Drive Audit Activity Events

This document lists the events and parameters for various types of Drive Audit activity events. You can retrieve these events by calling Activities.list() with applicationName=drive.

Access

Events of this type are returned with type=access.

Add to folder

Document add to folder.

Event details
Event name	add_to_folder
Parameters	actor_is_collaborator_account boolean Whether actor is a collaborator account. billable boolean Whether this activity is billable. destination_folder_id string Destination folder Id. destination_folder_title string Destination folder title. doc_id string Document Id. doc_title string Document title. doc_type string Document type. Possible values: document Doc type document. drawing Doc type drawing. folder Doc type folder. form Doc type form. html Doc type HTML. jam Doc type Jam. jpeg Doc type JPEG. mp4 Doc type MP4. mpeg Doc type MPEG. msexcel Doc type MS Excel. mspowerpoint Doc type MS Powerpoint. msword Doc type MS Word. pdf Doc type PDF. png Doc type PNG. presentation Doc type presentation. quicktime Doc type Quicktime. sites Doc type is Google Sites. spreadsheet Doc type spreadsheet. shared_drive Doc type is a shared drive. txt Doc type txt. unknown Doc type unknown. is_encrypted boolean Whether the file is client side encrypted. originating_app_id string The Google Cloud Project ID of the application that performed the action. Use the Drive REST API to retrieve the app title. owner string Email address of the document's owner. For items contained in a Team Drive, the owner is the name of the Team Drive. owner_is_shared_drive boolean Boolean flag denoting whether owner is a shared drive. primary_event boolean Whether this is a primary event. A single user action in Drive may generate several events, multiple of which can be primary (primary_event=true). The remaining events are deemed to be side effects of the primary event(s) (primary_event=false). For example, when a user creates a document, several events are generated, with only the create event having primary_event=true. But when a user shares a document with multiple other users in one action, an access change event having primary_event=true is created for each sharee. Possible values: false Boolean value false. true Boolean value true. shared_drive_id string The unique identifier of the Team Drive. Only populated for for events relating to a Team Drive or item contained inside a Team Drive. visibility string Visibility of Target File. Possible values: people_with_link Anyone with the link can access. people_within_domain_with_link Anyone with the link within the audience can access. private Private. public_in_the_domain Anyone within the audience can access. public_on_the_web Public on the web. shared_externally Shared with explicit users/groups external to the domain. shared_internally Shared with explicit users/groups internal to the domain. unknown Unknown visibility.
Sample request	GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/drive?eventName=add_to_folder&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format	{actor} added an item to {destination_folder_title}

Approval canceled

Drive approval canceled.

Event details
Event name	approval_canceled
Parameters	actor_is_collaborator_account boolean Whether actor is a collaborator account. billable boolean Whether this activity is billable. doc_id string Document Id. doc_title string Document title. doc_type string Document type. Possible values: document Doc type document. drawing Doc type drawing. folder Doc type folder. form Doc type form. html Doc type HTML. jam Doc type Jam. jpeg Doc type JPEG. mp4 Doc type MP4. mpeg Doc type MPEG. msexcel Doc type MS Excel. mspowerpoint Doc type MS Powerpoint. msword Doc type MS Word. pdf Doc type PDF. png Doc type PNG. presentation Doc type presentation. quicktime Doc type Quicktime. sites Doc type is Google Sites. spreadsheet Doc type spreadsheet. shared_drive Doc type is a shared drive. txt Doc type txt. unknown Doc type unknown. is_encrypted boolean Whether the file is client side encrypted. originating_app_id string The Google Cloud Project ID of the application that performed the action. Use the Drive REST API to retrieve the app title. owner string Email address of the document's owner. For items contained in a Team Drive, the owner is the name of the Team Drive. owner_is_shared_drive boolean Boolean flag denoting whether owner is a shared drive. primary_event boolean Whether this is a primary event. A single user action in Drive may generate several events, multiple of which can be primary (primary_event=true). The remaining events are deemed to be side effects of the primary event(s) (primary_event=false). For example, when a user creates a document, several events are generated, with only the create event having primary_event=true. But when a user shares a document with multiple other users in one action, an access change event having primary_event=true is created for each sharee. Possible values: false Boolean value false. true Boolean value true. shared_drive_id string The unique identifier of the Team Drive. Only populated for for events relating to a Team Drive or item contained inside a Team Drive. visibility string Visibility of Target File. Possible values: people_with_link Anyone with the link can access. people_within_domain_with_link Anyone with the link within the audience can access. private Private. public_in_the_domain Anyone within the audience can access. public_on_the_web Public on the web. shared_externally Shared with explicit users/groups external to the domain. shared_internally Shared with explicit users/groups internal to the domain. unknown Unknown visibility.
Sample request	GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/drive?eventName=approval_canceled&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format	{actor} canceled an approval on an item

Approval comment added

Drive approval comment added.

Event details
Event name	approval_comment_added
Parameters	actor_is_collaborator_account boolean Whether actor is a collaborator account. billable boolean Whether this activity is billable. doc_id string Document Id. doc_title string Document title. doc_type string Document type. Possible values: document Doc type document. drawing Doc type drawing. folder Doc type folder. form Doc type form. html Doc type HTML. jam Doc type Jam. jpeg Doc type JPEG. mp4 Doc type MP4. mpeg Doc type MPEG. msexcel Doc type MS Excel. mspowerpoint Doc type MS Powerpoint. msword Doc type MS Word. pdf Doc type PDF. png Doc type PNG. presentation Doc type presentation. quicktime Doc type Quicktime. sites Doc type is Google Sites. spreadsheet Doc type spreadsheet. shared_drive Doc type is a shared drive. txt Doc type txt. unknown Doc type unknown. is_encrypted boolean Whether the file is client side encrypted. originating_app_id string The Google Cloud Project ID of the application that performed the action. Use the Drive REST API to retrieve the app title. owner string Email address of the document's owner. For items contained in a Team Drive, the owner is the name of the Team Drive. owner_is_shared_drive boolean Boolean flag denoting whether owner is a shared drive. primary_event boolean Whether this is a primary event. A single user action in Drive may generate several events, multiple of which can be primary (primary_event=true). The remaining events are deemed to be side effects of the primary event(s) (primary_event=false). For example, when a user creates a document, several events are generated, with only the create event having primary_event=true. But when a user shares a document with multiple other users in one action, an access change event having primary_event=true is created for each sharee. Possible values: false Boolean value false. true Boolean value true. shared_drive_id string The unique identifier of the Team Drive. Only populated for for events relating to a Team Drive or item contained inside a Team Drive. visibility string Visibility of Target File. Possible values: people_with_link Anyone with the link can access. people_within_domain_with_link Anyone with the link within the audience can access. private Private. public_in_the_domain Anyone within the audience can access. public_on_the_web Public on the web. shared_externally Shared with explicit users/groups external to the domain. shared_internally Shared with explicit users/groups internal to the domain. unknown Unknown visibility.
Sample request	GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/drive?eventName=approval_comment_added&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format	{actor} added a comment on an approval on an item

Approval completed

Drive approval completed.

Event details
Event name	approval_completed
Parameters	actor_is_collaborator_account boolean Whether actor is a collaborator account. billable boolean Whether this activity is billable. doc_id string Document Id. doc_title string Document title. doc_type string Document type. Possible values: document Doc type document. drawing Doc type drawing. folder Doc type folder. form Doc type form. html Doc type HTML. jam Doc type Jam. jpeg Doc type JPEG. mp4 Doc type MP4. mpeg Doc type MPEG. msexcel Doc type MS Excel. mspowerpoint Doc type MS Powerpoint. msword Doc type MS Word. pdf Doc type PDF. png Doc type PNG. presentation Doc type presentation. quicktime Doc type Quicktime. sites Doc type is Google Sites. spreadsheet Doc type spreadsheet. shared_drive Doc type is a shared drive. txt Doc type txt. unknown Doc type unknown. is_encrypted boolean Whether the file is client side encrypted. originating_app_id string The Google Cloud Project ID of the application that performed the action. Use the Drive REST API to retrieve the app title. owner string Email address of the document's owner. For items contained in a Team Drive, the owner is the name of the Team Drive. owner_is_shared_drive boolean Boolean flag denoting whether owner is a shared drive. primary_event boolean Whether this is a primary event. A single user action in Drive may generate several events. Of these, one is the primary event (primary_event=true) and the rest are side effects of that event (primary_event=false). For example, when a user creates a document, several events are generated, with only the create event having primary_event=true. All other events from this action have primary_event=false. Possible values: false Boolean value false. true Boolean value true. shared_drive_id string The unique identifier of the Team Drive. Only populated for for events relating to a Team Drive or item contained inside a Team Drive. visibility string Visibility of Target File. Possible values: people_with_link Anyone with the link can access. people_within_domain_with_link Anyone with the link within the audience can access. private Private. public_in_the_domain Anyone within the audience can access. public_on_the_web Public on the web. shared_externally Shared with explicit users/groups external to the domain. shared_internally Shared with explicit users/groups internal to the domain. unknown Unknown visibility.
Sample request	GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/drive?eventName=approval_completed&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format	An approval was completed

Approval decisions reset

Drive approval decisions reset.

Event details
Event name	approval_decisions_reset
Parameters	actor_is_collaborator_account boolean Whether actor is a collaborator account. billable boolean Whether this activity is billable. doc_id string Document Id. doc_title string Document title. doc_type string Document type. Possible values: document Doc type document. drawing Doc type drawing. folder Doc type folder. form Doc type form. html Doc type HTML. jam Doc type Jam. jpeg Doc type JPEG. mp4 Doc type MP4. mpeg Doc type MPEG. msexcel Doc type MS Excel. mspowerpoint Doc type MS Powerpoint. msword Doc type MS Word. pdf Doc type PDF. png Doc type PNG. presentation Doc type presentation. quicktime Doc type Quicktime. sites Doc type is Google Sites. spreadsheet Doc type spreadsheet. shared_drive Doc type is a shared drive. txt Doc type txt. unknown Doc type unknown. is_encrypted boolean Whether the file is client side encrypted. originating_app_id string The Google Cloud Project ID of the application that performed the action. Use the Drive REST API to retrieve the app title. owner string Email address of the document's owner. For items contained in a Team Drive, the owner is the name of the Team Drive. owner_is_shared_drive boolean Boolean flag denoting whether owner is a shared drive. primary_event boolean Whether this is a primary event. A single user action in Drive may generate several events. Of these, one is the primary event (primary_event=true) and the rest are side effects of that event (primary_event=false). For example, when a user creates a document, several events are generated, with only the create event having primary_event=true. All other events from this action have primary_event=false. Possible values: false Boolean value false. true Boolean value true. shared_drive_id string The unique identifier of the Team Drive. Only populated for for events relating to a Team Drive or item contained inside a Team Drive. visibility string Visibility of Target File. Possible values: people_with_link Anyone with the link can access. people_within_domain_with_link Anyone with the link within the audience can access. private Private. public_in_the_domain Anyone within the audience can access. public_on_the_web Public on the web. shared_externally Shared with explicit users/groups external to the domain. shared_internally Shared with explicit users/groups internal to the domain. unknown Unknown visibility.
Sample request	GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/drive?eventName=approval_decisions_reset&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format	Approval decisions were reset

Approval due time change

Drive approval due time change.

Event details
Event name	approval_due_time_change
Parameters	actor_is_collaborator_account boolean Whether actor is a collaborator account. billable boolean Whether this activity is billable. doc_id string Document Id. doc_title string Document title. doc_type string Document type. Possible values: document Doc type document. drawing Doc type drawing. folder Doc type folder. form Doc type form. html Doc type HTML. jam Doc type Jam. jpeg Doc type JPEG. mp4 Doc type MP4. mpeg Doc type MPEG. msexcel Doc type MS Excel. mspowerpoint Doc type MS Powerpoint. msword Doc type MS Word. pdf Doc type PDF. png Doc type PNG. presentation Doc type presentation. quicktime Doc type Quicktime. sites Doc type is Google Sites. spreadsheet Doc type spreadsheet. shared_drive Doc type is a shared drive. txt Doc type txt. unknown Doc type unknown. is_encrypted boolean Whether the file is client side encrypted. originating_app_id string The Google Cloud Project ID of the application that performed the action. Use the Drive REST API to retrieve the app title. owner string Email address of the document's owner. For items contained in a Team Drive, the owner is the name of the Team Drive. owner_is_shared_drive boolean Boolean flag denoting whether owner is a shared drive. primary_event boolean Whether this is a primary event. A single user action in Drive may generate several events. Of these, one is the primary event (primary_event=true) and the rest are side effects of that event (primary_event=false). For example, when a user creates a document, several events are generated, with only the create event having primary_event=true. All other events from this action have primary_event=false. Possible values: false Boolean value false. true Boolean value true. shared_drive_id string The unique identifier of the Team Drive. Only populated for for events relating to a Team Drive or item contained inside a Team Drive. visibility string Visibility of Target File. Possible values: people_with_link Anyone with the link can access. people_within_domain_with_link Anyone with the link within the audience can access. private Private. public_in_the_domain Anyone within the audience can access. public_on_the_web Public on the web. shared_externally Shared with explicit users/groups external to the domain. shared_internally Shared with explicit users/groups internal to the domain. unknown Unknown visibility.
Sample request	GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/drive?eventName=approval_due_time_change&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format	{actor} requested a due time change on an approval

Approval requested

Drive approval requested.

Event details
Event name	approval_requested
Parameters	actor_is_collaborator_account boolean Whether actor is a collaborator account. billable boolean Whether this activity is billable. doc_id string Document Id. doc_title string Document title. doc_type string Document type. Possible values: document Doc type document. drawing Doc type drawing. folder Doc type folder. form Doc type form. html Doc type HTML. jam Doc type Jam. jpeg Doc type JPEG. mp4 Doc type MP4. mpeg Doc type MPEG. msexcel Doc type MS Excel. mspowerpoint Doc type MS Powerpoint. msword Doc type MS Word. pdf Doc type PDF. png Doc type PNG. presentation Doc type presentation. quicktime Doc type Quicktime. sites Doc type is Google Sites. spreadsheet Doc type spreadsheet. shared_drive Doc type is a shared drive. txt Doc type txt. unknown Doc type unknown. is_encrypted boolean Whether the file is client side encrypted. originating_app_id string The Google Cloud Project ID of the application that performed the action. Use the Drive REST API to retrieve the app title. owner string Email address of the document's owner. For items contained in a Team Drive, the owner is the name of the Team Drive. owner_is_shared_drive boolean Boolean flag denoting whether owner is a shared drive. primary_event boolean Whether this is a primary event. A single user action in Drive may generate several events, multiple of which can be primary (primary_event=true). The remaining events are deemed to be side effects of the primary event(s) (primary_event=false). For example, when a user creates a document, several events are generated, with only the create event having primary_event=true. But when a user shares a document with multiple other users in one action, an access change event having primary_event=true is created for each sharee. Possible values: false Boolean value false. true Boolean value true. shared_drive_id string The unique identifier of the Team Drive. Only populated for for events relating to a Team Drive or item contained inside a Team Drive. visibility string Visibility of Target File. Possible values: people_with_link Anyone with the link can access. people_within_domain_with_link Anyone with the link within the audience can access. private Private. public_in_the_domain Anyone within the audience can access. public_on_the_web Public on the web. shared_externally Shared with explicit users/groups external to the domain. shared_internally Shared with explicit users/groups internal to the domain. unknown Unknown visibility.
Sample request	GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/drive?eventName=approval_requested&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format	{actor} requested approval on an item

Approval reviewer change

Drive approval reviewer change.

Event details
Event name	approval_reviewer_change
Parameters	actor_is_collaborator_account boolean Whether actor is a collaborator account. billable boolean Whether this activity is billable. doc_id string Document Id. doc_title string Document title. doc_type string Document type. Possible values: document Doc type document. drawing Doc type drawing. folder Doc type folder. form Doc type form. html Doc type HTML. jam Doc type Jam. jpeg Doc type JPEG. mp4 Doc type MP4. mpeg Doc type MPEG. msexcel Doc type MS Excel. mspowerpoint Doc type MS Powerpoint. msword Doc type MS Word. pdf Doc type PDF. png Doc type PNG. presentation Doc type presentation. quicktime Doc type Quicktime. sites Doc type is Google Sites. spreadsheet Doc type spreadsheet. shared_drive Doc type is a shared drive. txt Doc type txt. unknown Doc type unknown. is_encrypted boolean Whether the file is client side encrypted. originating_app_id string The Google Cloud Project ID of the application that performed the action. Use the Drive REST API to retrieve the app title. owner string Email address of the document's owner. For items contained in a Team Drive, the owner is the name of the Team Drive. owner_is_shared_drive boolean Boolean flag denoting whether owner is a shared drive. primary_event boolean Whether this is a primary event. A single user action in Drive may generate several events. Of these, one is the primary event (primary_event=true) and the rest are side effects of that event (primary_event=false). For example, when a user creates a document, several events are generated, with only the create event having primary_event=true. All other events from this action have primary_event=false. Possible values: false Boolean value false. true Boolean value true. shared_drive_id string The unique identifier of the Team Drive. Only populated for for events relating to a Team Drive or item contained inside a Team Drive. visibility string Visibility of Target File. Possible values: people_with_link Anyone with the link can access. people_within_domain_with_link Anyone with the link within the audience can access. private Private. public_in_the_domain Anyone within the audience can access. public_on_the_web Public on the web. shared_externally Shared with explicit users/groups external to the domain. shared_internally Shared with explicit users/groups internal to the domain. unknown Unknown visibility.
Sample request	GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/drive?eventName=approval_reviewer_change&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format	{actor} requested a reviewer change on an approval

Approval reviewer responded

Drive approval reviewer responded.

Event details
Event name	approval_reviewer_responded
Parameters	actor_is_collaborator_account boolean Whether actor is a collaborator account. billable boolean Whether this activity is billable. doc_id string Document Id. doc_title string Document title. doc_type string Document type. Possible values: document Doc type document. drawing Doc type drawing. folder Doc type folder. form Doc type form. html Doc type HTML. jam Doc type Jam. jpeg Doc type JPEG. mp4 Doc type MP4. mpeg Doc type MPEG. msexcel Doc type MS Excel. mspowerpoint Doc type MS Powerpoint. msword Doc type MS Word. pdf Doc type PDF. png Doc type PNG. presentation Doc type presentation. quicktime Doc type Quicktime. sites Doc type is Google Sites. spreadsheet Doc type spreadsheet. shared_drive Doc type is a shared drive. txt Doc type txt. unknown Doc type unknown. is_encrypted boolean Whether the file is client side encrypted. originating_app_id string The Google Cloud Project ID of the application that performed the action. Use the Drive REST API to retrieve the app title. owner string Email address of the document's owner. For items contained in a Team Drive, the owner is the name of the Team Drive. owner_is_shared_drive boolean Boolean flag denoting whether owner is a shared drive. primary_event boolean Whether this is a primary event. A single user action in Drive may generate several events, multiple of which can be primary (primary_event=true). The remaining events are deemed to be side effects of the primary event(s) (primary_event=false). For example, when a user creates a document, several events are generated, with only the create event having primary_event=true. But when a user shares a document with multiple other users in one action, an access change event having primary_event=true is created for each sharee. Possible values: false Boolean value false. true Boolean value true. shared_drive_id string The unique identifier of the Team Drive. Only populated for for events relating to a Team Drive or item contained inside a Team Drive. visibility string Visibility of Target File. Possible values: people_with_link Anyone with the link can access. people_within_domain_with_link Anyone with the link within the audience can access. private Private. public_in_the_domain Anyone within the audience can access. public_on_the_web Public on the web. shared_externally Shared with explicit users/groups external to the domain. shared_internally Shared with explicit users/groups internal to the domain. unknown Unknown visibility.
Sample request	GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/drive?eventName=approval_reviewer_responded&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format	{actor} reviewed an approval on an item

Copy

Document copy.

Event details
Event name	copy
Parameters	actor_is_collaborator_account boolean Whether actor is a collaborator account. billable boolean Whether this activity is billable. doc_id string Document Id. doc_title string Document title. doc_type string Document type. Possible values: document Doc type document. drawing Doc type drawing. folder Doc type folder. form Doc type form. html Doc type HTML. jam Doc type Jam. jpeg Doc type JPEG. mp4 Doc type MP4. mpeg Doc type MPEG. msexcel Doc type MS Excel. mspowerpoint Doc type MS Powerpoint. msword Doc type MS Word. pdf Doc type PDF. png Doc type PNG. presentation Doc type presentation. quicktime Doc type Quicktime. sites Doc type is Google Sites. spreadsheet Doc type spreadsheet. shared_drive Doc type is a shared drive. txt Doc type txt. unknown Doc type unknown. is_encrypted boolean Whether the file is client side encrypted. new_value string New Value. old_value string Old Value. originating_app_id string The Google Cloud Project ID of the application that performed the action. Use the Drive REST API to retrieve the app title. owner string Email address of the document's owner. For items contained in a Team Drive, the owner is the name of the Team Drive. owner_is_shared_drive boolean Boolean flag denoting whether owner is a shared drive. primary_event boolean Whether this is a primary event. A single user action in Drive may generate several events, multiple of which can be primary (primary_event=true). The remaining events are deemed to be side effects of the primary event(s) (primary_event=false). For example, when a user creates a document, several events are generated, with only the create event having primary_event=true. But when a user shares a document with multiple other users in one action, an access change event having primary_event=true is created for each sharee. Possible values: false Boolean value false. true Boolean value true. shared_drive_id string The unique identifier of the Team Drive. Only populated for for events relating to a Team Drive or item contained inside a Team Drive. visibility string Visibility of Target File. Possible values: people_with_link Anyone with the link can access. people_within_domain_with_link Anyone with the link within the audience can access. private Private. public_in_the_domain Anyone within the audience can access. public_on_the_web Public on the web. shared_externally Shared with explicit users/groups external to the domain. shared_internally Shared with explicit users/groups internal to the domain. unknown Unknown visibility.
Sample request	GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/drive?eventName=copy&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format	{actor} created a copy of original document {old_value}

Create

Document create.

Event details
Event name	create
Parameters	actor_is_collaborator_account boolean Whether actor is a collaborator account. billable boolean Whether this activity is billable. doc_id string Document Id. doc_title string Document title. doc_type string Document type. Possible values: document Doc type document. drawing Doc type drawing. folder Doc type folder. form Doc type form. html Doc type HTML. jam Doc type Jam. jpeg Doc type JPEG. mp4 Doc type MP4. mpeg Doc type MPEG. msexcel Doc type MS Excel. mspowerpoint Doc type MS Powerpoint. msword Doc type MS Word. pdf Doc type PDF. png Doc type PNG. presentation Doc type presentation. quicktime Doc type Quicktime. sites Doc type is Google Sites. spreadsheet Doc type spreadsheet. shared_drive Doc type is a shared drive. txt Doc type txt. unknown Doc type unknown. is_encrypted boolean Whether the file is client side encrypted. originating_app_id string The Google Cloud Project ID of the application that performed the action. Use the Drive REST API to retrieve the app title. owner string Email address of the document's owner. For items contained in a Team Drive, the owner is the name of the Team Drive. owner_is_shared_drive boolean Boolean flag denoting whether owner is a shared drive. primary_event boolean Whether this is a primary event. A single user action in Drive may generate several events, multiple of which can be primary (primary_event=true). The remaining events are deemed to be side effects of the primary event(s) (primary_event=false). For example, when a user creates a document, several events are generated, with only the create event having primary_event=true. But when a user shares a document with multiple other users in one action, an access change event having primary_event=true is created for each sharee. Possible values: false Boolean value false. true Boolean value true. shared_drive_id string The unique identifier of the Team Drive. Only populated for for events relating to a Team Drive or item contained inside a Team Drive. visibility string Visibility of Target File. Possible values: people_with_link Anyone with the link can access. people_within_domain_with_link Anyone with the link within the audience can access. private Private. public_in_the_domain Anyone within the audience can access. public_on_the_web Public on the web. shared_externally Shared with explicit users/groups external to the domain. shared_internally Shared with explicit users/groups internal to the domain. unknown Unknown visibility.
Sample request	GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/drive?eventName=create&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format	{actor} created an item

Delete

Document delete.

Event details
Event name	delete
Parameters	actor_is_collaborator_account boolean Whether actor is a collaborator account. billable boolean Whether this activity is billable. doc_id string Document Id. doc_title string Document title. doc_type string Document type. Possible values: document Doc type document. drawing Doc type drawing. folder Doc type folder. form Doc type form. html Doc type HTML. jam Doc type Jam. jpeg Doc type JPEG. mp4 Doc type MP4. mpeg Doc type MPEG. msexcel Doc type MS Excel. mspowerpoint Doc type MS Powerpoint. msword Doc type MS Word. pdf Doc type PDF. png Doc type PNG. presentation Doc type presentation. quicktime Doc type Quicktime. sites Doc type is Google Sites. spreadsheet Doc type spreadsheet. shared_drive Doc type is a shared drive. txt Doc type txt. unknown Doc type unknown. is_encrypted boolean Whether the file is client side encrypted. originating_app_id string The Google Cloud Project ID of the application that performed the action. Use the Drive REST API to retrieve the app title. owner string Email address of the document's owner. For items contained in a Team Drive, the owner is the name of the Team Drive. owner_is_shared_drive boolean Boolean flag denoting whether owner is a shared drive. primary_event boolean Whether this is a primary event. A single user action in Drive may generate several events, multiple of which can be primary (primary_event=true). The remaining events are deemed to be side effects of the primary event(s) (primary_event=false). For example, when a user creates a document, several events are generated, with only the create event having primary_event=true. But when a user shares a document with multiple other users in one action, an access change event having primary_event=true is created for each sharee. Possible values: false Boolean value false. true Boolean value true. shared_drive_id string The unique identifier of the Team Drive. Only populated for for events relating to a Team Drive or item contained inside a Team Drive. visibility string Visibility of Target File. Possible values: people_with_link Anyone with the link can access. people_within_domain_with_link Anyone with the link within the audience can access. private Private. public_in_the_domain Anyone within the audience can access. public_on_the_web Public on the web. shared_externally Shared with explicit users/groups external to the domain. shared_internally Shared with explicit users/groups internal to the domain. unknown Unknown visibility.
Sample request	GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/drive?eventName=delete&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format	{actor} deleted an item

Download

Document download.

Event details
Event name	download
Parameters	actor_is_collaborator_account boolean Whether actor is a collaborator account. billable boolean Whether this activity is billable. doc_id string Document Id. doc_title string Document title. doc_type string Document type. Possible values: document Doc type document. drawing Doc type drawing. folder Doc type folder. form Doc type form. html Doc type HTML. jam Doc type Jam. jpeg Doc type JPEG. mp4 Doc type MP4. mpeg Doc type MPEG. msexcel Doc type MS Excel. mspowerpoint Doc type MS Powerpoint. msword Doc type MS Word. pdf Doc type PDF. png Doc type PNG. presentation Doc type presentation. quicktime Doc type Quicktime. sites Doc type is Google Sites. spreadsheet Doc type spreadsheet. shared_drive Doc type is a shared drive. txt Doc type txt. unknown Doc type unknown. is_encrypted boolean Whether the file is client side encrypted. originating_app_id string The Google Cloud Project ID of the application that performed the action. Use the Drive REST API to retrieve the app title. owner string Email address of the document's owner. For items contained in a Team Drive, the owner is the name of the Team Drive. owner_is_shared_drive boolean Boolean flag denoting whether owner is a shared drive. primary_event boolean Whether this is a primary event. A single user action in Drive may generate several events, multiple of which can be primary (primary_event=true). The remaining events are deemed to be side effects of the primary event(s) (primary_event=false). For example, when a user creates a document, several events are generated, with only the create event having primary_event=true. But when a user shares a document with multiple other users in one action, an access change event having primary_event=true is created for each sharee. Possible values: false Boolean value false. true Boolean value true. shared_drive_id string The unique identifier of the Team Drive. Only populated for for events relating to a Team Drive or item contained inside a Team Drive. visibility string Visibility of Target File. Possible values: people_with_link Anyone with the link can access. people_within_domain_with_link Anyone with the link within the audience can access. private Private. public_in_the_domain Anyone within the audience can access. public_on_the_web Public on the web. shared_externally Shared with explicit users/groups external to the domain. shared_internally Shared with explicit users/groups internal to the domain. unknown Unknown visibility.
Sample request	GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/drive?eventName=download&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format	{actor} downloaded an item

Drive Email as Attachment

Event details
Event name	email_as_attachment
Parameters	actor_is_collaborator_account boolean Whether actor is a collaborator account. billable boolean Whether this activity is billable. doc_id string Document Id. doc_title string Document title. doc_type string Document type. Possible values: document Doc type document. drawing Doc type drawing. folder Doc type folder. form Doc type form. html Doc type HTML. jam Doc type Jam. jpeg Doc type JPEG. mp4 Doc type MP4. mpeg Doc type MPEG. msexcel Doc type MS Excel. mspowerpoint Doc type MS Powerpoint. msword Doc type MS Word. pdf Doc type PDF. png Doc type PNG. presentation Doc type presentation. quicktime Doc type Quicktime. sites Doc type is Google Sites. spreadsheet Doc type spreadsheet. shared_drive Doc type is a shared drive. txt Doc type txt. unknown Doc type unknown. is_encrypted boolean Whether the file is client side encrypted. originating_app_id string The Google Cloud Project ID of the application that performed the action. Use the Drive REST API to retrieve the app title. owner string Email address of the document's owner. For items contained in a Team Drive, the owner is the name of the Team Drive. owner_is_shared_drive boolean Boolean flag denoting whether owner is a shared drive. primary_event boolean Whether this is a primary event. A single user action in Drive may generate several events, multiple of which can be primary (primary_event=true). The remaining events are deemed to be side effects of the primary event(s) (primary_event=false). For example, when a user creates a document, several events are generated, with only the create event having primary_event=true. But when a user shares a document with multiple other users in one action, an access change event having primary_event=true is created for each sharee. Possible values: false Boolean value false. true Boolean value true. target string Target User or Group. shared_drive_id string The unique identifier of the Team Drive. Only populated for for events relating to a Team Drive or item contained inside a Team Drive. visibility string Visibility of Target File. Possible values: people_with_link Anyone with the link can access. people_within_domain_with_link Anyone with the link within the audience can access. private Private. public_in_the_domain Anyone within the audience can access. public_on_the_web Public on the web. shared_externally Shared with explicit users/groups external to the domain. shared_internally Shared with explicit users/groups internal to the domain. unknown Unknown visibility.
Sample request	GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/drive?eventName=email_as_attachment&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format	{actor} shared this document as an email attachment to {target}

Edit

Document edit.

Event details
Event name	edit
Parameters	actor_is_collaborator_account boolean Whether actor is a collaborator account. billable boolean Whether this activity is billable. doc_id string Document Id. doc_title string Document title. doc_type string Document type. Possible values: document Doc type document. drawing Doc type drawing. folder Doc type folder. form Doc type form. html Doc type HTML. jam Doc type Jam. jpeg Doc type JPEG. mp4 Doc type MP4. mpeg Doc type MPEG. msexcel Doc type MS Excel. mspowerpoint Doc type MS Powerpoint. msword Doc type MS Word. pdf Doc type PDF. png Doc type PNG. presentation Doc type presentation. quicktime Doc type Quicktime. sites Doc type is Google Sites. spreadsheet Doc type spreadsheet. shared_drive Doc type is a shared drive. txt Doc type txt. unknown Doc type unknown. is_encrypted boolean Whether the file is client side encrypted. originating_app_id string The Google Cloud Project ID of the application that performed the action. Use the Drive REST API to retrieve the app title. owner string Email address of the document's owner. For items contained in a Team Drive, the owner is the name of the Team Drive. owner_is_shared_drive boolean Boolean flag denoting whether owner is a shared drive. primary_event boolean Whether this is a primary event. A single user action in Drive may generate several events, multiple of which can be primary (primary_event=true). The remaining events are deemed to be side effects of the primary event(s) (primary_event=false). For example, when a user creates a document, several events are generated, with only the create event having primary_event=true. But when a user shares a document with multiple other users in one action, an access change event having primary_event=true is created for each sharee. Possible values: false Boolean value false. true Boolean value true. shared_drive_id string The unique identifier of the Team Drive. Only populated for for events relating to a Team Drive or item contained inside a Team Drive. visibility string Visibility of Target File. Possible values: people_with_link Anyone with the link can access. people_within_domain_with_link Anyone with the link within the audience can access. private Private. public_in_the_domain Anyone within the audience can access. public_on_the_web Public on the web. shared_externally Shared with explicit users/groups external to the domain. shared_internally Shared with explicit users/groups internal to the domain. unknown Unknown visibility.
Sample request	GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/drive?eventName=edit&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format	{actor} edited an item

Label applied

Label was applied.

Event details
Event name	label_added
Parameters	doc_id string Document Id. doc_title string Document title. doc_type string Document type. Possible values: document Doc type document. drawing Doc type drawing. folder Doc type folder. form Doc type form. html Doc type HTML. jam Doc type Jam. jpeg Doc type JPEG. mp4 Doc type MP4. mpeg Doc type MPEG. msexcel Doc type MS Excel. mspowerpoint Doc type MS Powerpoint. msword Doc type MS Word. pdf Doc type PDF. png Doc type PNG. presentation Doc type presentation. quicktime Doc type Quicktime. sites Doc type is Google Sites. spreadsheet Doc type spreadsheet. shared_drive Doc type is a shared drive. txt Doc type txt. unknown Doc type unknown. is_encrypted boolean Whether the file is client side encrypted. label string The unique Identifier of a Label. label_title string Label title. originating_app_id string The Google Cloud Project ID of the application that performed the action. Use the Drive REST API to retrieve the app title. owner string Email address of the document's owner. For items contained in a Team Drive, the owner is the name of the Team Drive. owner_is_shared_drive boolean Boolean flag denoting whether owner is a shared drive. primary_event boolean Whether this is a primary event. A single user action in Drive may generate several events, multiple of which can be primary (primary_event=true). The remaining events are deemed to be side effects of the primary event(s) (primary_event=false). For example, when a user creates a document, several events are generated, with only the create event having primary_event=true. But when a user shares a document with multiple other users in one action, an access change event having primary_event=true is created for each sharee. Possible values: false Boolean value false. true Boolean value true. reason string Reason for label addition, removal, or value change event. Possible values: copy Reason for change Drive item copy. default_label Reason for change default label behavior. dlp_action Reason for change DLP. reason_unspecified Reason for change unspecified. user_action Reason for change is a user action. shared_drive_id string The unique identifier of the Team Drive. Only populated for for events relating to a Team Drive or item contained inside a Team Drive. visibility string Visibility of Target File. Possible values: people_with_link Anyone with the link can access. people_within_domain_with_link Anyone with the link within the audience can access. private Private. public_in_the_domain Anyone within the audience can access. public_on_the_web Public on the web. shared_externally Shared with explicit users/groups external to the domain. shared_internally Shared with explicit users/groups internal to the domain. unknown Unknown visibility.
Sample request	GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/drive?eventName=label_added&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format	{actor} applied Label {label_title}.

Label applied on creation

Label was applied automatically when the Drive item was created.

Event details
Event name	label_added_by_item_create
Parameters	doc_id string Document Id. doc_title string Document title. doc_type string Document type. Possible values: document Doc type document. drawing Doc type drawing. folder Doc type folder. form Doc type form. html Doc type HTML. jam Doc type Jam. jpeg Doc type JPEG. mp4 Doc type MP4. mpeg Doc type MPEG. msexcel Doc type MS Excel. mspowerpoint Doc type MS Powerpoint. msword Doc type MS Word. pdf Doc type PDF. png Doc type PNG. presentation Doc type presentation. quicktime Doc type Quicktime. sites Doc type is Google Sites. spreadsheet Doc type spreadsheet. shared_drive Doc type is a shared drive. txt Doc type txt. unknown Doc type unknown. is_encrypted boolean Whether the file is client side encrypted. label string The unique Identifier of a Label. label_title string Label title. originating_app_id string The Google Cloud Project ID of the application that performed the action. Use the Drive REST API to retrieve the app title. owner string Email address of the document's owner. For items contained in a Team Drive, the owner is the name of the Team Drive. owner_is_shared_drive boolean Boolean flag denoting whether owner is a shared drive. primary_event boolean Whether this is a primary event. A single user action in Drive may generate several events, multiple of which can be primary (primary_event=true). The remaining events are deemed to be side effects of the primary event(s) (primary_event=false). For example, when a user creates a document, several events are generated, with only the create event having primary_event=true. But when a user shares a document with multiple other users in one action, an access change event having primary_event=true is created for each sharee. Possible values: false Boolean value false. true Boolean value true. reason string Reason for label addition, removal, or value change event. Possible values: copy Reason for change Drive item copy. default_label Reason for change default label behavior. dlp_action Reason for change DLP. reason_unspecified Reason for change unspecified. user_action Reason for change is a user action. shared_drive_id string The unique identifier of the Team Drive. Only populated for for events relating to a Team Drive or item contained inside a Team Drive. visibility string Visibility of Target File. Possible values: people_with_link Anyone with the link can access. people_within_domain_with_link Anyone with the link within the audience can access. private Private. public_in_the_domain Anyone within the audience can access. public_on_the_web Public on the web. shared_externally Shared with explicit users/groups external to the domain. shared_internally Shared with explicit users/groups internal to the domain. unknown Unknown visibility.
Sample request	GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/drive?eventName=label_added_by_item_create&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format	Label {label_title} was automatically applied on creation.

Label field value changed

Label Field value was changed.

Event details
Event name	label_field_changed
Parameters	doc_id string Document Id. doc_title string Document title. doc_type string Document type. Possible values: document Doc type document. drawing Doc type drawing. folder Doc type folder. form Doc type form. html Doc type HTML. jam Doc type Jam. jpeg Doc type JPEG. mp4 Doc type MP4. mpeg Doc type MPEG. msexcel Doc type MS Excel. mspowerpoint Doc type MS Powerpoint. msword Doc type MS Word. pdf Doc type PDF. png Doc type PNG. presentation Doc type presentation. quicktime Doc type Quicktime. sites Doc type is Google Sites. spreadsheet Doc type spreadsheet. shared_drive Doc type is a shared drive. txt Doc type txt. unknown Doc type unknown. field string Label Field display name. field_id string Label Field ID. is_encrypted boolean Whether the file is client side encrypted. label string The unique Identifier of a Label. label_title string Label title. new_value string New Value. new_value_id string New Value IDs. old_value string Old Value. old_value_id string Old Value IDs. originating_app_id string The Google Cloud Project ID of the application that performed the action. Use the Drive REST API to retrieve the app title. owner string Email address of the document's owner. For items contained in a Team Drive, the owner is the name of the Team Drive. owner_is_shared_drive boolean Boolean flag denoting whether owner is a shared drive. primary_event boolean Whether this is a primary event. A single user action in Drive may generate several events, multiple of which can be primary (primary_event=true). The remaining events are deemed to be side effects of the primary event(s) (primary_event=false). For example, when a user creates a document, several events are generated, with only the create event having primary_event=true. But when a user shares a document with multiple other users in one action, an access change event having primary_event=true is created for each sharee. Possible values: false Boolean value false. true Boolean value true. reason string Reason for label addition, removal, or value change event. Possible values: copy Reason for change Drive item copy. default_label Reason for change default label behavior. dlp_action Reason for change DLP. reason_unspecified Reason for change unspecified. user_action Reason for change is a user action. shared_drive_id string The unique identifier of the Team Drive. Only populated for for events relating to a Team Drive or item contained inside a Team Drive. visibility string Visibility of Target File. Possible values: people_with_link Anyone with the link can access. people_within_domain_with_link Anyone with the link within the audience can access. private Private. public_in_the_domain Anyone within the audience can access. public_on_the_web Public on the web. shared_externally Shared with explicit users/groups external to the domain. shared_internally Shared with explicit users/groups internal to the domain. unknown Unknown visibility.
Sample request	GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/drive?eventName=label_field_changed&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format	{actor} changed the value of field {field} (Label: {label_title}) from '{old_value}' to '{new_value}'.

Label removed

Label was removed.

Event details
Event name	label_removed
Parameters	doc_id string Document Id. doc_title string Document title. doc_type string Document type. Possible values: document Doc type document. drawing Doc type drawing. folder Doc type folder. form Doc type form. html Doc type HTML. jam Doc type Jam. jpeg Doc type JPEG. mp4 Doc type MP4. mpeg Doc type MPEG. msexcel Doc type MS Excel. mspowerpoint Doc type MS Powerpoint. msword Doc type MS Word. pdf Doc type PDF. png Doc type PNG. presentation Doc type presentation. quicktime Doc type Quicktime. sites Doc type is Google Sites. spreadsheet Doc type spreadsheet. shared_drive Doc type is a shared drive. txt Doc type txt. unknown Doc type unknown. is_encrypted boolean Whether the file is client side encrypted. label string The unique Identifier of a Label. label_title string Label title. originating_app_id string The Google Cloud Project ID of the application that performed the action. Use the Drive REST API to retrieve the app title. owner string Email address of the document's owner. For items contained in a Team Drive, the owner is the name of the Team Drive. owner_is_shared_drive boolean Boolean flag denoting whether owner is a shared drive. primary_event boolean Whether this is a primary event. A single user action in Drive may generate several events, multiple of which can be primary (primary_event=true). The remaining events are deemed to be side effects of the primary event(s) (primary_event=false). For example, when a user creates a document, several events are generated, with only the create event having primary_event=true. But when a user shares a document with multiple other users in one action, an access change event having primary_event=true is created for each sharee. Possible values: false Boolean value false. true Boolean value true. reason string Reason for label addition, removal, or value change event. Possible values: copy Reason for change Drive item copy. default_label Reason for change default label behavior. dlp_action Reason for change DLP. reason_unspecified Reason for change unspecified. user_action Reason for change is a user action. shared_drive_id string The unique identifier of the Team Drive. Only populated for for events relating to a Team Drive or item contained inside a Team Drive. visibility string Visibility of Target File. Possible values: people_with_link Anyone with the link can access. people_within_domain_with_link Anyone with the link within the audience can access. private Private. public_in_the_domain Anyone within the audience can access. public_on_the_web Public on the web. shared_externally Shared with explicit users/groups external to the domain. shared_internally Shared with explicit users/groups internal to the domain. unknown Unknown visibility.
Sample request	GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/drive?eventName=label_removed&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format	{actor} removed Label {label_title}.

Lock

Document lock.

Event details
Event name	add_lock
Parameters	actor_is_collaborator_account boolean Whether actor is a collaborator account. billable boolean Whether this activity is billable. doc_id string Document Id. doc_title string Document title. doc_type string Document type. Possible values: document Doc type document. drawing Doc type drawing. folder Doc type folder. form Doc type form. html Doc type HTML. jam Doc type Jam. jpeg Doc type JPEG. mp4 Doc type MP4. mpeg Doc type MPEG. msexcel Doc type MS Excel. mspowerpoint Doc type MS Powerpoint. msword Doc type MS Word. pdf Doc type PDF. png Doc type PNG. presentation Doc type presentation. quicktime Doc type Quicktime. sites Doc type is Google Sites. spreadsheet Doc type spreadsheet. shared_drive Doc type is a shared drive. txt Doc type txt. unknown Doc type unknown. is_encrypted boolean Whether the file is client side encrypted. originating_app_id string The Google Cloud Project ID of the application that performed the action. Use the Drive REST API to retrieve the app title. owner string Email address of the document's owner. For items contained in a Team Drive, the owner is the name of the Team Drive. owner_is_shared_drive boolean Boolean flag denoting whether owner is a shared drive. primary_event boolean Whether this is a primary event. A single user action in Drive may generate several events, multiple of which can be primary (primary_event=true). The remaining events are deemed to be side effects of the primary event(s) (primary_event=false). For example, when a user creates a document, several events are generated, with only the create event having primary_event=true. But when a user shares a document with multiple other users in one action, an access change event having primary_event=true is created for each sharee. Possible values: false Boolean value false. true Boolean value true. shared_drive_id string The unique identifier of the Team Drive. Only populated for for events relating to a Team Drive or item contained inside a Team Drive. visibility string Visibility of Target File. Possible values: people_with_link Anyone with the link can access. people_within_domain_with_link Anyone with the link within the audience can access. private Private. public_in_the_domain Anyone within the audience can access. public_on_the_web Public on the web. shared_externally Shared with explicit users/groups external to the domain. shared_internally Shared with explicit users/groups internal to the domain. unknown Unknown visibility.
Sample request	GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/drive?eventName=add_lock&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format	{actor} locked an item

Move

Document move.

Event details
Event name	move
Parameters	actor_is_collaborator_account boolean Whether actor is a collaborator account. billable boolean Whether this activity is billable. destination_folder_id string Destination folder Id. destination_folder_title string Destination folder title. doc_id string Document Id. doc_title string Document title. doc_type string Document type. Possible values: document Doc type document. drawing Doc type drawing. folder Doc type folder. form Doc type form. html Doc type HTML. jam Doc type Jam. jpeg Doc type JPEG. mp4 Doc type MP4. mpeg Doc type MPEG. msexcel Doc type MS Excel. mspowerpoint Doc type MS Powerpoint. msword Doc type MS Word. pdf Doc type PDF. png Doc type PNG. presentation Doc type presentation. quicktime Doc type Quicktime. sites Doc type is Google Sites. spreadsheet Doc type spreadsheet. shared_drive Doc type is a shared drive. txt Doc type txt. unknown Doc type unknown. is_encrypted boolean Whether the file is client side encrypted. originating_app_id string The Google Cloud Project ID of the application that performed the action. Use the Drive REST API to retrieve the app title. owner string Email address of the document's owner. For items contained in a Team Drive, the owner is the name of the Team Drive. owner_is_shared_drive boolean Boolean flag denoting whether owner is a shared drive. primary_event boolean Whether this is a primary event. A single user action in Drive may generate several events, multiple of which can be primary (primary_event=true). The remaining events are deemed to be side effects of the primary event(s) (primary_event=false). For example, when a user creates a document, several events are generated, with only the create event having primary_event=true. But when a user shares a document with multiple other users in one action, an access change event having primary_event=true is created for each sharee. Possible values: false Boolean value false. true Boolean value true. source_folder_id string Source folder Id. source_folder_title string Source folder title. shared_drive_id string The unique identifier of the Team Drive. Only populated for for events relating to a Team Drive or item contained inside a Team Drive. visibility string Visibility of Target File. Possible values: people_with_link Anyone with the link can access. people_within_domain_with_link Anyone with the link within the audience can access. private Private. public_in_the_domain Anyone within the audience can access. public_on_the_web Public on the web. shared_externally Shared with explicit users/groups external to the domain. shared_internally Shared with explicit users/groups internal to the domain. unknown Unknown visibility.
Sample request	GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/drive?eventName=move&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format	{actor} moved an item from {source_folder_title} to {destination_folder_title}

Preview

Document preview.

Event details
Event name	preview
Parameters	actor_is_collaborator_account boolean Whether actor is a collaborator account. billable boolean Whether this activity is billable. doc_id string Document Id. doc_title string Document title. doc_type string Document type. Possible values: document Doc type document. drawing Doc type drawing. folder Doc type folder. form Doc type form. html Doc type HTML. jam Doc type Jam. jpeg Doc type JPEG. mp4 Doc type MP4. mpeg Doc type MPEG. msexcel Doc type MS Excel. mspowerpoint Doc type MS Powerpoint. msword Doc type MS Word. pdf Doc type PDF. png Doc type PNG. presentation Doc type presentation. quicktime Doc type Quicktime. sites Doc type is Google Sites. spreadsheet Doc type spreadsheet. shared_drive Doc type is a shared drive. txt Doc type txt. unknown Doc type unknown. is_encrypted boolean Whether the file is client side encrypted. originating_app_id string The Google Cloud Project ID of the application that performed the action. Use the Drive REST API to retrieve the app title. owner string Email address of the document's owner. For items contained in a Team Drive, the owner is the name of the Team Drive. owner_is_shared_drive boolean Boolean flag denoting whether owner is a shared drive. primary_event boolean Whether this is a primary event. A single user action in Drive may generate several events, multiple of which can be primary (primary_event=true). The remaining events are deemed to be side effects of the primary event(s) (primary_event=false). For example, when a user creates a document, several events are generated, with only the create event having primary_event=true. But when a user shares a document with multiple other users in one action, an access change event having primary_event=true is created for each sharee. Possible values: false Boolean value false. true Boolean value true. shared_drive_id string The unique identifier of the Team Drive. Only populated for for events relating to a Team Drive or item contained inside a Team Drive. visibility string Visibility of Target File. Possible values: people_with_link Anyone with the link can access. people_within_domain_with_link Anyone with the link within the audience can access. private Private. public_in_the_domain Anyone within the audience can access. public_on_the_web Public on the web. shared_externally Shared with explicit users/groups external to the domain. shared_internally Shared with explicit users/groups internal to the domain. unknown Unknown visibility.
Sample request	GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/drive?eventName=preview&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format	{actor} previewed an item

Print

Document print.

Event details
Event name	print
Parameters	actor_is_collaborator_account boolean Whether actor is a collaborator account. billable boolean Whether this activity is billable. doc_id string Document Id. doc_title string Document title. doc_type string Document type. Possible values: document Doc type document. drawing Doc type drawing. folder Doc type folder. form Doc type form. html Doc type HTML. jam Doc type Jam. jpeg Doc type JPEG. mp4 Doc type MP4. mpeg Doc type MPEG. msexcel Doc type MS Excel. mspowerpoint Doc type MS Powerpoint. msword Doc type MS Word. pdf Doc type PDF. png Doc type PNG. presentation Doc type presentation. quicktime Doc type Quicktime. sites Doc type is Google Sites. spreadsheet Doc type spreadsheet. shared_drive Doc type is a shared drive. txt Doc type txt. unknown Doc type unknown. is_encrypted boolean Whether the file is client side encrypted. originating_app_id string The Google Cloud Project ID of the application that performed the action. Use the Drive REST API to retrieve the app title. owner string Email address of the document's owner. For items contained in a Team Drive, the owner is the name of the Team Drive. owner_is_shared_drive boolean Boolean flag denoting whether owner is a shared drive. primary_event boolean Whether this is a primary event. A single user action in Drive may generate several events, multiple of which can be primary (primary_event=true). The remaining events are deemed to be side effects of the primary event(s) (primary_event=false). For example, when a user creates a document, several events are generated, with only the create event having primary_event=true. But when a user shares a document with multiple other users in one action, an access change event having primary_event=true is created for each sharee. Possible values: false Boolean value false. true Boolean value true. shared_drive_id string The unique identifier of the Team Drive. Only populated for for events relating to a Team Drive or item contained inside a Team Drive. visibility string Visibility of Target File. Possible values: people_with_link Anyone with the link can access. people_within_domain_with_link Anyone with the link within the audience can access. private Private. public_in_the_domain Anyone within the audience can access. public_on_the_web Public on the web. shared_externally Shared with explicit users/groups external to the domain. shared_internally Shared with explicit users/groups internal to the domain. unknown Unknown visibility.
Sample request	GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/drive?eventName=print&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format	{actor} printed an item

Remove from folder

Document remove from folder.

Event details
Event name	remove_from_folder
Parameters	actor_is_collaborator_account boolean Whether actor is a collaborator account. billable boolean Whether this activity is billable. doc_id string Document Id. doc_title string Document title. doc_type string Document type. Possible values: document Doc type document. drawing Doc type drawing. folder Doc type folder. form Doc type form. html Doc type HTML. jam Doc type Jam. jpeg Doc type JPEG. mp4 Doc type MP4. mpeg Doc type MPEG. msexcel Doc type MS Excel. mspowerpoint Doc type MS Powerpoint. msword Doc type MS Word. pdf Doc type PDF. png Doc type PNG. presentation Doc type presentation. quicktime Doc type Quicktime. sites Doc type is Google Sites. spreadsheet Doc type spreadsheet. shared_drive Doc type is a shared drive. txt Doc type txt. unknown Doc type unknown. is_encrypted boolean Whether the file is client side encrypted. originating_app_id string The Google Cloud Project ID of the application that performed the action. Use the Drive REST API to retrieve the app title. owner string Email address of the document's owner. For items contained in a Team Drive, the owner is the name of the Team Drive. owner_is_shared_drive boolean Boolean flag denoting whether owner is a shared drive. primary_event boolean Whether this is a primary event. A single user action in Drive may generate several events, multiple of which can be primary (primary_event=true). The remaining events are deemed to be side effects of the primary event(s) (primary_event=false). For example, when a user creates a document, several events are generated, with only the create event having primary_event=true. But when a user shares a document with multiple other users in one action, an access change event having primary_event=true is created for each sharee. Possible values: false Boolean value false. true Boolean value true. source_folder_id string Source folder Id. source_folder_title string Source folder title. shared_drive_id string The unique identifier of the Team Drive. Only populated for for events relating to a Team Drive or item contained inside a Team Drive. visibility string Visibility of Target File. Possible values: people_with_link Anyone with the link can access. people_within_domain_with_link Anyone with the link within the audience can access. private Private. public_in_the_domain Anyone within the audience can access. public_on_the_web Public on the web. shared_externally Shared with explicit users/groups external to the domain. shared_internally Shared with explicit users/groups internal to the domain. unknown Unknown visibility.
Sample request	GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/drive?eventName=remove_from_folder&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format	{actor} removed an item from {source_folder_title}

Rename

Document rename.

Event details
Event name	rename
Parameters	actor_is_collaborator_account boolean Whether actor is a collaborator account. billable boolean Whether this activity is billable. doc_id string Document Id. doc_title string Document title. doc_type string Document type. Possible values: document Doc type document. drawing Doc type drawing. folder Doc type folder. form Doc type form. html Doc type HTML. jam Doc type Jam. jpeg Doc type JPEG. mp4 Doc type MP4. mpeg Doc type MPEG. msexcel Doc type MS Excel. mspowerpoint Doc type MS Powerpoint. msword Doc type MS Word. pdf Doc type PDF. png Doc type PNG. presentation Doc type presentation. quicktime Doc type Quicktime. sites Doc type is Google Sites. spreadsheet Doc type spreadsheet. shared_drive Doc type is a shared drive. txt Doc type txt. unknown Doc type unknown. is_encrypted boolean Whether the file is client side encrypted. new_value string New Value. old_value string Old Value. originating_app_id string The Google Cloud Project ID of the application that performed the action. Use the Drive REST API to retrieve the app title. owner string Email address of the document's owner. For items contained in a Team Drive, the owner is the name of the Team Drive. owner_is_shared_drive boolean Boolean flag denoting whether owner is a shared drive. primary_event boolean Whether this is a primary event. A single user action in Drive may generate several events, multiple of which can be primary (primary_event=true). The remaining events are deemed to be side effects of the primary event(s) (primary_event=false). For example, when a user creates a document, several events are generated, with only the create event having primary_event=true. But when a user shares a document with multiple other users in one action, an access change event having primary_event=true is created for each sharee. Possible values: false Boolean value false. true Boolean value true. shared_drive_id string The unique identifier of the Team Drive. Only populated for for events relating to a Team Drive or item contained inside a Team Drive. visibility string Visibility of Target File. Possible values: people_with_link Anyone with the link can access. people_within_domain_with_link Anyone with the link within the audience can access. private Private. public_in_the_domain Anyone within the audience can access. public_on_the_web Public on the web. shared_externally Shared with explicit users/groups external to the domain. shared_internally Shared with explicit users/groups internal to the domain. unknown Unknown visibility.
Sample request	GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/drive?eventName=rename&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format	{actor} renamed {old_value} to {new_value}

Restore

Document restore.

Event details
Event name	untrash
Parameters	actor_is_collaborator_account boolean Whether actor is a collaborator account. billable boolean Whether this activity is billable. doc_id string Document Id. doc_title string Document title. doc_type string Document type. Possible values: document Doc type document. drawing Doc type drawing. folder Doc type folder. form Doc type form. html Doc type HTML. jam Doc type Jam. jpeg Doc type JPEG. mp4 Doc type MP4. mpeg Doc type MPEG. msexcel Doc type MS Excel. mspowerpoint Doc type MS Powerpoint. msword Doc type MS Word. pdf Doc type PDF. png Doc type PNG. presentation Doc type presentation. quicktime Doc type Quicktime. sites Doc type is Google Sites. spreadsheet Doc type spreadsheet. shared_drive Doc type is a shared drive. txt Doc type txt. unknown Doc type unknown. is_encrypted boolean Whether the file is client side encrypted. originating_app_id string The Google Cloud Project ID of the application that performed the action. Use the Drive REST API to retrieve the app title. owner string Email address of the document's owner. For items contained in a Team Drive, the owner is the name of the Team Drive. owner_is_shared_drive boolean Boolean flag denoting whether owner is a shared drive. primary_event boolean Whether this is a primary event. A single user action in Drive may generate several events, multiple of which can be primary (primary_event=true). The remaining events are deemed to be side effects of the primary event(s) (primary_event=false). For example, when a user creates a document, several events are generated, with only the create event having primary_event=true. But when a user shares a document with multiple other users in one action, an access change event having primary_event=true is created for each sharee. Possible values: false Boolean value false. true Boolean value true. shared_drive_id string The unique identifier of the Team Drive. Only populated for for events relating to a Team Drive or item contained inside a Team Drive. visibility string Visibility of Target File. Possible values: people_with_link Anyone with the link can access. people_within_domain_with_link Anyone with the link within the audience can access. private Private. public_in_the_domain Anyone within the audience can access. public_on_the_web Public on the web. shared_externally Shared with explicit users/groups external to the domain. shared_internally Shared with explicit users/groups internal to the domain. unknown Unknown visibility.
Sample request	GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/drive?eventName=untrash&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format	{actor} restored an item

Sheets ImportRange

Event details
Event name	sheets_import_range
Parameters	doc_id string Document Id. doc_title string Document title. doc_type string Document type. is_encrypted boolean Whether the file is client side encrypted. originating_app_id string The Google Cloud Project ID of the application that performed the action. Use the Drive REST API to retrieve the app title. owner string Email address of the document's owner. For items contained in a Team Drive, the owner is the name of the Team Drive. owner_is_shared_drive boolean Boolean flag denoting whether owner is a shared drive. primary_event boolean Whether this is a primary event. A single user action in Drive may generate several events, multiple of which can be primary (primary_event=true). The remaining events are deemed to be side effects of the primary event(s) (primary_event=false). For example, when a user creates a document, several events are generated, with only the create event having primary_event=true. But when a user shares a document with multiple other users in one action, an access change event having primary_event=true is created for each sharee. sheets_import_range_recipient_doc string Sheets ImportRange recipient doc. shared_drive_id string The unique identifier of the Team Drive. Only populated for for events relating to a Team Drive or item contained inside a Team Drive. visibility string Visibility of Target File. Possible values: people_with_link Anyone with the link can access. people_within_domain_with_link Anyone with the link within the audience can access. private Private. public_in_the_domain Anyone within the audience can access. public_on_the_web Public on the web. shared_externally Shared with explicit users/groups external to the domain. shared_internally Shared with explicit users/groups internal to the domain. unknown Unknown visibility.
Sample request	GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/drive?eventName=sheets_import_range&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format	{sheets_import_range_recipient_doc} imported range from an item

Trash

Document trash.

Event details
Event name	trash
Parameters	actor_is_collaborator_account boolean Whether actor is a collaborator account. billable boolean Whether this activity is billable. doc_id string Document Id. doc_title string Document title. doc_type string Document type. Possible values: document Doc type document. drawing Doc type drawing. folder Doc type folder. form Doc type form. html Doc type HTML. jam Doc type Jam. jpeg Doc type JPEG. mp4 Doc type MP4. mpeg Doc type MPEG. msexcel Doc type MS Excel. mspowerpoint Doc type MS Powerpoint. msword Doc type MS Word. pdf Doc type PDF. png Doc type PNG. presentation Doc type presentation. quicktime Doc type Quicktime. sites Doc type is Google Sites. spreadsheet Doc type spreadsheet. shared_drive Doc type is a shared drive. txt Doc type txt. unknown Doc type unknown. is_encrypted boolean Whether the file is client side encrypted. originating_app_id string The Google Cloud Project ID of the application that performed the action. Use the Drive REST API to retrieve the app title. owner string Email address of the document's owner. For items contained in a Team Drive, the owner is the name of the Team Drive. owner_is_shared_drive boolean Boolean flag denoting whether owner is a shared drive. primary_event boolean Whether this is a primary event. A single user action in Drive may generate several events, multiple of which can be primary (primary_event=true). The remaining events are deemed to be side effects of the primary event(s) (primary_event=false). For example, when a user creates a document, several events are generated, with only the create event having primary_event=true. But when a user shares a document with multiple other users in one action, an access change event having primary_event=true is created for each sharee. Possible values: false Boolean value false. true Boolean value true. shared_drive_id string The unique identifier of the Team Drive. Only populated for for events relating to a Team Drive or item contained inside a Team Drive. visibility string Visibility of Target File. Possible values: people_with_link Anyone with the link can access. people_within_domain_with_link Anyone with the link within the audience can access. private Private. public_in_the_domain Anyone within the audience can access. public_on_the_web Public on the web. shared_externally Shared with explicit users/groups external to the domain. shared_internally Shared with explicit users/groups internal to the domain. unknown Unknown visibility.
Sample request	GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/drive?eventName=trash&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format	{actor} trashed an item

Unlock

Document unlock.

Event details
Event name	remove_lock
Parameters	actor_is_collaborator_account boolean Whether actor is a collaborator account. billable boolean Whether this activity is billable. doc_id string Document Id. doc_title string Document title. doc_type string Document type. Possible values: document Doc type document. drawing Doc type drawing. folder Doc type folder. form Doc type form. html Doc type HTML. jam Doc type Jam. jpeg Doc type JPEG. mp4 Doc type MP4. mpeg Doc type MPEG. msexcel Doc type MS Excel. mspowerpoint Doc type MS Powerpoint. msword Doc type MS Word. pdf Doc type PDF. png Doc type PNG. presentation Doc type presentation. quicktime Doc type Quicktime. sites Doc type is Google Sites. spreadsheet Doc type spreadsheet. shared_drive Doc type is a shared drive. txt Doc type txt. unknown Doc type unknown. is_encrypted boolean Whether the file is client side encrypted. originating_app_id string The Google Cloud Project ID of the application that performed the action. Use the Drive REST API to retrieve the app title. owner string Email address of the document's owner. For items contained in a Team Drive, the owner is the name of the Team Drive. owner_is_shared_drive boolean Boolean flag denoting whether owner is a shared drive. primary_event boolean Whether this is a primary event. A single user action in Drive may generate several events, multiple of which can be primary (primary_event=true). The remaining events are deemed to be side effects of the primary event(s) (primary_event=false). For example, when a user creates a document, several events are generated, with only the create event having primary_event=true. But when a user shares a document with multiple other users in one action, an access change event having primary_event=true is created for each sharee. Possible values: false Boolean value false. true Boolean value true. shared_drive_id string The unique identifier of the Team Drive. Only populated for for events relating to a Team Drive or item contained inside a Team Drive. visibility string Visibility of Target File. Possible values: people_with_link Anyone with the link can access. people_within_domain_with_link Anyone with the link within the audience can access. private Private. public_in_the_domain Anyone within the audience can access. public_on_the_web Public on the web. shared_externally Shared with explicit users/groups external to the domain. shared_internally Shared with explicit users/groups internal to the domain. unknown Unknown visibility.
Sample request	GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/drive?eventName=remove_lock&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format	{actor} unlocked an item

Upload

Document upload.

Event details
Event name	upload
Parameters	actor_is_collaborator_account boolean Whether actor is a collaborator account. billable boolean Whether this activity is billable. doc_id string Document Id. doc_title string Document title. doc_type string Document type. Possible values: document Doc type document. drawing Doc type drawing. folder Doc type folder. form Doc type form. html Doc type HTML. jam Doc type Jam. jpeg Doc type JPEG. mp4 Doc type MP4. mpeg Doc type MPEG. msexcel Doc type MS Excel. mspowerpoint Doc type MS Powerpoint. msword Doc type MS Word. pdf Doc type PDF. png Doc type PNG. presentation Doc type presentation. quicktime Doc type Quicktime. sites Doc type is Google Sites. spreadsheet Doc type spreadsheet. shared_drive Doc type is a shared drive. txt Doc type txt. unknown Doc type unknown. is_encrypted boolean Whether the file is client side encrypted. originating_app_id string The Google Cloud Project ID of the application that performed the action. Use the Drive REST API to retrieve the app title. owner string Email address of the document's owner. For items contained in a Team Drive, the owner is the name of the Team Drive. owner_is_shared_drive boolean Boolean flag denoting whether owner is a shared drive. primary_event boolean Whether this is a primary event. A single user action in Drive may generate several events, multiple of which can be primary (primary_event=true). The remaining events are deemed to be side effects of the primary event(s) (primary_event=false). For example, when a user creates a document, several events are generated, with only the create event having primary_event=true. But when a user shares a document with multiple other users in one action, an access change event having primary_event=true is created for each sharee. Possible values: false Boolean value false. true Boolean value true. shared_drive_id string The unique identifier of the Team Drive. Only populated for for events relating to a Team Drive or item contained inside a Team Drive. visibility string Visibility of Target File. Possible values: people_with_link Anyone with the link can access. people_within_domain_with_link Anyone with the link within the audience can access. private Private. public_in_the_domain Anyone within the audience can access. public_on_the_web Public on the web. shared_externally Shared with explicit users/groups external to the domain. shared_internally Shared with explicit users/groups internal to the domain. unknown Unknown visibility.
Sample request	GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/drive?eventName=upload&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format	{actor} uploaded an item

View

Document view.

Event details
Event name	view
Parameters	actor_is_collaborator_account boolean Whether actor is a collaborator account. billable boolean Whether this activity is billable. doc_id string Document Id. doc_title string Document title. doc_type string Document type. Possible values: document Doc type document. drawing Doc type drawing. folder Doc type folder. form Doc type form. html Doc type HTML. jam Doc type Jam. jpeg Doc type JPEG. mp4 Doc type MP4. mpeg Doc type MPEG. msexcel Doc type MS Excel. mspowerpoint Doc type MS Powerpoint. msword Doc type MS Word. pdf Doc type PDF. png Doc type PNG. presentation Doc type presentation. quicktime Doc type Quicktime. sites Doc type is Google Sites. spreadsheet Doc type spreadsheet. shared_drive Doc type is a shared drive. txt Doc type txt. unknown Doc type unknown. is_encrypted boolean Whether the file is client side encrypted. originating_app_id string The Google Cloud Project ID of the application that performed the action. Use the Drive REST API to retrieve the app title. owner string Email address of the document's owner. For items contained in a Team Drive, the owner is the name of the Team Drive. owner_is_shared_drive boolean Boolean flag denoting whether owner is a shared drive. primary_event boolean Whether this is a primary event. A single user action in Drive may generate several events, multiple of which can be primary (primary_event=true). The remaining events are deemed to be side effects of the primary event(s) (primary_event=false). For example, when a user creates a document, several events are generated, with only the create event having primary_event=true. But when a user shares a document with multiple other users in one action, an access change event having primary_event=true is created for each sharee. Possible values: false Boolean value false. true Boolean value true. shared_drive_id string The unique identifier of the Team Drive. Only populated for for events relating to a Team Drive or item contained inside a Team Drive. visibility string Visibility of Target File. Possible values: people_with_link Anyone with the link can access. people_within_domain_with_link Anyone with the link within the audience can access. private Private. public_in_the_domain Anyone within the audience can access. public_on_the_web Public on the web. shared_externally Shared with explicit users/groups external to the domain. shared_internally Shared with explicit users/groups internal to the domain. unknown Unknown visibility.
Sample request	GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/drive?eventName=view&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format	{actor} viewed an item

ACL changed

ACL Changed. Events of this type are returned with type=acl_change.

Apply Security Update

Document apply security update.

Event details
Event name	apply_security_update
Parameters	actor_is_collaborator_account boolean Whether actor is a collaborator account. billable boolean Whether this activity is billable. doc_id string Document Id. doc_title string Document title. doc_type string Document type. Possible values: document Doc type document. drawing Doc type drawing. folder Doc type folder. form Doc type form. html Doc type HTML. jam Doc type Jam. jpeg Doc type JPEG. mp4 Doc type MP4. mpeg Doc type MPEG. msexcel Doc type MS Excel. mspowerpoint Doc type MS Powerpoint. msword Doc type MS Word. pdf Doc type PDF. png Doc type PNG. presentation Doc type presentation. quicktime Doc type Quicktime. sites Doc type is Google Sites. spreadsheet Doc type spreadsheet. shared_drive Doc type is a shared drive. txt Doc type txt. unknown Doc type unknown. is_encrypted boolean Whether the file is client side encrypted. originating_app_id string The Google Cloud Project ID of the application that performed the action. Use the Drive REST API to retrieve the app title. owner string Email address of the document's owner. For items contained in a Team Drive, the owner is the name of the Team Drive. owner_is_shared_drive boolean Boolean flag denoting whether owner is a shared drive. primary_event boolean Whether this is a primary event. A single user action in Drive may generate several events, multiple of which can be primary (primary_event=true). The remaining events are deemed to be side effects of the primary event(s) (primary_event=false). For example, when a user creates a document, several events are generated, with only the create event having primary_event=true. But when a user shares a document with multiple other users in one action, an access change event having primary_event=true is created for each sharee. Possible values: false Boolean value false. true Boolean value true. shared_drive_id string The unique identifier of the Team Drive. Only populated for for events relating to a Team Drive or item contained inside a Team Drive. visibility string Visibility of Target File. Possible values: people_with_link Anyone with the link can access. people_within_domain_with_link Anyone with the link within the audience can access. private Private. public_in_the_domain Anyone within the audience can access. public_on_the_web Public on the web. shared_externally Shared with explicit users/groups external to the domain. shared_internally Shared with explicit users/groups internal to the domain. unknown Unknown visibility.
Sample request	GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/drive?eventName=apply_security_update&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format	{actor} applied the security update to a file

Bulk Apply Security Update

Bulk apply security update.

Event details
Event name	shared_drive_apply_security_update
Parameters	actor_is_collaborator_account boolean Whether actor is a collaborator account. billable boolean Whether this activity is billable. doc_id string Document Id. doc_title string Document title. doc_type string Document type. Possible values: document Doc type document. drawing Doc type drawing. folder Doc type folder. form Doc type form. html Doc type HTML. jam Doc type Jam. jpeg Doc type JPEG. mp4 Doc type MP4. mpeg Doc type MPEG. msexcel Doc type MS Excel. mspowerpoint Doc type MS Powerpoint. msword Doc type MS Word. pdf Doc type PDF. png Doc type PNG. presentation Doc type presentation. quicktime Doc type Quicktime. sites Doc type is Google Sites. spreadsheet Doc type spreadsheet. shared_drive Doc type is a shared drive. txt Doc type txt. unknown Doc type unknown. is_encrypted boolean Whether the file is client side encrypted. originating_app_id string The Google Cloud Project ID of the application that performed the action. Use the Drive REST API to retrieve the app title. owner string Email address of the document's owner. For items contained in a Team Drive, the owner is the name of the Team Drive. owner_is_shared_drive boolean Boolean flag denoting whether owner is a shared drive. primary_event boolean Whether this is a primary event. A single user action in Drive may generate several events, multiple of which can be primary (primary_event=true). The remaining events are deemed to be side effects of the primary event(s) (primary_event=false). For example, when a user creates a document, several events are generated, with only the create event having primary_event=true. But when a user shares a document with multiple other users in one action, an access change event having primary_event=true is created for each sharee. Possible values: false Boolean value false. true Boolean value true. shared_drive_id string The unique identifier of the Team Drive. Only populated for for events relating to a Team Drive or item contained inside a Team Drive. visibility string Visibility of Target File. Possible values: people_with_link Anyone with the link can access. people_within_domain_with_link Anyone with the link within the audience can access. private Private. public_in_the_domain Anyone within the audience can access. public_on_the_web Public on the web. shared_externally Shared with explicit users/groups external to the domain. shared_internally Shared with explicit users/groups internal to the domain. unknown Unknown visibility.
Sample request	GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/drive?eventName=shared_drive_apply_security_update&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format	{actor} applied the security update to all files in a shared drive

Bulk Remove Security Update

Bulk remove security update.

Event details
Event name	shared_drive_remove_security_update
Parameters	actor_is_collaborator_account boolean Whether actor is a collaborator account. billable boolean Whether this activity is billable. doc_id string Document Id. doc_title string Document title. doc_type string Document type. Possible values: document Doc type document. drawing Doc type drawing. folder Doc type folder. form Doc type form. html Doc type HTML. jam Doc type Jam. jpeg Doc type JPEG. mp4 Doc type MP4. mpeg Doc type MPEG. msexcel Doc type MS Excel. mspowerpoint Doc type MS Powerpoint. msword Doc type MS Word. pdf Doc type PDF. png Doc type PNG. presentation Doc type presentation. quicktime Doc type Quicktime. sites Doc type is Google Sites. spreadsheet Doc type spreadsheet. shared_drive Doc type is a shared drive. txt Doc type txt. unknown Doc type unknown. is_encrypted boolean Whether the file is client side encrypted. originating_app_id string The Google Cloud Project ID of the application that performed the action. Use the Drive REST API to retrieve the app title. owner string Email address of the document's owner. For items contained in a Team Drive, the owner is the name of the Team Drive. owner_is_shared_drive boolean Boolean flag denoting whether owner is a shared drive. primary_event boolean Whether this is a primary event. A single user action in Drive may generate several events, multiple of which can be primary (primary_event=true). The remaining events are deemed to be side effects of the primary event(s) (primary_event=false). For example, when a user creates a document, several events are generated, with only the create event having primary_event=true. But when a user shares a document with multiple other users in one action, an access change event having primary_event=true is created for each sharee. Possible values: false Boolean value false. true Boolean value true. shared_drive_id string The unique identifier of the Team Drive. Only populated for for events relating to a Team Drive or item contained inside a Team Drive. visibility string Visibility of Target File. Possible values: people_with_link Anyone with the link can access. people_within_domain_with_link Anyone with the link within the audience can access. private Private. public_in_the_domain Anyone within the audience can access. public_on_the_web Public on the web. shared_externally Shared with explicit users/groups external to the domain. shared_internally Shared with explicit users/groups internal to the domain. unknown Unknown visibility.
Sample request	GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/drive?eventName=shared_drive_remove_security_update&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format	{actor} removed the security update from all files in a shared drive

Drive Publish Status Change

Event details
Event name	publish_change
Parameters	actor_is_collaborator_account boolean Whether actor is a collaborator account. billable boolean Whether this activity is billable. doc_id string Document Id. doc_title string Document title. doc_type string Document type. Possible values: document Doc type document. drawing Doc type drawing. folder Doc type folder. form Doc type form. html Doc type HTML. jam Doc type Jam. jpeg Doc type JPEG. mp4 Doc type MP4. mpeg Doc type MPEG. msexcel Doc type MS Excel. mspowerpoint Doc type MS Powerpoint. msword Doc type MS Word. pdf Doc type PDF. png Doc type PNG. presentation Doc type presentation. quicktime Doc type Quicktime. sites Doc type is Google Sites. spreadsheet Doc type spreadsheet. shared_drive Doc type is a shared drive. txt Doc type txt. unknown Doc type unknown. is_encrypted boolean Whether the file is client side encrypted. new_publish_visibility string New Publish Visibility Value. Possible values: nobody Nobody. public_in_the_domain Anyone within the audience can view published document. public_on_the_web Anyone on the web can view published document. unchanged Unchanged. new_value string New Value. Possible values: auto Publish Live File. fixed Publish a Version. none Unpublished. unchanged Unchanged. old_publish_visibility string Old Publish Visibility Value. Possible values: nobody Nobody. public_in_the_domain Anyone within the audience can view published document. public_on_the_web Anyone on the web can view published document. unchanged Unchanged. old_value string Old Value. Possible values: auto Publish Live File. fixed Publish a Version. none Unpublished. unchanged Unchanged. originating_app_id string The Google Cloud Project ID of the application that performed the action. Use the Drive REST API to retrieve the app title. owner string Email address of the document's owner. For items contained in a Team Drive, the owner is the name of the Team Drive. owner_is_shared_drive boolean Boolean flag denoting whether owner is a shared drive. primary_event boolean Whether this is a primary event. A single user action in Drive may generate several events, multiple of which can be primary (primary_event=true). The remaining events are deemed to be side effects of the primary event(s) (primary_event=false). For example, when a user creates a document, several events are generated, with only the create event having primary_event=true. But when a user shares a document with multiple other users in one action, an access change event having primary_event=true is created for each sharee. Possible values: false Boolean value false. true Boolean value true. shared_drive_id string The unique identifier of the Team Drive. Only populated for for events relating to a Team Drive or item contained inside a Team Drive. visibility string Visibility of Target File. Possible values: people_with_link Anyone with the link can access. people_within_domain_with_link Anyone with the link within the audience can access. private Private. public_in_the_domain Anyone within the audience can access. public_on_the_web Public on the web. shared_externally Shared with explicit users/groups external to the domain. shared_internally Shared with explicit users/groups internal to the domain. unknown Unknown visibility.
Sample request	GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/drive?eventName=publish_change&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format	{actor} changed publish status from {old_value} to {new_value} and changed visibility from {old_publish_visibility} to {new_publish_visibility}

Editor Settings Change

Editor Settings Changed.

Event details
Event name	change_acl_editors
Parameters	actor_is_collaborator_account boolean Whether actor is a collaborator account. billable boolean Whether this activity is billable. doc_id string Document Id. doc_title string Document title. doc_type string Document type. Possible values: document Doc type document. drawing Doc type drawing. folder Doc type folder. form Doc type form. html Doc type HTML. jam Doc type Jam. jpeg Doc type JPEG. mp4 Doc type MP4. mpeg Doc type MPEG. msexcel Doc type MS Excel. mspowerpoint Doc type MS Powerpoint. msword Doc type MS Word. pdf Doc type PDF. png Doc type PNG. presentation Doc type presentation. quicktime Doc type Quicktime. sites Doc type is Google Sites. spreadsheet Doc type spreadsheet. shared_drive Doc type is a shared drive. txt Doc type txt. unknown Doc type unknown. is_encrypted boolean Whether the file is client side encrypted. new_value string New Value. Possible values: owner The person modifying the access on the file is the Owner of the file. writers The person modifying the access on the file is a Writer (Editor) of the file. old_value string Old Value. Possible values: owner The person modifying the access on the file is the Owner of the file. writers The person modifying the access on the file is a Writer (Editor) of the file. old_visibility string Old Visibility of Target File. Possible values: people_with_link Anyone with the link can access. people_within_domain_with_link Anyone with the link within the audience can access. private Private. public_in_the_domain Anyone within the audience can access. public_on_the_web Public on the web. shared_externally Shared with explicit users/groups external to the domain. shared_internally Shared with explicit users/groups internal to the domain. unknown Unknown visibility. originating_app_id string The Google Cloud Project ID of the application that performed the action. Use the Drive REST API to retrieve the app title. owner string Email address of the document's owner. For items contained in a Team Drive, the owner is the name of the Team Drive. owner_is_shared_drive boolean Boolean flag denoting whether owner is a shared drive. primary_event boolean Whether this is a primary event. A single user action in Drive may generate several events, multiple of which can be primary (primary_event=true). The remaining events are deemed to be side effects of the primary event(s) (primary_event=false). For example, when a user creates a document, several events are generated, with only the create event having primary_event=true. But when a user shares a document with multiple other users in one action, an access change event having primary_event=true is created for each sharee. Possible values: false Boolean value false. true Boolean value true. shared_drive_id string The unique identifier of the Team Drive. Only populated for for events relating to a Team Drive or item contained inside a Team Drive. visibility string Visibility of Target File. Possible values: people_with_link Anyone with the link can access. people_within_domain_with_link Anyone with the link within the audience can access. private Private. public_in_the_domain Anyone within the audience can access. public_on_the_web Public on the web. shared_externally Shared with explicit users/groups external to the domain. shared_internally Shared with explicit users/groups internal to the domain. unknown Unknown visibility. visibility_change string Change in overall visibility of the file. Possible values: external Overall visibility changed from internal to external. internal Overall visibility changed from external to internal. none No change in overall visibility.
Sample request	GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/drive?eventName=change_acl_editors&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format	{actor} changed editor settings from {old_value} to {new_value}

Link Sharing Access Type Change

Change in link sharing access type of document.

Event details
Event name	change_document_access_scope
Parameters	actor_is_collaborator_account boolean Whether actor is a collaborator account. billable boolean Whether this activity is billable. doc_id string Document Id. doc_title string Document title. doc_type string Document type. Possible values: document Doc type document. drawing Doc type drawing. folder Doc type folder. form Doc type form. html Doc type HTML. jam Doc type Jam. jpeg Doc type JPEG. mp4 Doc type MP4. mpeg Doc type MPEG. msexcel Doc type MS Excel. mspowerpoint Doc type MS Powerpoint. msword Doc type MS Word. pdf Doc type PDF. png Doc type PNG. presentation Doc type presentation. quicktime Doc type Quicktime. sites Doc type is Google Sites. spreadsheet Doc type spreadsheet. shared_drive Doc type is a shared drive. txt Doc type txt. unknown Doc type unknown. is_encrypted boolean Whether the file is client side encrypted. new_value string New Value. Possible values: can_comment Can comment. can_edit Can edit. can_view Can view. can_view_published Can view published. none Scope none. organizer Manager. owner Is a owner. old_value string Old Value. Possible values: can_comment Can comment. can_edit Can edit. can_view Can view. can_view_published Can view published. none Scope none. organizer Manager. owner Is a owner. old_visibility string Old Visibility of Target File. Possible values: people_with_link Anyone with the link can access. people_within_domain_with_link Anyone with the link within the audience can access. private Private. public_in_the_domain Anyone within the audience can access. public_on_the_web Public on the web. shared_externally Shared with explicit users/groups external to the domain. shared_internally Shared with explicit users/groups internal to the domain. unknown Unknown visibility. originating_app_id string The Google Cloud Project ID of the application that performed the action. Use the Drive REST API to retrieve the app title. owner string Email address of the document's owner. For items contained in a Team Drive, the owner is the name of the Team Drive. owner_is_shared_drive boolean Boolean flag denoting whether owner is a shared drive. primary_event boolean Whether this is a primary event. A single user action in Drive may generate several events, multiple of which can be primary (primary_event=true). The remaining events are deemed to be side effects of the primary event(s) (primary_event=false). For example, when a user creates a document, several events are generated, with only the create event having primary_event=true. But when a user shares a document with multiple other users in one action, an access change event having primary_event=true is created for each sharee. Possible values: false Boolean value false. true Boolean value true. target_domain string Optional. The domain for which the acccess scope was changed. This can also be the alias all to indicate the access scope was changed for all domains that have visibility for this document. shared_drive_id string The unique identifier of the Team Drive. Only populated for for events relating to a Team Drive or item contained inside a Team Drive. visibility string Visibility of Target File. Possible values: people_with_link Anyone with the link can access. people_within_domain_with_link Anyone with the link within the audience can access. private Private. public_in_the_domain Anyone within the audience can access. public_on_the_web Public on the web. shared_externally Shared with explicit users/groups external to the domain. shared_internally Shared with explicit users/groups internal to the domain. unknown Unknown visibility. visibility_change string Change in overall visibility of the file. Possible values: external Overall visibility changed from internal to external. internal Overall visibility changed from external to internal. none No change in overall visibility.
Sample request	GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/drive?eventName=change_document_access_scope&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format	{actor} changed link sharing access type from {old_value} to {new_value} for {target_domain}

Link Sharing Access Type Change from Parent Folder

Change in link sharing access type of document due to hierarchy reconciliation.

Event details
Event name	change_document_access_scope_hierarchy_reconciled
Parameters	actor_is_collaborator_account boolean Whether actor is a collaborator account. billable boolean Whether this activity is billable. doc_id string Document Id. doc_title string Document title. doc_type string Document type. Possible values: document Doc type document. drawing Doc type drawing. folder Doc type folder. form Doc type form. html Doc type HTML. jam Doc type Jam. jpeg Doc type JPEG. mp4 Doc type MP4. mpeg Doc type MPEG. msexcel Doc type MS Excel. mspowerpoint Doc type MS Powerpoint. msword Doc type MS Word. pdf Doc type PDF. png Doc type PNG. presentation Doc type presentation. quicktime Doc type Quicktime. sites Doc type is Google Sites. spreadsheet Doc type spreadsheet. shared_drive Doc type is a shared drive. txt Doc type txt. unknown Doc type unknown. is_encrypted boolean Whether the file is client side encrypted. new_value string New Value. Possible values: can_comment Can comment. can_edit Can edit. can_view Can view. can_view_published Can view published. none Scope none. organizer Manager. owner Is a owner. old_value string Old Value. Possible values: can_comment Can comment. can_edit Can edit. can_view Can view. can_view_published Can view published. none Scope none. organizer Manager. owner Is a owner. old_visibility string Old Visibility of Target File. Possible values: people_with_link Anyone with the link can access. people_within_domain_with_link Anyone with the link within the audience can access. private Private. public_in_the_domain Anyone within the audience can access. public_on_the_web Public on the web. shared_externally Shared with explicit users/groups external to the domain. shared_internally Shared with explicit users/groups internal to the domain. unknown Unknown visibility. originating_app_id string The Google Cloud Project ID of the application that performed the action. Use the Drive REST API to retrieve the app title. owner string Email address of the document's owner. For items contained in a Team Drive, the owner is the name of the Team Drive. owner_is_shared_drive boolean Boolean flag denoting whether owner is a shared drive. primary_event boolean Whether this is a primary event. A single user action in Drive may generate several events, multiple of which can be primary (primary_event=true). The remaining events are deemed to be side effects of the primary event(s) (primary_event=false). For example, when a user creates a document, several events are generated, with only the create event having primary_event=true. But when a user shares a document with multiple other users in one action, an access change event having primary_event=true is created for each sharee. Possible values: false Boolean value false. true Boolean value true. target_domain string Optional. The domain for which the acccess scope was changed. This can also be the alias all to indicate the access scope was changed for all domains that have visibility for this document. shared_drive_id string The unique identifier of the Team Drive. Only populated for for events relating to a Team Drive or item contained inside a Team Drive. visibility string Visibility of Target File. Possible values: people_with_link Anyone with the link can access. people_within_domain_with_link Anyone with the link within the audience can access. private Private. public_in_the_domain Anyone within the audience can access. public_on_the_web Public on the web. shared_externally Shared with explicit users/groups external to the domain. shared_internally Shared with explicit users/groups internal to the domain. unknown Unknown visibility. visibility_change string Change in overall visibility of the file. Possible values: external Overall visibility changed from internal to external. internal Overall visibility changed from external to internal. none No change in overall visibility.
Sample request	GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/drive?eventName=change_document_access_scope_hierarchy_reconciled&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format	{actor} changed link sharing access type from {old_value} to {new_value} for {target_domain}

Link Sharing visibility change

Change in link sharing visibility of document.

Event details
Event name	change_document_visibility
Parameters	actor_is_collaborator_account boolean Whether actor is a collaborator account. billable boolean Whether this activity is billable. doc_id string Document Id. doc_title string Document title. doc_type string Document type. Possible values: document Doc type document. drawing Doc type drawing. folder Doc type folder. form Doc type form. html Doc type HTML. jam Doc type Jam. jpeg Doc type JPEG. mp4 Doc type MP4. mpeg Doc type MPEG. msexcel Doc type MS Excel. mspowerpoint Doc type MS Powerpoint. msword Doc type MS Word. pdf Doc type PDF. png Doc type PNG. presentation Doc type presentation. quicktime Doc type Quicktime. sites Doc type is Google Sites. spreadsheet Doc type spreadsheet. shared_drive Doc type is a shared drive. txt Doc type txt. unknown Doc type unknown. is_encrypted boolean Whether the file is client side encrypted. new_value string New Value. Possible values: people_with_link Anyone with the link on the web can access. people_within_domain_with_link Anyone with the link within the audience can access, apart from possible sharing with individual users/groups outside the audience. private Document link not exposed, apart from possible sharing with individual users/groups (even outside the domain). public_in_the_domain Anyone within the audience can access, apart from possible sharing with individual users/groups outside the audience. public_on_the_web Public on the web. old_value string Old Value. Possible values: people_with_link Anyone with the link on the web can access. people_within_domain_with_link Anyone with the link within the audience can access, apart from possible sharing with individual users/groups outside the audience. private Document link not exposed, apart from possible sharing with individual users/groups (even outside the domain). public_in_the_domain Anyone within the audience can access, apart from possible sharing with individual users/groups outside the audience. public_on_the_web Public on the web. old_visibility string Old Visibility of Target File. Possible values: people_with_link Anyone with the link can access. people_within_domain_with_link Anyone with the link within the audience can access. private Private. public_in_the_domain Anyone within the audience can access. public_on_the_web Public on the web. shared_externally Shared with explicit users/groups external to the domain. shared_internally Shared with explicit users/groups internal to the domain. unknown Unknown visibility. originating_app_id string The Google Cloud Project ID of the application that performed the action. Use the Drive REST API to retrieve the app title. owner string Email address of the document's owner. For items contained in a Team Drive, the owner is the name of the Team Drive. owner_is_shared_drive boolean Boolean flag denoting whether owner is a shared drive. primary_event boolean Whether this is a primary event. A single user action in Drive may generate several events, multiple of which can be primary (primary_event=true). The remaining events are deemed to be side effects of the primary event(s) (primary_event=false). For example, when a user creates a document, several events are generated, with only the create event having primary_event=true. But when a user shares a document with multiple other users in one action, an access change event having primary_event=true is created for each sharee. Possible values: false Boolean value false. true Boolean value true. target_domain string Optional. The domain for which the acccess scope was changed. This can also be the alias all to indicate the access scope was changed for all domains that have visibility for this document. shared_drive_id string The unique identifier of the Team Drive. Only populated for for events relating to a Team Drive or item contained inside a Team Drive. visibility string Visibility of Target File. Possible values: people_with_link Anyone with the link can access. people_within_domain_with_link Anyone with the link within the audience can access. private Private. public_in_the_domain Anyone within the audience can access. public_on_the_web Public on the web. shared_externally Shared with explicit users/groups external to the domain. shared_internally Shared with explicit users/groups internal to the domain. unknown Unknown visibility. visibility_change string Change in overall visibility of the file. Possible values: external Overall visibility changed from internal to external. internal Overall visibility changed from external to internal. none No change in overall visibility.
Sample request	GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/drive?eventName=change_document_visibility&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format	{actor} changed link sharing visibility from {old_value} to {new_value} for {target_domain}

Link Sharing visibility change from Parent Folder

Change in link sharing visibility of document due to hierarchy reconciliation.

Event details
Event name	change_document_visibility_hierarchy_reconciled
Parameters	actor_is_collaborator_account boolean Whether actor is a collaborator account. billable boolean Whether this activity is billable. doc_id string Document Id. doc_title string Document title. doc_type string Document type. Possible values: document Doc type document. drawing Doc type drawing. folder Doc type folder. form Doc type form. html Doc type HTML. jam Doc type Jam. jpeg Doc type JPEG. mp4 Doc type MP4. mpeg Doc type MPEG. msexcel Doc type MS Excel. mspowerpoint Doc type MS Powerpoint. msword Doc type MS Word. pdf Doc type PDF. png Doc type PNG. presentation Doc type presentation. quicktime Doc type Quicktime. sites Doc type is Google Sites. spreadsheet Doc type spreadsheet. shared_drive Doc type is a shared drive. txt Doc type txt. unknown Doc type unknown. is_encrypted boolean Whether the file is client side encrypted. new_value string New Value. Possible values: people_with_link Anyone with the link on the web can access. people_within_domain_with_link Anyone with the link within the audience can access, apart from possible sharing with individual users/groups outside the audience. private Document link not exposed, apart from possible sharing with individual users/groups (even outside the domain). public_in_the_domain Anyone within the audience can access, apart from possible sharing with individual users/groups outside the audience. public_on_the_web Public on the web. old_value string Old Value. Possible values: people_with_link Anyone with the link on the web can access. people_within_domain_with_link Anyone with the link within the audience can access, apart from possible sharing with individual users/groups outside the audience. private Document link not exposed, apart from possible sharing with individual users/groups (even outside the domain). public_in_the_domain Anyone within the audience can access, apart from possible sharing with individual users/groups outside the audience. public_on_the_web Public on the web. old_visibility string Old Visibility of Target File. Possible values: people_with_link Anyone with the link can access. people_within_domain_with_link Anyone with the link within the audience can access. private Private. public_in_the_domain Anyone within the audience can access. public_on_the_web Public on the web. shared_externally Shared with explicit users/groups external to the domain. shared_internally Shared with explicit users/groups internal to the domain. unknown Unknown visibility. originating_app_id string The Google Cloud Project ID of the application that performed the action. Use the Drive REST API to retrieve the app title. owner string Email address of the document's owner. For items contained in a Team Drive, the owner is the name of the Team Drive. owner_is_shared_drive boolean Boolean flag denoting whether owner is a shared drive. primary_event boolean Whether this is a primary event. A single user action in Drive may generate several events, multiple of which can be primary (primary_event=true). The remaining events are deemed to be side effects of the primary event(s) (primary_event=false). For example, when a user creates a document, several events are generated, with only the create event having primary_event=true. But when a user shares a document with multiple other users in one action, an access change event having primary_event=true is created for each sharee. Possible values: false Boolean value false. true Boolean value true. target_domain string Optional. The domain for which the acccess scope was changed. This can also be the alias all to indicate the access scope was changed for all domains that have visibility for this document. shared_drive_id string The unique identifier of the Team Drive. Only populated for for events relating to a Team Drive or item contained inside a Team Drive. visibility string Visibility of Target File. Possible values: people_with_link Anyone with the link can access. people_within_domain_with_link Anyone with the link within the audience can access. private Private. public_in_the_domain Anyone within the audience can access. public_on_the_web Public on the web. shared_externally Shared with explicit users/groups external to the domain. shared_internally Shared with explicit users/groups internal to the domain. unknown Unknown visibility. visibility_change string Change in overall visibility of the file. Possible values: external Overall visibility changed from internal to external. internal Overall visibility changed from external to internal. none No change in overall visibility.
Sample request	GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/drive?eventName=change_document_visibility_hierarchy_reconciled&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format	Due to a change in a parent folder, the link sharing visibility for {target_domain} changed from {old_value} to {new_value}

Remove security update

Document remove security update.

Event details
Event name	remove_security_update
Parameters	actor_is_collaborator_account boolean Whether actor is a collaborator account. billable boolean Whether this activity is billable. doc_id string Document Id. doc_title string Document title. doc_type string Document type. Possible values: document Doc type document. drawing Doc type drawing. folder Doc type folder. form Doc type form. html Doc type HTML. jam Doc type Jam. jpeg Doc type JPEG. mp4 Doc type MP4. mpeg Doc type MPEG. msexcel Doc type MS Excel. mspowerpoint Doc type MS Powerpoint. msword Doc type MS Word. pdf Doc type PDF. png Doc type PNG. presentation Doc type presentation. quicktime Doc type Quicktime. sites Doc type is Google Sites. spreadsheet Doc type spreadsheet. shared_drive Doc type is a shared drive. txt Doc type txt. unknown Doc type unknown. is_encrypted boolean Whether the file is client side encrypted. originating_app_id string The Google Cloud Project ID of the application that performed the action. Use the Drive REST API to retrieve the app title. owner string Email address of the document's owner. For items contained in a Team Drive, the owner is the name of the Team Drive. owner_is_shared_drive boolean Boolean flag denoting whether owner is a shared drive. primary_event boolean Whether this is a primary event. A single user action in Drive may generate several events, multiple of which can be primary (primary_event=true). The remaining events are deemed to be side effects of the primary event(s) (primary_event=false). For example, when a user creates a document, several events are generated, with only the create event having primary_event=true. But when a user shares a document with multiple other users in one action, an access change event having primary_event=true is created for each sharee. Possible values: false Boolean value false. true Boolean value true. shared_drive_id string The unique identifier of the Team Drive. Only populated for for events relating to a Team Drive or item contained inside a Team Drive. visibility string Visibility of Target File. Possible values: people_with_link Anyone with the link can access. people_within_domain_with_link Anyone with the link within the audience can access. private Private. public_in_the_domain Anyone within the audience can access. public_on_the_web Public on the web. shared_externally Shared with explicit users/groups external to the domain. shared_internally Shared with explicit users/groups internal to the domain. unknown Unknown visibility.
Sample request	GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/drive?eventName=remove_security_update&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format	{actor} removed the security update from a file

Shared Drive Membership Change

Shared drive Membership Change.

Event details
Event name	shared_drive_membership_change
Parameters	actor_is_collaborator_account boolean Whether actor is a collaborator account. added_role string Added membership role of a user/group in a Team Drive. Possible values: commenter Team Drive role Commenter. content_manager Team Drive role Content manager. editor Team Drive role Contributor. none No role in Team Drive. organizer Team Drive role Manager. viewer Team Drive role Viewer. billable boolean Whether this activity is billable. doc_id string Document Id. doc_title string Document title. doc_type string Document type. Possible values: document Doc type document. drawing Doc type drawing. folder Doc type folder. form Doc type form. html Doc type HTML. jam Doc type Jam. jpeg Doc type JPEG. mp4 Doc type MP4. mpeg Doc type MPEG. msexcel Doc type MS Excel. mspowerpoint Doc type MS Powerpoint. msword Doc type MS Word. pdf Doc type PDF. png Doc type PNG. presentation Doc type presentation. quicktime Doc type Quicktime. sites Doc type is Google Sites. spreadsheet Doc type spreadsheet. shared_drive Doc type is a shared drive. txt Doc type txt. unknown Doc type unknown. is_encrypted boolean Whether the file is client side encrypted. membership_change_type string Type of change in Team Drive membership of a user/group. Possible values: add_to_shared_drive Addition to a Team Drive. change_roles Change of a member's role in a Team Drive. re_share Re-share of a member's role in a Team Drive. remove_from_shared_drive Removal from a Team Drive. originating_app_id string The Google Cloud Project ID of the application that performed the action. Use the Drive REST API to retrieve the app title. owner string Email address of the document's owner. For items contained in a Team Drive, the owner is the name of the Team Drive. owner_is_shared_drive boolean Boolean flag denoting whether owner is a shared drive. primary_event boolean Whether this is a primary event. A single user action in Drive may generate several events, multiple of which can be primary (primary_event=true). The remaining events are deemed to be side effects of the primary event(s) (primary_event=false). For example, when a user creates a document, several events are generated, with only the create event having primary_event=true. But when a user shares a document with multiple other users in one action, an access change event having primary_event=true is created for each sharee. Possible values: false Boolean value false. true Boolean value true. removed_role string Removed membership role of a user/group in a Team Drive. Possible values: commenter Team Drive role Commenter. content_manager Team Drive role Content manager. editor Team Drive role Contributor. none No role in Team Drive. organizer Team Drive role Manager. viewer Team Drive role Viewer. target string Target User or Group. shared_drive_id string The unique identifier of the Team Drive. Only populated for for events relating to a Team Drive or item contained inside a Team Drive. visibility string Visibility of Target File. Possible values: people_with_link Anyone with the link can access. people_within_domain_with_link Anyone with the link within the audience can access. private Private. public_in_the_domain Anyone within the audience can access. public_on_the_web Public on the web. shared_externally Shared with explicit users/groups external to the domain. shared_internally Shared with explicit users/groups internal to the domain. unknown Unknown visibility.
Sample request	GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/drive?eventName=shared_drive_membership_change&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format	{actor} made a membership change of type {membership_change_type} for {target} by removing role(s) {removed_role} and adding role(s) {added_role}

Shared Drive Settings Change

Event details
Event name	shared_drive_settings_change
Parameters	actor_is_collaborator_account boolean Whether actor is a collaborator account. billable boolean Whether this activity is billable. doc_id string Document Id. doc_title string Document title. doc_type string Document type. Possible values: document Doc type document. drawing Doc type drawing. folder Doc type folder. form Doc type form. html Doc type HTML. jam Doc type Jam. jpeg Doc type JPEG. mp4 Doc type MP4. mpeg Doc type MPEG. msexcel Doc type MS Excel. mspowerpoint Doc type MS Powerpoint. msword Doc type MS Word. pdf Doc type PDF. png Doc type PNG. presentation Doc type presentation. quicktime Doc type Quicktime. sites Doc type is Google Sites. spreadsheet Doc type spreadsheet. shared_drive Doc type is a shared drive. txt Doc type txt. unknown Doc type unknown. is_encrypted boolean Whether the file is client side encrypted. new_settings_state string New state of Team Drive settings. Possible values: none Team Drive settings change value None. restricted Team Drive settings change value Restricted. unrestricted Team Drive settings change value Unrestricted. old_settings_state string Old state of Team Drive settings. Possible values: none Team Drive settings change value None. restricted Team Drive settings change value Restricted. unrestricted Team Drive settings change value Unrestricted. originating_app_id string The Google Cloud Project ID of the application that performed the action. Use the Drive REST API to retrieve the app title. owner string Email address of the document's owner. For items contained in a Team Drive, the owner is the name of the Team Drive. owner_is_shared_drive boolean Boolean flag denoting whether owner is a shared drive. primary_event boolean Whether this is a primary event. A single user action in Drive may generate several events, multiple of which can be primary (primary_event=true). The remaining events are deemed to be side effects of the primary event(s) (primary_event=false). For example, when a user creates a document, several events are generated, with only the create event having primary_event=true. But when a user shares a document with multiple other users in one action, an access change event having primary_event=true is created for each sharee. Possible values: false Boolean value false. true Boolean value true. target string Target User or Group. shared_drive_id string The unique identifier of the Team Drive. Only populated for for events relating to a Team Drive or item contained inside a Team Drive. shared_drive_settings_change_type string Type of change in Team Drive settings. Possible values: cross_domain_sharing A Team Drive settings change that restricts or unrestricts the ability for the contents within the Team Drive to be shared outside the domain. direct_acl A Team Drive settings change that restricts or unrestricts the ability to add users directly onto a file when they're not a member. download A Team Drive settings change that restricts or unrestricts a user's ability to download files from the Team Drive. drive_fs A Team Drive settings change that restricts or unrestricts access to Drive File Stream. visibility string Visibility of Target File. Possible values: people_with_link Anyone with the link can access. people_within_domain_with_link Anyone with the link within the audience can access. private Private. public_in_the_domain Anyone within the audience can access. public_on_the_web Public on the web. shared_externally Shared with explicit users/groups external to the domain. shared_internally Shared with explicit users/groups internal to the domain. unknown Unknown visibility.
Sample request	GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/drive?eventName=shared_drive_settings_change&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format	{actor} changed {team_drive_settings_change_type} setting from {old_settings_state} to {new_settings_state}

Sheets ImportRange access change

Event details
Event name	sheets_import_range_access_change
Parameters	doc_id string Document Id. doc_title string Document title. doc_type string Document type. is_encrypted boolean Whether the file is client side encrypted. originating_app_id string The Google Cloud Project ID of the application that performed the action. Use the Drive REST API to retrieve the app title. owner string Email address of the document's owner. For items contained in a Team Drive, the owner is the name of the Team Drive. owner_is_shared_drive boolean Boolean flag denoting whether owner is a shared drive. primary_event boolean Whether this is a primary event. A single user action in Drive may generate several events, multiple of which can be primary (primary_event=true). The remaining events are deemed to be side effects of the primary event(s) (primary_event=false). For example, when a user creates a document, several events are generated, with only the create event having primary_event=true. But when a user shares a document with multiple other users in one action, an access change event having primary_event=true is created for each sharee. sheets_import_range_recipient_doc string Sheets ImportRange recipient doc. shared_drive_id string The unique identifier of the Team Drive. Only populated for for events relating to a Team Drive or item contained inside a Team Drive. visibility string Visibility of Target File. Possible values: people_with_link Anyone with the link can access. people_within_domain_with_link Anyone with the link within the audience can access. private Private. public_in_the_domain Anyone within the audience can access. public_on_the_web Public on the web. shared_externally Shared with explicit users/groups external to the domain. shared_internally Shared with explicit users/groups internal to the domain. unknown Unknown visibility.
Sample request	GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/drive?eventName=sheets_import_range_access_change&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format	{actor} enabled Sheets range import to {sheets_import_range_recipient_doc}

User Sharing Permissions Change

User Sharing Permissions Changed.

Event details
Event name	change_user_access
Parameters	actor_is_collaborator_account boolean Whether actor is a collaborator account. billable boolean Whether this activity is billable. doc_id string Document Id. doc_title string Document title. doc_type string Document type. Possible values: document Doc type document. drawing Doc type drawing. folder Doc type folder. form Doc type form. html Doc type HTML. jam Doc type Jam. jpeg Doc type JPEG. mp4 Doc type MP4. mpeg Doc type MPEG. msexcel Doc type MS Excel. mspowerpoint Doc type MS Powerpoint. msword Doc type MS Word. pdf Doc type PDF. png Doc type PNG. presentation Doc type presentation. quicktime Doc type Quicktime. sites Doc type is Google Sites. spreadsheet Doc type spreadsheet. shared_drive Doc type is a shared drive. txt Doc type txt. unknown Doc type unknown. is_encrypted boolean Whether the file is client side encrypted. new_value string New Value. Possible values: can_comment Can comment. can_edit Can edit. can_view Can view. can_view_published Can view published. none Scope none. organizer Manager. owner Is a owner. old_value string Old Value. Possible values: can_comment Can comment. can_edit Can edit. can_view Can view. can_view_published Can view published. none Scope none. organizer Manager. owner Is a owner. old_visibility string Old Visibility of Target File. Possible values: people_with_link Anyone with the link can access. people_within_domain_with_link Anyone with the link within the audience can access. private Private. public_in_the_domain Anyone within the audience can access. public_on_the_web Public on the web. shared_externally Shared with explicit users/groups external to the domain. shared_internally Shared with explicit users/groups internal to the domain. unknown Unknown visibility. originating_app_id string The Google Cloud Project ID of the application that performed the action. Use the Drive REST API to retrieve the app title. owner string Email address of the document's owner. For items contained in a Team Drive, the owner is the name of the Team Drive. owner_is_shared_drive boolean Boolean flag denoting whether owner is a shared drive. primary_event boolean Whether this is a primary event. A single user action in Drive may generate several events, multiple of which can be primary (primary_event=true). The remaining events are deemed to be side effects of the primary event(s) (primary_event=false). For example, when a user creates a document, several events are generated, with only the create event having primary_event=true. But when a user shares a document with multiple other users in one action, an access change event having primary_event=true is created for each sharee. Possible values: false Boolean value false. true Boolean value true. target_user string The email address of the user or group whose access permissions were changed, or the name of the domain for which access permissions were changed. shared_drive_id string The unique identifier of the Team Drive. Only populated for for events relating to a Team Drive or item contained inside a Team Drive. visibility string Visibility of Target File. Possible values: people_with_link Anyone with the link can access. people_within_domain_with_link Anyone with the link within the audience can access. private Private. public_in_the_domain Anyone within the audience can access. public_on_the_web Public on the web. shared_externally Shared with explicit users/groups external to the domain. shared_internally Shared with explicit users/groups internal to the domain. unknown Unknown visibility. visibility_change string Change in overall visibility of the file. Possible values: external Overall visibility changed from internal to external. internal Overall visibility changed from external to internal. none No change in overall visibility.
Sample request	GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/drive?eventName=change_user_access&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format	{actor} changed sharing permissions for {target_user} from {old_value} to {new_value}

User Sharing Permissions Change from Parent Folder

User Sharing Permissions Changed due to hierarchy reconciliation.

Event details
Event name	change_user_access_hierarchy_reconciled
Parameters	actor_is_collaborator_account boolean Whether actor is a collaborator account. billable boolean Whether this activity is billable. doc_id string Document Id. doc_title string Document title. doc_type string Document type. Possible values: document Doc type document. drawing Doc type drawing. folder Doc type folder. form Doc type form. html Doc type HTML. jam Doc type Jam. jpeg Doc type JPEG. mp4 Doc type MP4. mpeg Doc type MPEG. msexcel Doc type MS Excel. mspowerpoint Doc type MS Powerpoint. msword Doc type MS Word. pdf Doc type PDF. png Doc type PNG. presentation Doc type presentation. quicktime Doc type Quicktime. sites Doc type is Google Sites. spreadsheet Doc type spreadsheet. shared_drive Doc type is a shared drive. txt Doc type txt. unknown Doc type unknown. is_encrypted boolean Whether the file is client side encrypted. new_value string New Value. Possible values: can_comment Can comment. can_edit Can edit. can_view Can view. can_view_published Can view published. none Scope none. organizer Manager. owner Is a owner. old_value string Old Value. Possible values: can_comment Can comment. can_edit Can edit. can_view Can view. can_view_published Can view published. none Scope none. organizer Manager. owner Is a owner. old_visibility string Old Visibility of Target File. Possible values: people_with_link Anyone with the link can access. people_within_domain_with_link Anyone with the link within the audience can access. private Private. public_in_the_domain Anyone within the audience can access. public_on_the_web Public on the web. shared_externally Shared with explicit users/groups external to the domain. shared_internally Shared with explicit users/groups internal to the domain. unknown Unknown visibility. originating_app_id string The Google Cloud Project ID of the application that performed the action. Use the Drive REST API to retrieve the app title. owner string Email address of the document's owner. For items contained in a Team Drive, the owner is the name of the Team Drive. owner_is_shared_drive boolean Boolean flag denoting whether owner is a shared drive. primary_event boolean Whether this is a primary event. A single user action in Drive may generate several events, multiple of which can be primary (primary_event=true). The remaining events are deemed to be side effects of the primary event(s) (primary_event=false). For example, when a user creates a document, several events are generated, with only the create event having primary_event=true. But when a user shares a document with multiple other users in one action, an access change event having primary_event=true is created for each sharee. Possible values: false Boolean value false. true Boolean value true. target_user string The email address of the user or group whose access permissions were changed, or the name of the domain for which access permissions were changed. shared_drive_id string The unique identifier of the Team Drive. Only populated for for events relating to a Team Drive or item contained inside a Team Drive. visibility string Visibility of Target File. Possible values: people_with_link Anyone with the link can access. people_within_domain_with_link Anyone with the link within the audience can access. private Private. public_in_the_domain Anyone within the audience can access. public_on_the_web Public on the web. shared_externally Shared with explicit users/groups external to the domain. shared_internally Shared with explicit users/groups internal to the domain. unknown Unknown visibility. visibility_change string Change in overall visibility of the file. Possible values: external Overall visibility changed from internal to external. internal Overall visibility changed from external to internal. none No change in overall visibility.
Sample request	GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/drive?eventName=change_user_access_hierarchy_reconciled&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format	Due to a change in a parent folder, the sharing permissions for {target_user} changed from {old_value} to {new_value}

Pooled quota metadata

Events of this type are returned with type=pooled_quota_metadata.

Storage Usage Update

Drive storage usage update.

Event details
Event name	storage_usage_update
Parameters	storage_entity_id integer Entity that uses the storage. storage_usage_in_bytes integer Storage usage (in bytes).
Sample request	GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/drive?eventName=storage_usage_update&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format	Storage usage update for {actor}