name restore_investigation_end
Parameters
additional_details

string

Additional details pertaining to an audit log.

matter_id

string

The Matter ID an audit pertains to.

organizational_unit_name

string

The organizational unit name.

query

string

The user inputted query for search and exports.

resource_name

string

The resource name of the action, such as hold name or saved query name.

resource_url

string

The document URL of the document view.

target_user

string

The targeted user (such as user put on hold).

Sample request
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/vault?eventName=restore_investigation_end&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format
Investigation restoration ended

The name of the Vault event: Search.

Event details
Event name search
Parameters
additional_details

string

Additional details pertaining to an audit log.

matter_id

string

The Matter ID an audit pertains to.

organizational_unit_name

string

The organizational unit name.

query

string

The user inputted query for search and exports.

resource_name

string

The resource name of the action, such as hold name or saved query name.

resource_url

string

The document URL of the document view.

target_user

string

The targeted user (such as user put on hold).

Sample request
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/vault?eventName=search&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format
User performed a search

Search Count

The name of the Vault event: Search Count.

Event details
Event name search_count
Parameters
additional_details

string

Additional details pertaining to an audit log.

matter_id

string

The Matter ID an audit pertains to.

organizational_unit_name

string

The organizational unit name.

query

string

The user inputted query for search and exports.

resource_name

string

The resource name of the action, such as hold name or saved query name.

resource_url

string

The document URL of the document view.

target_user

string

The targeted user (such as user put on hold).

Sample request
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/vault?eventName=search_count&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format
User ran a count search

Update Investigation Details Begin

The name of the Vault event: Update Investigation Details Begin.

Event details
Event name update_investigation_details_begin
Parameters
additional_details

string

Additional details pertaining to an audit log.

matter_id

string

The Matter ID an audit pertains to.

organizational_unit_name

string

The organizational unit name.

query

string

The user inputted query for search and exports.

resource_name

string

The resource name of the action, such as hold name or saved query name.

resource_url

string

The document URL of the document view.

target_user

string

The targeted user (such as user put on hold).

Sample request
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/vault?eventName=update_investigation_details_begin&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format
Investigation details update began

Update Investigation Details End

The name of the Vault event: Update Investigation Details End.

Event details
Event name update_investigation_details_end
Parameters
additional_details

string

Additional details pertaining to an audit log.

matter_id

string

The Matter ID an audit pertains to.

organizational_unit_name

string

The organizational unit name.

query

string

The user inputted query for search and exports.

resource_name

string

The resource name of the action, such as hold name or saved query name.

resource_url

string

The document URL of the document view.

target_user

string

The targeted user (such as user put on hold).

Sample request
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/vault?eventName=update_investigation_details_end&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format
Investigation details update ended

Update Preservation Rule Add Holds Begin

The name of the Vault event: Update Preservation Rule Add Holds Begin.

Event details
Event name update_preservation_rule_add_holds_begin
Parameters
additional_details

string

Additional details pertaining to an audit log.

matter_id

string

The Matter ID an audit pertains to.

organizational_unit_name

string

The organizational unit name.

query

string

The user inputted query for search and exports.

resource_name

string

The resource name of the action, such as hold name or saved query name.

resource_url

string

The document URL of the document view.

target_user

string

The targeted user (such as user put on hold).

Sample request
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/vault?eventName=update_preservation_rule_add_holds_begin&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format
Preservation rule addition update began

Update Preservation Rule Add Holds End

The name of the Vault event: Update Preservation Rule Add Holds End.

Event details
Event name update_preservation_rule_add_holds_end
Parameters
additional_details

string

Additional details pertaining to an audit log.

matter_id

string

The Matter ID an audit pertains to.

organizational_unit_name

string

The organizational unit name.

query

string

The user inputted query for search and exports.

resource_name

string

The resource name of the action, such as hold name or saved query name.

resource_url

string

The document URL of the document view.

target_user

string

The targeted user (such as user put on hold).

Sample request
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/vault?eventName=update_preservation_rule_add_holds_end&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format
Preservation rule addition update ended

Update Preservation Rule Query Begin

The name of the Vault event: Update Preservation Rule Query Begin.

Event details
Event name update_preservation_rule_query_begin
Parameters
additional_details

string

Additional details pertaining to an audit log.

matter_id

string

The Matter ID an audit pertains to.

organizational_unit_name

string

The organizational unit name.

query

string

The user inputted query for search and exports.

resource_name

string

The resource name of the action, such as hold name or saved query name.

resource_url

string

The document URL of the document view.

target_user

string

The targeted user (such as user put on hold).

Sample request
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/vault?eventName=update_preservation_rule_query_begin&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format
Preservation rule query update began

Update Preservation Rule Query End

The name of the Vault event: Update Preservation Rule Query End.

Event details
Event name update_preservation_rule_query_end
Parameters
additional_details

string

Additional details pertaining to an audit log.

matter_id

string

The Matter ID an audit pertains to.

organizational_unit_name

string

The organizational unit name.

query

string

The user inputted query for search and exports.

resource_name

string

The resource name of the action, such as hold name or saved query name.

resource_url

string

The document URL of the document view.

target_user

string

The targeted user (such as user put on hold).

Sample request
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/vault?eventName=update_preservation_rule_query_end&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format
Preservation rule query update ended

Update Preservation Rule Remove Holds Begin

The name of the Vault event: Update Preservation Rule Remove Holds Begin.

Event details
Event name update_preservation_rule_remove_holds_begin
Parameters
additional_details

string

Additional details pertaining to an audit log.

matter_id

string

The Matter ID an audit pertains to.

organizational_unit_name

string

The organizational unit name.

query

string

The user inputted query for search and exports.

resource_name

string

The resource name of the action, such as hold name or saved query name.

resource_url

string

The document URL of the document view.

target_user

string

The targeted user (such as user put on hold).

Sample request
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/vault?eventName=update_preservation_rule_remove_holds_begin&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format
Preservation rule removal update began

Update Preservation Rule Remove Holds End

The name of the Vault event: Update Preservation Rule Remove Holds End.

Event details
Event name update_preservation_rule_remove_holds_end
Parameters
additional_details

string

Additional details pertaining to an audit log.

matter_id

string

The Matter ID an audit pertains to.

organizational_unit_name

string

The organizational unit name.

query

string

The user inputted query for search and exports.

resource_name

string

The resource name of the action, such as hold name or saved query name.

resource_url

string

The document URL of the document view.

target_user

string

The targeted user (such as user put on hold).

Sample request
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/vault?eventName=update_preservation_rule_remove_holds_end&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format
Preservation rule removal update ended

Update Retention Rule Begin

The name of the Vault event: Update Retention Rule Begin.

Event details
Event name update_retention_rule_begin
Parameters
additional_details

string

Additional details pertaining to an audit log.

matter_id

string

The Matter ID an audit pertains to.

organizational_unit_name

string

The organizational unit name.

query

string

The user inputted query for search and exports.

resource_name

string

The resource name of the action, such as hold name or saved query name.

resource_url

string

The document URL of the document view.

target_user

string

The targeted user (such as user put on hold).

Sample request
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/vault?eventName=update_retention_rule_begin&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format
Retention rule update began

Update Retention Rule End

The name of the Vault event: Update Retention Rule End.

Event details
Event name update_retention_rule_end
Parameters
additional_details

string

Additional details pertaining to an audit log.

matter_id

string

The Matter ID an audit pertains to.

organizational_unit_name

string

The organizational unit name.

query

string

The user inputted query for search and exports.

resource_name

string

The resource name of the action, such as hold name or saved query name.

resource_url

string

The document URL of the document view.

target_user

string

The targeted user (such as user put on hold).

Sample request
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/vault?eventName=update_retention_rule_end&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format
Retention rule update ended

Update Retention Settings

The name of the Vault event: Update Retention Settings.

Event details
Event name update_retention_settings
Parameters
additional_details

string

Additional details pertaining to an audit log.

matter_id

string

The Matter ID an audit pertains to.

organizational_unit_name

string

The organizational unit name.

query

string

The user inputted query for search and exports.

resource_name

string

The resource name of the action, such as hold name or saved query name.

resource_url

string

The document URL of the document view.

target_user

string

The targeted user (such as user put on hold).

Sample request
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/vault?eventName=update_retention_settings&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format
User updated retention settings

Update Saved Query Details Begin

The name of the Vault event: Update Saved Query Details Begin.

Event details
Event name update_saved_query_details_begin
Parameters
additional_details

string

Additional details pertaining to an audit log.

matter_id

string

The Matter ID an audit pertains to.

organizational_unit_name

string

The organizational unit name.

query

string

The user inputted query for search and exports.

resource_name

string

The resource name of the action, such as hold name or saved query name.

resource_url

string

The document URL of the document view.

target_user

string

The targeted user (such as user put on hold).

Sample request
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/vault?eventName=update_saved_query_details_begin&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format
Saved query details update began

Update Saved Query Details End

The name of the Vault event: Update Saved Query Details End.

Event details
Event name update_saved_query_details_end
Parameters
additional_details

string

Additional details pertaining to an audit log.

matter_id

string

The Matter ID an audit pertains to.

organizational_unit_name

string

The organizational unit name.

query

string

The user inputted query for search and exports.

resource_name

string

The resource name of the action, such as hold name or saved query name.

resource_url

string

The document URL of the document view.

target_user

string

The targeted user (such as user put on hold).

Sample request
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/vault?eventName=update_saved_query_details_end&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format
Saved query details update ended

View Cross Matter Litigation Hold Report

The name of the Vault event: View Cross Matter Litigation Hold Report.

Event details
Event name view_cross_matter_litigation_hold_report
Parameters
additional_details

string

Additional details pertaining to an audit log.

matter_id

string

The Matter ID an audit pertains to.

organizational_unit_name

string

The organizational unit name.

query

string

The user inputted query for search and exports.

resource_name

string

The resource name of the action, such as hold name or saved query name.

resource_url

string

The document URL of the document view.

target_user

string

The targeted user (such as user put on hold).

Sample request
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/vault?eventName=view_cross_matter_litigation_hold_report&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format
User viewed a cross matter litigation hold report

View Custodian Litigation Hold Report

The name of the Vault event: View Custodian Litigation Hold Report.

Event details
Event name view_custodian_litigation_hold_report
Parameters
additional_details

string

Additional details pertaining to an audit log.

matter_id

string

The Matter ID an audit pertains to.

organizational_unit_name

string

The organizational unit name.

query

string

The user inputted query for search and exports.

resource_name

string

The resource name of the action, such as hold name or saved query name.

resource_url

string

The document URL of the document view.

target_user

string

The targeted user (such as user put on hold).

Sample request
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/vault?eventName=view_custodian_litigation_hold_report&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format
User viewed a custodian litigation hold report

View Document

The name of the Vault event: View Document.

Event details
Event name view_document
Parameters
additional_details

string

Additional details pertaining to an audit log.

matter_id

string

The Matter ID an audit pertains to.

organizational_unit_name

string

The organizational unit name.

query

string

The user inputted query for search and exports.

resource_name

string

The resource name of the action, such as hold name or saved query name.

resource_url

string

The document URL of the document view.

target_user

string

The targeted user (such as user put on hold).

Sample request
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/vault?eventName=view_document&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format
User viewed a document

View Document Information

The name of the Vault event: View Document Information.

Event details
Event name view_document_information
Parameters
additional_details

string

Additional details pertaining to an audit log.

matter_id

string

The Matter ID an audit pertains to.

organizational_unit_name

string

The organizational unit name.

query

string

The user inputted query for search and exports.

resource_name

string

The resource name of the action, such as hold name or saved query name.

resource_url

string

The document URL of the document view.

target_user

string

The targeted user (such as user put on hold).

Sample request
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/vault?eventName=view_document_information&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format
User viewed a document’s information

View External Document

The name of the Vault event: View External Document.

Event details
Event name view_external_document
Parameters
additional_details

string

Additional details pertaining to an audit log.

matter_id

string

The Matter ID an audit pertains to.

organizational_unit_name

string

The organizational unit name.

query

string

The user inputted query for search and exports.

resource_name

string

The resource name of the action, such as hold name or saved query name.

resource_url

string

The document URL of the document view.

target_user

string

The targeted user (such as user put on hold).

Sample request
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/vault?eventName=view_external_document&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format
User viewed an external document

View Investigation

The name of the Vault event: View Investigation.

Event details
Event name view_investigation
Parameters
additional_details

string

Additional details pertaining to an audit log.

matter_id

string

The Matter ID an audit pertains to.

organizational_unit_name

string

The organizational unit name.

query

string

The user inputted query for search and exports.

resource_name

string

The resource name of the action, such as hold name or saved query name.

resource_url

string

The document URL of the document view.

target_user

string

The targeted user (such as user put on hold).

Sample request
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/vault?eventName=view_investigation&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format
User viewed a matter

View Matter Audit Log

The name of the Vault event: View Matter Audit Log.

Event details
Event name view_matter_audit_log
Parameters
additional_details

string

Additional details pertaining to an audit log.

matter_id

string

The Matter ID an audit pertains to.

organizational_unit_name

string

The organizational unit name.

query

string

The user inputted query for search and exports.

resource_name

string

The resource name of the action, such as hold name or saved query name.

resource_url

string

The document URL of the document view.

target_user

string

The targeted user (such as user put on hold).

Sample request
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/vault?eventName=view_matter_audit_log&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format
User viewed a matter’s log events

View Per Matter Litigation Hold Report

The name of the Vault event: View Per Matter Litigation Hold Report.

Event details
Event name view_per_matter_litigation_hold_report
Parameters
additional_details

string

Additional details pertaining to an audit log.

matter_id

string

The Matter ID an audit pertains to.

organizational_unit_name

string

The organizational unit name.

query

string

The user inputted query for search and exports.

resource_name

string

The resource name of the action, such as hold name or saved query name.

resource_url

string

The document URL of the document view.

target_user

string

The targeted user (such as user put on hold).

Sample request
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/vault?eventName=view_per_matter_litigation_hold_report&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format
User viewed a matter litigation hold report

View Retention Policy

The name of the Vault event: View Retention Policy.

Event details
Event name view_retention_policy
Parameters
additional_details

string

Additional details pertaining to an audit log.

matter_id

string

The Matter ID an audit pertains to.

organizational_unit_name

string

The organizational unit name.

query

string

The user inputted query for search and exports.

resource_name

string

The resource name of the action, such as hold name or saved query name.

resource_url

string

The document URL of the document view.

target_user

string

The targeted user (such as user put on hold).

Sample request
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/vault?eventName=view_retention_policy&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format
User viewed retention policy

View Retention Settings

The name of the Vault event: View Retention Settings.

Event details
Event name view_retention_settings
Parameters
additional_details

string

Additional details pertaining to an audit log.

matter_id

string

The Matter ID an audit pertains to.

organizational_unit_name

string

The organizational unit name.

query

string

The user inputted query for search and exports.

resource_name

string

The resource name of the action, such as hold name or saved query name.

resource_url

string

The document URL of the document view.

target_user

string

The targeted user (such as user put on hold).

Sample request
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/vault?eventName=view_retention_settings&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format
User viewed retention settings

View System Audit Log

The name of the Vault event: View System Audit Log.

Event details
Event name view_system_audit_log
Parameters
additional_details

string

Additional details pertaining to an audit log.

matter_id

string

The Matter ID an audit pertains to.

organizational_unit_name

string

The organizational unit name.

query

string

The user inputted query for search and exports.

resource_name

string

The resource name of the action, such as hold name or saved query name.

resource_url

string

The document URL of the document view.

target_user

string

The targeted user (such as user put on hold).

Sample request
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/vault?eventName=view_system_audit_log&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format
User viewed the system’s log events