Drive Audit Activity Events

This document lists the events and parameters for various types of Drive Audit activity events. You can retrieve these events by calling Activities.list() with applicationName=drive.

Access

Events of this type are returned with type=access.

Access request denied

An access request was denied.

Event details
Event name	deny_access_request
Parameters	actor_is_collaborator_account boolean Whether actor is a collaborator account. billable boolean Whether this activity is billable. doc_id string Document Id. doc_title string Document title. doc_type string Document type. Possible values: document Doc type document. drawing Doc type drawing. folder Doc type folder. form Doc type form. html Doc type HTML. jam Doc type Jam. jpeg Doc type JPEG. mp4 Doc type MP4. mpeg Doc type MPEG. msexcel Doc type MS Excel. mspowerpoint Doc type MS Powerpoint. msword Doc type MS Word. pdf Doc type PDF. png Doc type PNG. presentation Doc type presentation. quicktime Doc type Quicktime. script Doc type is Google Script. shortcut Doc type is Google Shortcut. sites Doc type is Google Sites. spreadsheet Doc type spreadsheet. shared_drive Doc type is a shared drive. txt Doc type txt. unknown Doc type unknown. is_encrypted boolean Whether the file is client side encrypted. originating_app_id string The Google Cloud Project ID of the application that performed the action. Use the Drive REST API to retrieve the app title. owner string Email address of the document's owner. For items contained in a shared drive, the owner is the name of the shared drive. owner_is_shared_drive boolean Boolean flag denoting whether owner is a shared drive. owner_shared_drive_id string The shared drive root id if the document owner is shared drive. primary_event boolean Whether this is a primary event. A single user action in Drive may generate several events, multiple of which can be primary (primary_event=true). The remaining events are deemed to be side effects of the primary event(s) (primary_event=false). For example, when a user creates a document, several events are generated, with only the create event having primary_event=true. But when a user shares a document with multiple other users in one action, an access change event having primary_event=true is created for each sharee. Possible values: false Boolean value false. true Boolean value true. target_user string The email address of the user or group whose access permissions were changed, or the name of the domain for which access permissions were changed. If the user has multiple email addresses on their Google account, their display email is used instead of the specific email that the item was shared with. shared_drive_id string The unique identifier of the shared drive. Only populated for events or items from a shared drive. visibility string Visibility of Target File. Possible values: people_with_link Anyone with the link can access. people_within_domain_with_link Anyone with the link within the audience can access. private Private. public_in_the_domain Anyone within the audience can access. public_on_the_web Public on the web. shared_externally Shared with explicit users/groups external to the domain. shared_internally Shared with explicit users/groups internal to the domain. unknown Unknown visibility.
Sample request	GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/drive?eventName=deny_access_request&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format	{actor} denied an access request for {target_user}

Access request expired

An access request expired.

Event details
Event name	expire_access_request
Parameters	actor_is_collaborator_account boolean Whether actor is a collaborator account. billable boolean Whether this activity is billable. doc_id string Document Id. doc_title string Document title. doc_type string Document type. Possible values: document Doc type document. drawing Doc type drawing. folder Doc type folder. form Doc type form. html Doc type HTML. jam Doc type Jam. jpeg Doc type JPEG. mp4 Doc type MP4. mpeg Doc type MPEG. msexcel Doc type MS Excel. mspowerpoint Doc type MS Powerpoint. msword Doc type MS Word. pdf Doc type PDF. png Doc type PNG. presentation Doc type presentation. quicktime Doc type Quicktime. script Doc type is Google Script. shortcut Doc type is Google Shortcut. sites Doc type is Google Sites. spreadsheet Doc type spreadsheet. shared_drive Doc type is a shared drive. txt Doc type txt. unknown Doc type unknown. is_encrypted boolean Whether the file is client side encrypted. originating_app_id string The Google Cloud Project ID of the application that performed the action. Use the Drive REST API to retrieve the app title. owner string Email address of the document's owner. For items contained in a shared drive, the owner is the name of the shared drive. owner_is_shared_drive boolean Boolean flag denoting whether owner is a shared drive. owner_shared_drive_id string The shared drive root id if the document owner is shared drive. primary_event boolean Whether this is a primary event. A single user action in Drive may generate several events, multiple of which can be primary (primary_event=true). The remaining events are deemed to be side effects of the primary event(s) (primary_event=false). For example, when a user creates a document, several events are generated, with only the create event having primary_event=true. But when a user shares a document with multiple other users in one action, an access change event having primary_event=true is created for each sharee. Possible values: false Boolean value false. true Boolean value true. target_user string The email address of the user or group whose access permissions were changed, or the name of the domain for which access permissions were changed. If the user has multiple email addresses on their Google account, their display email is used instead of the specific email that the item was shared with. shared_drive_id string The unique identifier of the shared drive. Only populated for events or items from a shared drive. visibility string Visibility of Target File. Possible values: people_with_link Anyone with the link can access. people_within_domain_with_link Anyone with the link within the audience can access. private Private. public_in_the_domain Anyone within the audience can access. public_on_the_web Public on the web. shared_externally Shared with explicit users/groups external to the domain. shared_internally Shared with explicit users/groups internal to the domain. unknown Unknown visibility.
Sample request	GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/drive?eventName=expire_access_request&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format	An access request for {target_user} expired

Access requested

Access requested to an item.

Event details
Event name	request_access
Parameters	actor_is_collaborator_account boolean Whether actor is a collaborator account. billable boolean Whether this activity is billable. doc_id string Document Id. doc_title string Document title. doc_type string Document type. Possible values: document Doc type document. drawing Doc type drawing. folder Doc type folder. form Doc type form. html Doc type HTML. jam Doc type Jam. jpeg Doc type JPEG. mp4 Doc type MP4. mpeg Doc type MPEG. msexcel Doc type MS Excel. mspowerpoint Doc type MS Powerpoint. msword Doc type MS Word. pdf Doc type PDF. png Doc type PNG. presentation Doc type presentation. quicktime Doc type Quicktime. script Doc type is Google Script. shortcut Doc type is Google Shortcut. sites Doc type is Google Sites. spreadsheet Doc type spreadsheet. shared_drive Doc type is a shared drive. txt Doc type txt. unknown Doc type unknown. is_encrypted boolean Whether the file is client side encrypted. originating_app_id string The Google Cloud Project ID of the application that performed the action. Use the Drive REST API to retrieve the app title. owner string Email address of the document's owner. For items contained in a shared drive, the owner is the name of the shared drive. owner_is_shared_drive boolean Boolean flag denoting whether owner is a shared drive. owner_shared_drive_id string The shared drive root id if the document owner is shared drive. primary_event boolean Whether this is a primary event. A single user action in Drive may generate several events, multiple of which can be primary (primary_event=true). The remaining events are deemed to be side effects of the primary event(s) (primary_event=false). For example, when a user creates a document, several events are generated, with only the create event having primary_event=true. But when a user shares a document with multiple other users in one action, an access change event having primary_event=true is created for each sharee. Possible values: false Boolean value false. true Boolean value true. requested_role string Requested access role. Possible values: can_comment Can comment. can_edit Can edit. can_respond Can respond. can_view Can view. can_view_published Can view published. none Scope none. organizer Manager. owner Is a owner. target_user string The email address of the user or group that the actor is requesting access for. shared_drive_id string The unique identifier of the shared drive. Only populated for events or items from a shared drive. visibility string Visibility of Target File. Possible values: people_with_link Anyone with the link can access. people_within_domain_with_link Anyone with the link within the audience can access. private Private. public_in_the_domain Anyone within the audience can access. public_on_the_web Public on the web. shared_externally Shared with explicit users/groups external to the domain. shared_internally Shared with explicit users/groups internal to the domain. unknown Unknown visibility.
Sample request	GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/drive?eventName=request_access&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format	{actor} requested access to an item for {target_user}

Add to folder

Document add to folder.

Event details
Event name	add_to_folder
Parameters	actor_is_collaborator_account boolean Whether actor is a collaborator account. billable boolean Whether this activity is billable. destination_folder_id string Destination folder Id. destination_folder_title string Destination folder title. doc_id string Document Id. doc_title string Document title. doc_type string Document type. Possible values: document Doc type document. drawing Doc type drawing. folder Doc type folder. form Doc type form. html Doc type HTML. jam Doc type Jam. jpeg Doc type JPEG. mp4 Doc type MP4. mpeg Doc type MPEG. msexcel Doc type MS Excel. mspowerpoint Doc type MS Powerpoint. msword Doc type MS Word. pdf Doc type PDF. png Doc type PNG. presentation Doc type presentation. quicktime Doc type Quicktime. script Doc type is Google Script. shortcut Doc type is Google Shortcut. sites Doc type is Google Sites. spreadsheet Doc type spreadsheet. shared_drive Doc type is a shared drive. txt Doc type txt. unknown Doc type unknown. is_encrypted boolean Whether the file is client side encrypted. originating_app_id string The Google Cloud Project ID of the application that performed the action. Use the Drive REST API to retrieve the app title. owner string Email address of the document's owner. For items contained in a shared drive, the owner is the name of the shared drive. owner_is_shared_drive boolean Boolean flag denoting whether owner is a shared drive. owner_shared_drive_id string The shared drive root id if the document owner is shared drive. primary_event boolean Whether this is a primary event. A single user action in Drive may generate several events, multiple of which can be primary (primary_event=true). The remaining events are deemed to be side effects of the primary event(s) (primary_event=false). For example, when a user creates a document, several events are generated, with only the create event having primary_event=true. But when a user shares a document with multiple other users in one action, an access change event having primary_event=true is created for each sharee. Possible values: false Boolean value false. true Boolean value true. shared_drive_id string The unique identifier of the shared drive. Only populated for events or items from a shared drive. visibility string Visibility of Target File. Possible values: people_with_link Anyone with the link can access. people_within_domain_with_link Anyone with the link within the audience can access. private Private. public_in_the_domain Anyone within the audience can access. public_on_the_web Public on the web. shared_externally Shared with explicit users/groups external to the domain. shared_internally Shared with explicit users/groups internal to the domain. unknown Unknown visibility.
Sample request	GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/drive?eventName=add_to_folder&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format	{actor} added an item to {destination_folder_title}

Appeal abuse violation

Event details
Event name	appeal_abuse_violation
Parameters	actor_is_collaborator_account boolean Whether actor is a collaborator account. billable boolean Whether this activity is billable. doc_id string Document Id. doc_title string Document title. doc_type string Document type. Possible values: document Doc type document. drawing Doc type drawing. folder Doc type folder. form Doc type form. html Doc type HTML. jam Doc type Jam. jpeg Doc type JPEG. mp4 Doc type MP4. mpeg Doc type MPEG. msexcel Doc type MS Excel. mspowerpoint Doc type MS Powerpoint. msword Doc type MS Word. pdf Doc type PDF. png Doc type PNG. presentation Doc type presentation. quicktime Doc type Quicktime. script Doc type is Google Script. shortcut Doc type is Google Shortcut. sites Doc type is Google Sites. spreadsheet Doc type spreadsheet. shared_drive Doc type is a shared drive. txt Doc type txt. unknown Doc type unknown. is_encrypted boolean Whether the file is client side encrypted. originating_app_id string The Google Cloud Project ID of the application that performed the action. Use the Drive REST API to retrieve the app title. owner string Email address of the document's owner. For items contained in a shared drive, the owner is the name of the shared drive. owner_is_shared_drive boolean Boolean flag denoting whether owner is a shared drive. owner_shared_drive_id string The shared drive root id if the document owner is shared drive. primary_event boolean Whether this is a primary event. A single user action in Drive may generate several events, multiple of which can be primary (primary_event=true). The remaining events are deemed to be side effects of the primary event(s) (primary_event=false). For example, when a user creates a document, several events are generated, with only the create event having primary_event=true. But when a user shares a document with multiple other users in one action, an access change event having primary_event=true is created for each sharee. Possible values: false Boolean value false. true Boolean value true. shared_drive_id string The unique identifier of the shared drive. Only populated for events or items from a shared drive. visibility string Visibility of Target File. Possible values: people_with_link Anyone with the link can access. people_within_domain_with_link Anyone with the link within the audience can access. private Private. public_in_the_domain Anyone within the audience can access. public_on_the_web Public on the web. shared_externally Shared with explicit users/groups external to the domain. shared_internally Shared with explicit users/groups internal to the domain. unknown Unknown visibility.
Sample request	GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/drive?eventName=appeal_abuse_violation&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format	{actor} appealed an abuse violation

Approval canceled

Drive approval canceled.

Event details
Event name	approval_canceled
Parameters	actor_is_collaborator_account boolean Whether actor is a collaborator account. billable boolean Whether this activity is billable. doc_id string Document Id. doc_title string Document title. doc_type string Document type. Possible values: document Doc type document. drawing Doc type drawing. folder Doc type folder. form Doc type form. html Doc type HTML. jam Doc type Jam. jpeg Doc type JPEG. mp4 Doc type MP4. mpeg Doc type MPEG. msexcel Doc type MS Excel. mspowerpoint Doc type MS Powerpoint. msword Doc type MS Word. pdf Doc type PDF. png Doc type PNG. presentation Doc type presentation. quicktime Doc type Quicktime. script Doc type is Google Script. shortcut Doc type is Google Shortcut. sites Doc type is Google Sites. spreadsheet Doc type spreadsheet. shared_drive Doc type is a shared drive. txt Doc type txt. unknown Doc type unknown. is_encrypted boolean Whether the file is client side encrypted. originating_app_id string The Google Cloud Project ID of the application that performed the action. Use the Drive REST API to retrieve the app title. owner string Email address of the document's owner. For items contained in a shared drive, the owner is the name of the shared drive. owner_is_shared_drive boolean Boolean flag denoting whether owner is a shared drive. owner_shared_drive_id string The shared drive root id if the document owner is shared drive. primary_event boolean Whether this is a primary event. A single user action in Drive may generate several events, multiple of which can be primary (primary_event=true). The remaining events are deemed to be side effects of the primary event(s) (primary_event=false). For example, when a user creates a document, several events are generated, with only the create event having primary_event=true. But when a user shares a document with multiple other users in one action, an access change event having primary_event=true is created for each sharee. Possible values: false Boolean value false. true Boolean value true. shared_drive_id string The unique identifier of the shared drive. Only populated for events or items from a shared drive. visibility string Visibility of Target File. Possible values: people_with_link Anyone with the link can access. people_within_domain_with_link Anyone with the link within the audience can access. private Private. public_in_the_domain Anyone within the audience can access. public_on_the_web Public on the web. shared_externally Shared with explicit users/groups external to the domain. shared_internally Shared with explicit users/groups internal to the domain. unknown Unknown visibility.
Sample request	GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/drive?eventName=approval_canceled&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format	{actor} canceled an approval on an item

Approval comment added

Drive approval comment added.

Event details
Event name	approval_comment_added
Parameters	actor_is_collaborator_account boolean Whether actor is a collaborator account. billable boolean Whether this activity is billable. doc_id string Document Id. doc_title string Document title. doc_type string Document type. Possible values: document Doc type document. drawing Doc type drawing. folder Doc type folder. form Doc type form. html Doc type HTML. jam Doc type Jam. jpeg Doc type JPEG. mp4 Doc type MP4. mpeg Doc type MPEG. msexcel Doc type MS Excel. mspowerpoint Doc type MS Powerpoint. msword Doc type MS Word. pdf Doc type PDF. png Doc type PNG. presentation Doc type presentation. quicktime Doc type Quicktime. script Doc type is Google Script. shortcut Doc type is Google Shortcut. sites Doc type is Google Sites. spreadsheet Doc type spreadsheet. shared_drive Doc type is a shared drive. txt Doc type txt. unknown Doc type unknown. is_encrypted boolean Whether the file is client side encrypted. originating_app_id string The Google Cloud Project ID of the application that performed the action. Use the Drive REST API to retrieve the app title. owner string Email address of the document's owner. For items contained in a shared drive, the owner is the name of the shared drive. owner_is_shared_drive boolean Boolean flag denoting whether owner is a shared drive. owner_shared_drive_id string The shared drive root id if the document owner is shared drive. primary_event boolean Whether this is a primary event. A single user action in Drive may generate several events, multiple of which can be primary (primary_event=true). The remaining events are deemed to be side effects of the primary event(s) (primary_event=false). For example, when a user creates a document, several events are generated, with only the create event having primary_event=true. But when a user shares a document with multiple other users in one action, an access change event having primary_event=true is created for each sharee. Possible values: false Boolean value false. true Boolean value true. shared_drive_id string The unique identifier of the shared drive. Only populated for events or items from a shared drive. visibility string Visibility of Target File. Possible values: people_with_link Anyone with the link can access. people_within_domain_with_link Anyone with the link within the audience can access. private Private. public_in_the_domain Anyone within the audience can access. public_on_the_web Public on the web. shared_externally Shared with explicit users/groups external to the domain. shared_internally Shared with explicit users/groups internal to the domain. unknown Unknown visibility.
Sample request	GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/drive?eventName=approval_comment_added&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format	{actor} added a comment on an approval on an item

Approval completed

Drive approval completed.

Event details
Event name	approval_completed
Parameters	actor_is_collaborator_account boolean Whether actor is a collaborator account. billable boolean Whether this activity is billable. doc_id string Document Id. doc_title string Document title. doc_type string Document type. Possible values: document Doc type document. drawing Doc type drawing. folder Doc type folder. form Doc type form. html Doc type HTML. jam Doc type Jam. jpeg Doc type JPEG. mp4 Doc type MP4. mpeg Doc type MPEG. msexcel Doc type MS Excel. mspowerpoint Doc type MS Powerpoint. msword Doc type MS Word. pdf Doc type PDF. png Doc type PNG. presentation Doc type presentation. quicktime Doc type Quicktime. script Doc type is Google Script. shortcut Doc type is Google Shortcut. sites Doc type is Google Sites. spreadsheet Doc type spreadsheet. shared_drive Doc type is a shared drive. txt Doc type txt. unknown Doc type unknown. is_encrypted boolean Whether the file is client side encrypted. originating_app_id string The Google Cloud Project ID of the application that performed the action. Use the Drive REST API to retrieve the app title. owner string Email address of the document's owner. For items contained in a shared drive, the owner is the name of the shared drive. owner_is_shared_drive boolean Boolean flag denoting whether owner is a shared drive. owner_shared_drive_id string The shared drive root id if the document owner is shared drive. primary_event boolean Whether this is a primary event. A single user action in Drive may generate several events, multiple of which can be primary (primary_event=true). The remaining events are deemed to be side effects of the primary event(s) (primary_event=false). For example, when a user creates a document, several events are generated, with only the create event having primary_event=true. But when a user shares a document with multiple other users in one action, an access change event having primary_event=true is created for each sharee. Possible values: false Boolean value false. true Boolean value true. shared_drive_id string The unique identifier of the shared drive. Only populated for events or items from a shared drive. visibility string Visibility of Target File. Possible values: people_with_link Anyone with the link can access. people_within_domain_with_link Anyone with the link within the audience can access. private Private. public_in_the_domain Anyone within the audience can access. public_on_the_web Public on the web. shared_externally Shared with explicit users/groups external to the domain. shared_internally Shared with explicit users/groups internal to the domain. unknown Unknown visibility.
Sample request	GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/drive?eventName=approval_completed&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format	An approval was completed

Approval decisions reset

Drive approval decisions reset.

Event details
Event name	approval_decisions_reset
Parameters	actor_is_collaborator_account boolean Whether actor is a collaborator account. billable boolean Whether this activity is billable. doc_id string Document Id. doc_title string Document title. doc_type string Document type. Possible values: document Doc type document. drawing Doc type drawing. folder Doc type folder. form Doc type form. html Doc type HTML. jam Doc type Jam. jpeg Doc type JPEG. mp4 Doc type MP4. mpeg Doc type MPEG. msexcel Doc type MS Excel. mspowerpoint Doc type MS Powerpoint. msword Doc type MS Word. pdf Doc type PDF. png Doc type PNG. presentation Doc type presentation. quicktime Doc type Quicktime. script Doc type is Google Script. shortcut Doc type is Google Shortcut. sites Doc type is Google Sites. spreadsheet Doc type spreadsheet. shared_drive Doc type is a shared drive. txt Doc type txt. unknown Doc type unknown. is_encrypted boolean Whether the file is client side encrypted. originating_app_id string The Google Cloud Project ID of the application that performed the action. Use the Drive REST API to retrieve the app title. owner string Email address of the document's owner. For items contained in a shared drive, the owner is the name of the shared drive. owner_is_shared_drive boolean Boolean flag denoting whether owner is a shared drive. owner_shared_drive_id string The shared drive root id if the document owner is shared drive. primary_event boolean Whether this is a primary event. A single user action in Drive may generate several events, multiple of which can be primary (primary_event=true). The remaining events are deemed to be side effects of the primary event(s) (primary_event=false). For example, when a user creates a document, several events are generated, with only the create event having primary_event=true. But when a user shares a document with multiple other users in one action, an access change event having primary_event=true is created for each sharee. Possible values: false Boolean value false. true Boolean value true. shared_drive_id string The unique identifier of the shared drive. Only populated for events or items from a shared drive. visibility string Visibility of Target File. Possible values: people_with_link Anyone with the link can access. people_within_domain_with_link Anyone with the link within the audience can access. private Private. public_in_the_domain Anyone within the audience can access. public_on_the_web Public on the web. shared_externally Shared with explicit users/groups external to the domain. shared_internally Shared with explicit users/groups internal to the domain. unknown Unknown visibility.
Sample request	GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/drive?eventName=approval_decisions_reset&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format	Approval decisions were reset

Approval due time change

Drive approval due time change.

Event details
Event name	approval_due_time_change
Parameters	actor_is_collaborator_account boolean Whether actor is a collaborator account. billable boolean Whether this activity is billable. doc_id string Document Id. doc_title string Document title. doc_type string Document type. Possible values: document Doc type document. drawing Doc type drawing. folder Doc type folder. form Doc type form. html Doc type HTML. jam Doc type Jam. jpeg Doc type JPEG. mp4 Doc type MP4. mpeg Doc type MPEG. msexcel Doc type MS Excel. mspowerpoint Doc type MS Powerpoint. msword Doc type MS Word. pdf Doc type PDF. png Doc type PNG. presentation Doc type presentation. quicktime Doc type Quicktime. script Doc type is Google Script. shortcut Doc type is Google Shortcut. sites Doc type is Google Sites. spreadsheet Doc type spreadsheet. shared_drive Doc type is a shared drive. txt Doc type txt. unknown Doc type unknown. is_encrypted boolean Whether the file is client side encrypted. originating_app_id string The Google Cloud Project ID of the application that performed the action. Use the Drive REST API to retrieve the app title. owner string Email address of the document's owner. For items contained in a shared drive, the owner is the name of the shared drive. owner_is_shared_drive boolean Boolean flag denoting whether owner is a shared drive. owner_shared_drive_id string The shared drive root id if the document owner is shared drive. primary_event boolean Whether this is a primary event. A single user action in Drive may generate several events, multiple of which can be primary (primary_event=true). The remaining events are deemed to be side effects of the primary event(s) (primary_event=false). For example, when a user creates a document, several events are generated, with only the create event having primary_event=true. But when a user shares a document with multiple other users in one action, an access change event having primary_event=true is created for each sharee. Possible values: false Boolean value false. true Boolean value true. shared_drive_id string The unique identifier of the shared drive. Only populated for events or items from a shared drive. visibility string Visibility of Target File. Possible values: people_with_link Anyone with the link can access. people_within_domain_with_link Anyone with the link within the audience can access. private Private. public_in_the_domain Anyone within the audience can access. public_on_the_web Public on the web. shared_externally Shared with explicit users/groups external to the domain. shared_internally Shared with explicit users/groups internal to the domain. unknown Unknown visibility.
Sample request	GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/drive?eventName=approval_due_time_change&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format	{actor} requested a due time change on an approval

Approval requested

Drive approval requested.

Event details
Event name	approval_requested
Parameters	actor_is_collaborator_account boolean Whether actor is a collaborator account. billable boolean Whether this activity is billable. doc_id string Document Id. doc_title string Document title. doc_type string Document type. Possible values: document Doc type document. drawing Doc type drawing. folder Doc type folder. form Doc type form. html Doc type HTML. jam Doc type Jam. jpeg Doc type JPEG. mp4 Doc type MP4. mpeg Doc type MPEG. msexcel Doc type MS Excel. mspowerpoint Doc type MS Powerpoint. msword Doc type MS Word. pdf Doc type PDF. png Doc type PNG. presentation Doc type presentation. quicktime Doc type Quicktime. script Doc type is Google Script. shortcut Doc type is Google Shortcut. sites Doc type is Google Sites. spreadsheet Doc type spreadsheet. shared_drive Doc type is a shared drive. txt Doc type txt. unknown Doc type unknown. is_encrypted boolean Whether the file is client side encrypted. originating_app_id string The Google Cloud Project ID of the application that performed the action. Use the Drive REST API to retrieve the app title. owner string Email address of the document's owner. For items contained in a shared drive, the owner is the name of the shared drive. owner_is_shared_drive boolean Boolean flag denoting whether owner is a shared drive. owner_shared_drive_id string The shared drive root id if the document owner is shared drive. primary_event boolean Whether this is a primary event. A single user action in Drive may generate several events, multiple of which can be primary (primary_event=true). The remaining events are deemed to be side effects of the primary event(s) (primary_event=false). For example, when a user creates a document, several events are generated, with only the create event having primary_event=true. But when a user shares a document with multiple other users in one action, an access change event having primary_event=true is created for each sharee. Possible values: false Boolean value false. true Boolean value true. shared_drive_id string The unique identifier of the shared drive. Only populated for events or items from a shared drive. visibility string Visibility of Target File. Possible values: people_with_link Anyone with the link can access. people_within_domain_with_link Anyone with the link within the audience can access. private Private. public_in_the_domain Anyone within the audience can access. public_on_the_web Public on the web. shared_externally Shared with explicit users/groups external to the domain. shared_internally Shared with explicit users/groups internal to the domain. unknown Unknown visibility.
Sample request	GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/drive?eventName=approval_requested&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format	{actor} requested approval on an item

Approval reviewer change

Drive approval reviewer change.

Event details
Event name	approval_reviewer_change
Parameters	actor_is_collaborator_account boolean Whether actor is a collaborator account. billable boolean Whether this activity is billable. doc_id string Document Id. doc_title string Document title. doc_type string Document type. Possible values: document Doc type document. drawing Doc type drawing. folder Doc type folder. form Doc type form. html Doc type HTML. jam Doc type Jam. jpeg Doc type JPEG. mp4 Doc type MP4. mpeg Doc type MPEG. msexcel Doc type MS Excel. mspowerpoint Doc type MS Powerpoint. msword Doc type MS Word. pdf Doc type PDF. png Doc type PNG. presentation Doc type presentation. quicktime Doc type Quicktime. script Doc type is Google Script. shortcut Doc type is Google Shortcut. sites Doc type is Google Sites. spreadsheet Doc type spreadsheet. shared_drive Doc type is a shared drive. txt Doc type txt. unknown Doc type unknown. is_encrypted boolean Whether the file is client side encrypted. originating_app_id string The Google Cloud Project ID of the application that performed the action. Use the Drive REST API to retrieve the app title. owner string Email address of the document's owner. For items contained in a shared drive, the owner is the name of the shared drive. owner_is_shared_drive boolean Boolean flag denoting whether owner is a shared drive. owner_shared_drive_id string The shared drive root id if the document owner is shared drive. primary_event boolean Whether this is a primary event. A single user action in Drive may generate several events, multiple of which can be primary (primary_event=true). The remaining events are deemed to be side effects of the primary event(s) (primary_event=false). For example, when a user creates a document, several events are generated, with only the create event having primary_event=true. But when a user shares a document with multiple other users in one action, an access change event having primary_event=true is created for each sharee. Possible values: false Boolean value false. true Boolean value true. shared_drive_id string The unique identifier of the shared drive. Only populated for events or items from a shared drive. visibility string Visibility of Target File. Possible values: people_with_link Anyone with the link can access. people_within_domain_with_link Anyone with the link within the audience can access. private Private. public_in_the_domain Anyone within the audience can access. public_on_the_web Public on the web. shared_externally Shared with explicit users/groups external to the domain. shared_internally Shared with explicit users/groups internal to the domain. unknown Unknown visibility.
Sample request	GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/drive?eventName=approval_reviewer_change&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format	{actor} requested a reviewer change on an approval

Approval reviewer responded

Drive approval reviewer responded.

Event details
Event name	approval_reviewer_responded
Parameters	actor_is_collaborator_account boolean Whether actor is a collaborator account. billable boolean Whether this activity is billable. doc_id string Document Id. doc_title string Document title. doc_type string Document type. Possible values: document Doc type document. drawing Doc type drawing. folder Doc type folder. form Doc type form. html Doc type HTML. jam Doc type Jam. jpeg Doc type JPEG. mp4 Doc type MP4. mpeg Doc type MPEG. msexcel Doc type MS Excel. mspowerpoint Doc type MS Powerpoint. msword Doc type MS Word. pdf Doc type PDF. png Doc type PNG. presentation Doc type presentation. quicktime Doc type Quicktime. script Doc type is Google Script. shortcut Doc type is Google Shortcut. sites Doc type is Google Sites. spreadsheet Doc type spreadsheet. shared_drive Doc type is a shared drive. txt Doc type txt. unknown Doc type unknown. is_encrypted boolean Whether the file is client side encrypted. originating_app_id string The Google Cloud Project ID of the application that performed the action. Use the Drive REST API to retrieve the app title. owner string Email address of the document's owner. For items contained in a shared drive, the owner is the name of the shared drive. owner_is_shared_drive boolean Boolean flag denoting whether owner is a shared drive. owner_shared_drive_id string The shared drive root id if the document owner is shared drive. primary_event boolean Whether this is a primary event. A single user action in Drive may generate several events, multiple of which can be primary (primary_event=true). The remaining events are deemed to be side effects of the primary event(s) (primary_event=false). For example, when a user creates a document, several events are generated, with only the create event having primary_event=true. But when a user shares a document with multiple other users in one action, an access change event having primary_event=true is created for each sharee. Possible values: false Boolean value false. true Boolean value true. shared_drive_id string The unique identifier of the shared drive. Only populated for events or items from a shared drive. visibility string Visibility of Target File. Possible values: people_with_link Anyone with the link can access. people_within_domain_with_link Anyone with the link within the audience can access. private Private. public_in_the_domain Anyone within the audience can access. public_on_the_web Public on the web. shared_externally Shared with explicit users/groups external to the domain. shared_internally Shared with explicit users/groups internal to the domain. unknown Unknown visibility.
Sample request	GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/drive?eventName=approval_reviewer_responded&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format	{actor} reviewed an approval on an item

Comment created

A comment was created.

Event details
Event name	create_comment
Parameters	actor_is_collaborator_account boolean Whether actor is a collaborator account. billable boolean Whether this activity is billable. doc_id string Document Id. doc_title string Document title. doc_type string Document type. Possible values: document Doc type document. drawing Doc type drawing. folder Doc type folder. form Doc type form. html Doc type HTML. jam Doc type Jam. jpeg Doc type JPEG. mp4 Doc type MP4. mpeg Doc type MPEG. msexcel Doc type MS Excel. mspowerpoint Doc type MS Powerpoint. msword Doc type MS Word. pdf Doc type PDF. png Doc type PNG. presentation Doc type presentation. quicktime Doc type Quicktime. script Doc type is Google Script. shortcut Doc type is Google Shortcut. sites Doc type is Google Sites. spreadsheet Doc type spreadsheet. shared_drive Doc type is a shared drive. txt Doc type txt. unknown Doc type unknown. is_encrypted boolean Whether the file is client side encrypted. originating_app_id string The Google Cloud Project ID of the application that performed the action. Use the Drive REST API to retrieve the app title. owner string Email address of the document's owner. For items contained in a shared drive, the owner is the name of the shared drive. owner_is_shared_drive boolean Boolean flag denoting whether owner is a shared drive. owner_shared_drive_id string The shared drive root id if the document owner is shared drive. primary_event boolean Whether this is a primary event. A single user action in Drive may generate several events, multiple of which can be primary (primary_event=true). The remaining events are deemed to be side effects of the primary event(s) (primary_event=false). For example, when a user creates a document, several events are generated, with only the create event having primary_event=true. But when a user shares a document with multiple other users in one action, an access change event having primary_event=true is created for each sharee. Possible values: false Boolean value false. true Boolean value true. shared_drive_id string The unique identifier of the shared drive. Only populated for events or items from a shared drive. visibility string Visibility of Target File. Possible values: people_with_link Anyone with the link can access. people_within_domain_with_link Anyone with the link within the audience can access. private Private. public_in_the_domain Anyone within the audience can access. public_on_the_web Public on the web. shared_externally Shared with explicit users/groups external to the domain. shared_internally Shared with explicit users/groups internal to the domain. unknown Unknown visibility.
Sample request	GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/drive?eventName=create_comment&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format	{actor} created a comment

Comment deleted

A comment was deleted.

Event details
Event name	delete_comment
Parameters	actor_is_collaborator_account boolean Whether actor is a collaborator account. billable boolean Whether this activity is billable. doc_id string Document Id. doc_title string Document title. doc_type string Document type. Possible values: document Doc type document. drawing Doc type drawing. folder Doc type folder. form Doc type form. html Doc type HTML. jam Doc type Jam. jpeg Doc type JPEG. mp4 Doc type MP4. mpeg Doc type MPEG. msexcel Doc type MS Excel. mspowerpoint Doc type MS Powerpoint. msword Doc type MS Word. pdf Doc type PDF. png Doc type PNG. presentation Doc type presentation. quicktime Doc type Quicktime. script Doc type is Google Script. shortcut Doc type is Google Shortcut. sites Doc type is Google Sites. spreadsheet Doc type spreadsheet. shared_drive Doc type is a shared drive. txt Doc type txt. unknown Doc type unknown. is_encrypted boolean Whether the file is client side encrypted. originating_app_id string The Google Cloud Project ID of the application that performed the action. Use the Drive REST API to retrieve the app title. owner string Email address of the document's owner. For items contained in a shared drive, the owner is the name of the shared drive. owner_is_shared_drive boolean Boolean flag denoting whether owner is a shared drive. owner_shared_drive_id string The shared drive root id if the document owner is shared drive. primary_event boolean Whether this is a primary event. A single user action in Drive may generate several events, multiple of which can be primary (primary_event=true). The remaining events are deemed to be side effects of the primary event(s) (primary_event=false). For example, when a user creates a document, several events are generated, with only the create event having primary_event=true. But when a user shares a document with multiple other users in one action, an access change event having primary_event=true is created for each sharee. Possible values: false Boolean value false. true Boolean value true. shared_drive_id string The unique identifier of the shared drive. Only populated for events or items from a shared drive. visibility string Visibility of Target File. Possible values: people_with_link Anyone with the link can access. people_within_domain_with_link Anyone with the link within the audience can access. private Private. public_in_the_domain Anyone within the audience can access. public_on_the_web Public on the web. shared_externally Shared with explicit users/groups external to the domain. shared_internally Shared with explicit users/groups internal to the domain. unknown Unknown visibility.
Sample request	GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/drive?eventName=delete_comment&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format	{actor} deleted a comment

Comment edited

A comment was edited.

Event details
Event name	edit_comment
Parameters	actor_is_collaborator_account boolean Whether actor is a collaborator account. billable boolean Whether this activity is billable. doc_id string Document Id. doc_title string Document title. doc_type string Document type. Possible values: document Doc type document. drawing Doc type drawing. folder Doc type folder. form Doc type form. html Doc type HTML. jam Doc type Jam. jpeg Doc type JPEG. mp4 Doc type MP4. mpeg Doc type MPEG. msexcel Doc type MS Excel. mspowerpoint Doc type MS Powerpoint. msword Doc type MS Word. pdf Doc type PDF. png Doc type PNG. presentation Doc type presentation. quicktime Doc type Quicktime. script Doc type is Google Script. shortcut Doc type is Google Shortcut. sites Doc type is Google Sites. spreadsheet Doc type spreadsheet. shared_drive Doc type is a shared drive. txt Doc type txt. unknown Doc type unknown. is_encrypted boolean Whether the file is client side encrypted. originating_app_id string The Google Cloud Project ID of the application that performed the action. Use the Drive REST API to retrieve the app title. owner string Email address of the document's owner. For items contained in a shared drive, the owner is the name of the shared drive. owner_is_shared_drive boolean Boolean flag denoting whether owner is a shared drive. owner_shared_drive_id string The shared drive root id if the document owner is shared drive. primary_event boolean Whether this is a primary event. A single user action in Drive may generate several events, multiple of which can be primary (primary_event=true). The remaining events are deemed to be side effects of the primary event(s) (primary_event=false). For example, when a user creates a document, several events are generated, with only the create event having primary_event=true. But when a user shares a document with multiple other users in one action, an access change event having primary_event=true is created for each sharee. Possible values: false Boolean value false. true Boolean value true. shared_drive_id string The unique identifier of the shared drive. Only populated for events or items from a shared drive. visibility string Visibility of Target File. Possible values: people_with_link Anyone with the link can access. people_within_domain_with_link Anyone with the link within the audience can access. private Private. public_in_the_domain Anyone within the audience can access. public_on_the_web Public on the web. shared_externally Shared with explicit users/groups external to the domain. shared_internally Shared with explicit users/groups internal to the domain. unknown Unknown visibility.
Sample request	GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/drive?eventName=edit_comment&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format	{actor} edited a comment

Comment reassigned

A comment was reassigned.

Event details
Event name	reassign_comment
Parameters	actor_is_collaborator_account boolean Whether actor is a collaborator account. billable boolean Whether this activity is billable. doc_id string Document Id. doc_title string Document title. doc_type string Document type. Possible values: document Doc type document. drawing Doc type drawing. folder Doc type folder. form Doc type form. html Doc type HTML. jam Doc type Jam. jpeg Doc type JPEG. mp4 Doc type MP4. mpeg Doc type MPEG. msexcel Doc type MS Excel. mspowerpoint Doc type MS Powerpoint. msword Doc type MS Word. pdf Doc type PDF. png Doc type PNG. presentation Doc type presentation. quicktime Doc type Quicktime. script Doc type is Google Script. shortcut Doc type is Google Shortcut. sites Doc type is Google Sites. spreadsheet Doc type spreadsheet. shared_drive Doc type is a shared drive. txt Doc type txt. unknown Doc type unknown. is_encrypted boolean Whether the file is client side encrypted. originating_app_id string The Google Cloud Project ID of the application that performed the action. Use the Drive REST API to retrieve the app title. owner string Email address of the document's owner. For items contained in a shared drive, the owner is the name of the shared drive. owner_is_shared_drive boolean Boolean flag denoting whether owner is a shared drive. owner_shared_drive_id string The shared drive root id if the document owner is shared drive. primary_event boolean Whether this is a primary event. A single user action in Drive may generate several events, multiple of which can be primary (primary_event=true). The remaining events are deemed to be side effects of the primary event(s) (primary_event=false). For example, when a user creates a document, several events are generated, with only the create event having primary_event=true. But when a user shares a document with multiple other users in one action, an access change event having primary_event=true is created for each sharee. Possible values: false Boolean value false. true Boolean value true. shared_drive_id string The unique identifier of the shared drive. Only populated for events or items from a shared drive. visibility string Visibility of Target File. Possible values: people_with_link Anyone with the link can access. people_within_domain_with_link Anyone with the link within the audience can access. private Private. public_in_the_domain Anyone within the audience can access. public_on_the_web Public on the web. shared_externally Shared with explicit users/groups external to the domain. shared_internally Shared with explicit users/groups internal to the domain. unknown Unknown visibility.
Sample request	GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/drive?eventName=reassign_comment&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format	{actor} reassigned a comment

Comment reopened

A comment was reopened.

Event details
Event name	reopen_comment
Parameters	actor_is_collaborator_account boolean Whether actor is a collaborator account. billable boolean Whether this activity is billable. doc_id string Document Id. doc_title string Document title. doc_type string Document type. Possible values: document Doc type document. drawing Doc type drawing. folder Doc type folder. form Doc type form. html Doc type HTML. jam Doc type Jam. jpeg Doc type JPEG. mp4 Doc type MP4. mpeg Doc type MPEG. msexcel Doc type MS Excel. mspowerpoint Doc type MS Powerpoint. msword Doc type MS Word. pdf Doc type PDF. png Doc type PNG. presentation Doc type presentation. quicktime Doc type Quicktime. script Doc type is Google Script. shortcut Doc type is Google Shortcut. sites Doc type is Google Sites. spreadsheet Doc type spreadsheet. shared_drive Doc type is a shared drive. txt Doc type txt. unknown Doc type unknown. is_encrypted boolean Whether the file is client side encrypted. originating_app_id string The Google Cloud Project ID of the application that performed the action. Use the Drive REST API to retrieve the app title. owner string Email address of the document's owner. For items contained in a shared drive, the owner is the name of the shared drive. owner_is_shared_drive boolean Boolean flag denoting whether owner is a shared drive. owner_shared_drive_id string The shared drive root id if the document owner is shared drive. primary_event boolean Whether this is a primary event. A single user action in Drive may generate several events, multiple of which can be primary (primary_event=true). The remaining events are deemed to be side effects of the primary event(s) (primary_event=false). For example, when a user creates a document, several events are generated, with only the create event having primary_event=true. But when a user shares a document with multiple other users in one action, an access change event having primary_event=true is created for each sharee. Possible values: false Boolean value false. true Boolean value true. shared_drive_id string The unique identifier of the shared drive. Only populated for events or items from a shared drive. visibility string Visibility of Target File. Possible values: people_with_link Anyone with the link can access. people_within_domain_with_link Anyone with the link within the audience can access. private Private. public_in_the_domain Anyone within the audience can access. public_on_the_web Public on the web. shared_externally Shared with explicit users/groups external to the domain. shared_internally Shared with explicit users/groups internal to the domain. unknown Unknown visibility.
Sample request	GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/drive?eventName=reopen_comment&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format	{actor} reopened a comment

Comment resolved

A comment was resolved.

Event details
Event name	resolve_comment
Parameters	actor_is_collaborator_account boolean Whether actor is a collaborator account. billable boolean Whether this activity is billable. doc_id string Document Id. doc_title string Document title. doc_type string Document type. Possible values: document Doc type document. drawing Doc type drawing. folder Doc type folder. form Doc type form. html Doc type HTML. jam Doc type Jam. jpeg Doc type JPEG. mp4 Doc type MP4. mpeg Doc type MPEG. msexcel Doc type MS Excel. mspowerpoint Doc type MS Powerpoint. msword Doc type MS Word. pdf Doc type PDF. png Doc type PNG. presentation Doc type presentation. quicktime Doc type Quicktime. script Doc type is Google Script. shortcut Doc type is Google Shortcut. sites Doc type is Google Sites. spreadsheet Doc type spreadsheet. shared_drive Doc type is a shared drive. txt Doc type txt. unknown Doc type unknown. is_encrypted boolean Whether the file is client side encrypted. originating_app_id string The Google Cloud Project ID of the application that performed the action. Use the Drive REST API to retrieve the app title. owner string Email address of the document's owner. For items contained in a shared drive, the owner is the name of the shared drive. owner_is_shared_drive boolean Boolean flag denoting whether owner is a shared drive. owner_shared_drive_id string The shared drive root id if the document owner is shared drive. primary_event boolean Whether this is a primary event. A single user action in Drive may generate several events, multiple of which can be primary (primary_event=true). The remaining events are deemed to be side effects of the primary event(s) (primary_event=false). For example, when a user creates a document, several events are generated, with only the create event having primary_event=true. But when a user shares a document with multiple other users in one action, an access change event having primary_event=true is created for each sharee. Possible values: false Boolean value false. true Boolean value true. shared_drive_id string The unique identifier of the shared drive. Only populated for events or items from a shared drive. visibility string Visibility of Target File. Possible values: people_with_link Anyone with the link can access. people_within_domain_with_link Anyone with the link within the audience can access. private Private. public_in_the_domain Anyone within the audience can access. public_on_the_web Public on the web. shared_externally Shared with explicit users/groups external to the domain. shared_internally Shared with explicit users/groups internal to the domain. unknown Unknown visibility.
Sample request	GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/drive?eventName=resolve_comment&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format	{actor} resolved a comment

Connected Sheets Query

Event details
Event name	connected_sheets_query
Parameters	actor_is_collaborator_account boolean Whether actor is a collaborator account. billable boolean Whether this activity is billable. data_connection_id string Data connection ID. delegating_principal string Delegating user whose credentials are used. doc_id string Document Id. doc_title string Document title. doc_type string Document type. Possible values: document Doc type document. drawing Doc type drawing. folder Doc type folder. form Doc type form. html Doc type HTML. jam Doc type Jam. jpeg Doc type JPEG. mp4 Doc type MP4. mpeg Doc type MPEG. msexcel Doc type MS Excel. mspowerpoint Doc type MS Powerpoint. msword Doc type MS Word. pdf Doc type PDF. png Doc type PNG. presentation Doc type presentation. quicktime Doc type Quicktime. script Doc type is Google Script. shortcut Doc type is Google Shortcut. sites Doc type is Google Sites. spreadsheet Doc type spreadsheet. shared_drive Doc type is a shared drive. txt Doc type txt. unknown Doc type unknown. execution_id string Query execution ID. execution_trigger string The trigger for the query execution. Possible values: api One Platform API execution trigger. apps_script Apps Script execution trigger. scheduled Scheduled execution trigger. sheets_ui Sheets UI execution trigger. is_encrypted boolean Whether the file is client side encrypted. originating_app_id string The Google Cloud Project ID of the application that performed the action. Use the Drive REST API to retrieve the app title. owner string Email address of the document's owner. For items contained in a shared drive, the owner is the name of the shared drive. owner_is_shared_drive boolean Boolean flag denoting whether owner is a shared drive. owner_shared_drive_id string The shared drive root id if the document owner is shared drive. primary_event boolean Whether this is a primary event. A single user action in Drive may generate several events, multiple of which can be primary (primary_event=true). The remaining events are deemed to be side effects of the primary event(s) (primary_event=false). For example, when a user creates a document, several events are generated, with only the create event having primary_event=true. But when a user shares a document with multiple other users in one action, an access change event having primary_event=true is created for each sharee. Possible values: false Boolean value false. true Boolean value true. query_type string Type of query. Possible values: big_query BigQuery. looker Looker. shared_drive_id string The unique identifier of the shared drive. Only populated for events or items from a shared drive. shared_drive_id string The unique identifier of the shared drive. Only populated for events or items from a shared drive. visibility string Visibility of Target File. Possible values: people_with_link Anyone with the link can access. people_within_domain_with_link Anyone with the link within the audience can access. private Private. public_in_the_domain Anyone within the audience can access. public_on_the_web Public on the web. shared_externally Shared with explicit users/groups external to the domain. shared_internally Shared with explicit users/groups internal to the domain. unknown Unknown visibility.
Sample request	GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/drive?eventName=connected_sheets_query&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format	{execution_trigger} {query_type} query executed

Copy

Document copy.

Event details
Event name	copy
Parameters	actor_is_collaborator_account boolean Whether actor is a collaborator account. billable boolean Whether this activity is billable. copy_type string Doc copy type. Possible values: external Copy type external. internal Copy type internal. doc_id string Document Id. doc_title string Document title. doc_type string Document type. Possible values: document Doc type document. drawing Doc type drawing. folder Doc type folder. form Doc type form. html Doc type HTML. jam Doc type Jam. jpeg Doc type JPEG. mp4 Doc type MP4. mpeg Doc type MPEG. msexcel Doc type MS Excel. mspowerpoint Doc type MS Powerpoint. msword Doc type MS Word. pdf Doc type PDF. png Doc type PNG. presentation Doc type presentation. quicktime Doc type Quicktime. script Doc type is Google Script. shortcut Doc type is Google Shortcut. sites Doc type is Google Sites. spreadsheet Doc type spreadsheet. shared_drive Doc type is a shared drive. txt Doc type txt. unknown Doc type unknown. encryption_change string The encryption change that happened as part of this copy. An unset value indicates that no encryption change happened. Possible values: decrypted_copy An unencrypted item was created from an encrypted item. encrypted_copy An encrypted item was created from an unencrypted item. is_encrypted boolean Whether the file is client side encrypted. new_value string New Value. old_value string Old Value. originating_app_id string The Google Cloud Project ID of the application that performed the action. Use the Drive REST API to retrieve the app title. owner string Email address of the document's owner. For items contained in a shared drive, the owner is the name of the shared drive. owner_is_shared_drive boolean Boolean flag denoting whether owner is a shared drive. owner_shared_drive_id string The shared drive root id if the document owner is shared drive. primary_event boolean Whether this is a primary event. A single user action in Drive may generate several events, multiple of which can be primary (primary_event=true). The remaining events are deemed to be side effects of the primary event(s) (primary_event=false). For example, when a user creates a document, several events are generated, with only the create event having primary_event=true. But when a user shares a document with multiple other users in one action, an access change event having primary_event=true is created for each sharee. Possible values: false Boolean value false. true Boolean value true. shared_drive_id string The unique identifier of the shared drive. Only populated for events or items from a shared drive. visibility string Visibility of Target File. Possible values: people_with_link Anyone with the link can access. people_within_domain_with_link Anyone with the link within the audience can access. private Private. public_in_the_domain Anyone within the audience can access. public_on_the_web Public on the web. shared_externally Shared with explicit users/groups external to the domain. shared_internally Shared with explicit users/groups internal to the domain. unknown Unknown visibility.
Sample request	GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/drive?eventName=copy&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format	{actor} created a copy of original document {old_value}

Create

Document create.

Event details
Event name	create
Parameters	actor_is_collaborator_account boolean Whether actor is a collaborator account. billable boolean Whether this activity is billable. doc_id string Document Id. doc_title string Document title. doc_type string Document type. Possible values: document Doc type document. drawing Doc type drawing. folder Doc type folder. form Doc type form. html Doc type HTML. jam Doc type Jam. jpeg Doc type JPEG. mp4 Doc type MP4. mpeg Doc type MPEG. msexcel Doc type MS Excel. mspowerpoint Doc type MS Powerpoint. msword Doc type MS Word. pdf Doc type PDF. png Doc type PNG. presentation Doc type presentation. quicktime Doc type Quicktime. script Doc type is Google Script. shortcut Doc type is Google Shortcut. sites Doc type is Google Sites. spreadsheet Doc type spreadsheet. shared_drive Doc type is a shared drive. txt Doc type txt. unknown Doc type unknown. is_encrypted boolean Whether the file is client side encrypted. originating_app_id string The Google Cloud Project ID of the application that performed the action. Use the Drive REST API to retrieve the app title. owner string Email address of the document's owner. For items contained in a shared drive, the owner is the name of the shared drive. owner_is_shared_drive boolean Boolean flag denoting whether owner is a shared drive. owner_shared_drive_id string The shared drive root id if the document owner is shared drive. primary_event boolean Whether this is a primary event. A single user action in Drive may generate several events, multiple of which can be primary (primary_event=true). The remaining events are deemed to be side effects of the primary event(s) (primary_event=false). For example, when a user creates a document, several events are generated, with only the create event having primary_event=true. But when a user shares a document with multiple other users in one action, an access change event having primary_event=true is created for each sharee. Possible values: false Boolean value false. true Boolean value true. shared_drive_id string The unique identifier of the shared drive. Only populated for events or items from a shared drive. visibility string Visibility of Target File. Possible values: people_with_link Anyone with the link can access. people_within_domain_with_link Anyone with the link within the audience can access. private Private. public_in_the_domain Anyone within the audience can access. public_on_the_web Public on the web. shared_externally Shared with explicit users/groups external to the domain. shared_internally Shared with explicit users/groups internal to the domain. unknown Unknown visibility.
Sample request	GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/drive?eventName=create&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format	{actor} created an item

Delete

Document delete.

Event details
Event name	delete
Parameters	actor_is_collaborator_account boolean Whether actor is a collaborator account. billable boolean Whether this activity is billable. doc_id string Document Id. doc_title string Document title. doc_type string Document type. Possible values: document Doc type document. drawing Doc type drawing. folder Doc type folder. form Doc type form. html Doc type HTML. jam Doc type Jam. jpeg Doc type JPEG. mp4 Doc type MP4. mpeg Doc type MPEG. msexcel Doc type MS Excel. mspowerpoint Doc type MS Powerpoint. msword Doc type MS Word. pdf Doc type PDF. png Doc type PNG. presentation Doc type presentation. quicktime Doc type Quicktime. script Doc type is Google Script. shortcut Doc type is Google Shortcut. sites Doc type is Google Sites. spreadsheet Doc type spreadsheet. shared_drive Doc type is a shared drive. txt Doc type txt. unknown Doc type unknown. is_encrypted boolean Whether the file is client side encrypted. originating_app_id string The Google Cloud Project ID of the application that performed the action. Use the Drive REST API to retrieve the app title. owner string Email address of the document's owner. For items contained in a shared drive, the owner is the name of the shared drive. owner_is_shared_drive boolean Boolean flag denoting whether owner is a shared drive. owner_shared_drive_id string The shared drive root id if the document owner is shared drive. primary_event boolean Whether this is a primary event. A single user action in Drive may generate several events, multiple of which can be primary (primary_event=true). The remaining events are deemed to be side effects of the primary event(s) (primary_event=false). For example, when a user creates a document, several events are generated, with only the create event having primary_event=true. But when a user shares a document with multiple other users in one action, an access change event having primary_event=true is created for each sharee. Possible values: false Boolean value false. true Boolean value true. shared_drive_id string The unique identifier of the shared drive. Only populated for events or items from a shared drive. visibility string Visibility of Target File. Possible values: people_with_link Anyone with the link can access. people_within_domain_with_link Anyone with the link within the audience can access. private Private. public_in_the_domain Anyone within the audience can access. public_on_the_web Public on the web. shared_externally Shared with explicit users/groups external to the domain. shared_internally Shared with explicit users/groups internal to the domain. unknown Unknown visibility.
Sample request	GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/drive?eventName=delete&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format	{actor} deleted an item

Download

Document download.

Event details
Event name	download
Parameters	actor_is_collaborator_account boolean Whether actor is a collaborator account. billable boolean Whether this activity is billable. doc_id string Document Id. doc_title string Document title. doc_type string Document type. Possible values: document Doc type document. drawing Doc type drawing. folder Doc type folder. form Doc type form. html Doc type HTML. jam Doc type Jam. jpeg Doc type JPEG. mp4 Doc type MP4. mpeg Doc type MPEG. msexcel Doc type MS Excel. mspowerpoint Doc type MS Powerpoint. msword Doc type MS Word. pdf Doc type PDF. png Doc type PNG. presentation Doc type presentation. quicktime Doc type Quicktime. script Doc type is Google Script. shortcut Doc type is Google Shortcut. sites Doc type is Google Sites. spreadsheet Doc type spreadsheet. shared_drive Doc type is a shared drive. txt Doc type txt. unknown Doc type unknown. is_encrypted boolean Whether the file is client side encrypted. originating_app_id string The Google Cloud Project ID of the application that performed the action. Use the Drive REST API to retrieve the app title. owner string Email address of the document's owner. For items contained in a shared drive, the owner is the name of the shared drive. owner_is_shared_drive boolean Boolean flag denoting whether owner is a shared drive. owner_shared_drive_id string The shared drive root id if the document owner is shared drive. primary_event boolean Whether this is a primary event. A single user action in Drive may generate several events, multiple of which can be primary (primary_event=true). The remaining events are deemed to be side effects of the primary event(s) (primary_event=false). For example, when a user creates a document, several events are generated, with only the create event having primary_event=true. But when a user shares a document with multiple other users in one action, an access change event having primary_event=true is created for each sharee. Possible values: false Boolean value false. true Boolean value true. shared_drive_id string The unique identifier of the shared drive. Only populated for events or items from a shared drive. visibility string Visibility of Target File. Possible values: people_with_link Anyone with the link can access. people_within_domain_with_link Anyone with the link within the audience can access. private Private. public_in_the_domain Anyone within the audience can access. public_on_the_web Public on the web. shared_externally Shared with explicit users/groups external to the domain. shared_internally Shared with explicit users/groups internal to the domain. unknown Unknown visibility.
Sample request	GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/drive?eventName=download&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format	{actor} downloaded an item

Drive Email as Attachment

Event details
Event name	email_as_attachment
Parameters	actor_is_collaborator_account boolean Whether actor is a collaborator account. billable boolean Whether this activity is billable. doc_id string Document Id. doc_title string Document title. doc_type string Document type. Possible values: document Doc type document. drawing Doc type drawing. folder Doc type folder. form Doc type form. html Doc type HTML. jam Doc type Jam. jpeg Doc type JPEG. mp4 Doc type MP4. mpeg Doc type MPEG. msexcel Doc type MS Excel. mspowerpoint Doc type MS Powerpoint. msword Doc type MS Word. pdf Doc type PDF. png Doc type PNG. presentation Doc type presentation. quicktime Doc type Quicktime. script Doc type is Google Script. shortcut Doc type is Google Shortcut. sites Doc type is Google Sites. spreadsheet Doc type spreadsheet. shared_drive Doc type is a shared drive. txt Doc type txt. unknown Doc type unknown. is_encrypted boolean Whether the file is client side encrypted. originating_app_id string The Google Cloud Project ID of the application that performed the action. Use the Drive REST API to retrieve the app title. owner string Email address of the document's owner. For items contained in a shared drive, the owner is the name of the shared drive. owner_is_shared_drive boolean Boolean flag denoting whether owner is a shared drive. owner_shared_drive_id string The shared drive root id if the document owner is shared drive. primary_event boolean Whether this is a primary event. A single user action in Drive may generate several events, multiple of which can be primary (primary_event=true). The remaining events are deemed to be side effects of the primary event(s) (primary_event=false). For example, when a user creates a document, several events are generated, with only the create event having primary_event=true. But when a user shares a document with multiple other users in one action, an access change event having primary_event=true is created for each sharee. Possible values: false Boolean value false. true Boolean value true. target string Target User or Group. shared_drive_id string The unique identifier of the shared drive. Only populated for events or items from a shared drive. visibility string Visibility of Target File. Possible values: people_with_link Anyone with the link can access. people_within_domain_with_link Anyone with the link within the audience can access. private Private. public_in_the_domain Anyone within the audience can access. public_on_the_web Public on the web. shared_externally Shared with explicit users/groups external to the domain. shared_internally Shared with explicit users/groups internal to the domain. unknown Unknown visibility.
Sample request	GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/drive?eventName=email_as_attachment&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format	{actor} shared this document as an email attachment to {target}

Edit

Document edit.

Event details
Event name	edit
Parameters	actor_is_collaborator_account boolean Whether actor is a collaborator account. billable boolean Whether this activity is billable. doc_id string Document Id. doc_title string Document title. doc_type string Document type. Possible values: document Doc type document. drawing Doc type drawing. folder Doc type folder. form Doc type form. html Doc type HTML. jam Doc type Jam. jpeg Doc type JPEG. mp4 Doc type MP4. mpeg Doc type MPEG. msexcel Doc type MS Excel. mspowerpoint Doc type MS Powerpoint. msword Doc type MS Word. pdf Doc type PDF. png Doc type PNG. presentation Doc type presentation. quicktime Doc type Quicktime. script Doc type is Google Script. shortcut Doc type is Google Shortcut. sites Doc type is Google Sites. spreadsheet Doc type spreadsheet. shared_drive Doc type is a shared drive. txt Doc type txt. unknown Doc type unknown. is_encrypted boolean Whether the file is client side encrypted. originating_app_id string The Google Cloud Project ID of the application that performed the action. Use the Drive REST API to retrieve the app title. owner string Email address of the document's owner. For items contained in a shared drive, the owner is the name of the shared drive. owner_is_shared_drive boolean Boolean flag denoting whether owner is a shared drive. owner_shared_drive_id string The shared drive root id if the document owner is shared drive. primary_event boolean Whether this is a primary event. A single user action in Drive may generate several events, multiple of which can be primary (primary_event=true). The remaining events are deemed to be side effects of the primary event(s) (primary_event=false). For example, when a user creates a document, several events are generated, with only the create event having primary_event=true. But when a user shares a document with multiple other users in one action, an access change event having primary_event=true is created for each sharee. Possible values: false Boolean value false. true Boolean value true. shared_drive_id string The unique identifier of the shared drive. Only populated for events or items from a shared drive. visibility string Visibility of Target File. Possible values: people_with_link Anyone with the link can access. people_within_domain_with_link Anyone with the link within the audience can access. private Private. public_in_the_domain Anyone within the audience can access. public_on_the_web Public on the web. shared_externally Shared with explicit users/groups external to the domain. shared_internally Shared with explicit users/groups internal to the domain. unknown Unknown visibility.
Sample request	GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/drive?eventName=edit&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format	{actor} edited an item

Email collaborators

A user emailed this item's collaborators.

Event details
Event name	email_collaborators
Parameters	actor_is_collaborator_account boolean Whether actor is a collaborator account. billable boolean Whether this activity is billable. doc_id string Document Id. doc_title string Document title. doc_type string Document type. Possible values: document Doc type document. drawing Doc type drawing. folder Doc type folder. form Doc type form. html Doc type HTML. jam Doc type Jam. jpeg Doc type JPEG. mp4 Doc type MP4. mpeg Doc type MPEG. msexcel Doc type MS Excel. mspowerpoint Doc type MS Powerpoint. msword Doc type MS Word. pdf Doc type PDF. png Doc type PNG. presentation Doc type presentation. quicktime Doc type Quicktime. script Doc type is Google Script. shortcut Doc type is Google Shortcut. sites Doc type is Google Sites. spreadsheet Doc type spreadsheet. shared_drive Doc type is a shared drive. txt Doc type txt. unknown Doc type unknown. is_encrypted boolean Whether the file is client side encrypted. originating_app_id string The Google Cloud Project ID of the application that performed the action. Use the Drive REST API to retrieve the app title. owner string Email address of the document's owner. For items contained in a shared drive, the owner is the name of the shared drive. owner_is_shared_drive boolean Boolean flag denoting whether owner is a shared drive. owner_shared_drive_id string The shared drive root id if the document owner is shared drive. primary_event boolean Whether this is a primary event. A single user action in Drive may generate several events, multiple of which can be primary (primary_event=true). The remaining events are deemed to be side effects of the primary event(s) (primary_event=false). For example, when a user creates a document, several events are generated, with only the create event having primary_event=true. But when a user shares a document with multiple other users in one action, an access change event having primary_event=true is created for each sharee. Possible values: false Boolean value false. true Boolean value true. recipients string Email addresses of the recipients. shared_drive_id string The unique identifier of the shared drive. Only populated for events or items from a shared drive. visibility string Visibility of Target File. Possible values: people_with_link Anyone with the link can access. people_within_domain_with_link Anyone with the link within the audience can access. private Private. public_in_the_domain Anyone within the audience can access. public_on_the_web Public on the web. shared_externally Shared with explicit users/groups external to the domain. shared_internally Shared with explicit users/groups internal to the domain. unknown Unknown visibility.
Sample request	GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/drive?eventName=email_collaborators&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format	{actor} emailed collaborators of an item

Forms Responses Downloaded

Download Forms Response.

Event details
Event name	download_forms_response
Parameters	actor_is_collaborator_account boolean Whether actor is a collaborator account. billable boolean Whether this activity is billable. doc_id string Document Id. doc_title string Document title. doc_type string Document type. Possible values: document Doc type document. drawing Doc type drawing. folder Doc type folder. form Doc type form. html Doc type HTML. jam Doc type Jam. jpeg Doc type JPEG. mp4 Doc type MP4. mpeg Doc type MPEG. msexcel Doc type MS Excel. mspowerpoint Doc type MS Powerpoint. msword Doc type MS Word. pdf Doc type PDF. png Doc type PNG. presentation Doc type presentation. quicktime Doc type Quicktime. script Doc type is Google Script. shortcut Doc type is Google Shortcut. sites Doc type is Google Sites. spreadsheet Doc type spreadsheet. shared_drive Doc type is a shared drive. txt Doc type txt. unknown Doc type unknown. is_encrypted boolean Whether the file is client side encrypted. originating_app_id string The Google Cloud Project ID of the application that performed the action. Use the Drive REST API to retrieve the app title. owner string Email address of the document's owner. For items contained in a shared drive, the owner is the name of the shared drive. owner_is_shared_drive boolean Boolean flag denoting whether owner is a shared drive. owner_shared_drive_id string The shared drive root id if the document owner is shared drive. primary_event boolean Whether this is a primary event. A single user action in Drive may generate several events, multiple of which can be primary (primary_event=true). The remaining events are deemed to be side effects of the primary event(s) (primary_event=false). For example, when a user creates a document, several events are generated, with only the create event having primary_event=true. But when a user shares a document with multiple other users in one action, an access change event having primary_event=true is created for each sharee. Possible values: false Boolean value false. true Boolean value true. shared_drive_id string The unique identifier of the shared drive. Only populated for events or items from a shared drive. visibility string Visibility of Target File. Possible values: people_with_link Anyone with the link can access. people_within_domain_with_link Anyone with the link within the audience can access. private Private. public_in_the_domain Anyone within the audience can access. public_on_the_web Public on the web. shared_externally Shared with explicit users/groups external to the domain. shared_internally Shared with explicit users/groups internal to the domain. unknown Unknown visibility.
Sample request	GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/drive?eventName=download_forms_response&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format	{actor} downloaded forms responses

Label applied

Label was applied.

Event details
Event name	label_added
Parameters	doc_id string Document Id. doc_title string Document title. doc_type string Document type. Possible values: document Doc type document. drawing Doc type drawing. folder Doc type folder. form Doc type form. html Doc type HTML. jam Doc type Jam. jpeg Doc type JPEG. mp4 Doc type MP4. mpeg Doc type MPEG. msexcel Doc type MS Excel. mspowerpoint Doc type MS Powerpoint. msword Doc type MS Word. pdf Doc type PDF. png Doc type PNG. presentation Doc type presentation. quicktime Doc type Quicktime. script Doc type is Google Script. shortcut Doc type is Google Shortcut. sites Doc type is Google Sites. spreadsheet Doc type spreadsheet. shared_drive Doc type is a shared drive. txt Doc type txt. unknown Doc type unknown. is_encrypted boolean Whether the file is client side encrypted. label string The unique Identifier of a Label. label_title string Label title. originating_app_id string The Google Cloud Project ID of the application that performed the action. Use the Drive REST API to retrieve the app title. owner string Email address of the document's owner. For items contained in a shared drive, the owner is the name of the shared drive. owner_is_shared_drive boolean Boolean flag denoting whether owner is a shared drive. owner_shared_drive_id string The shared drive root id if the document owner is shared drive. primary_event boolean Whether this is a primary event. A single user action in Drive may generate several events, multiple of which can be primary (primary_event=true). The remaining events are deemed to be side effects of the primary event(s) (primary_event=false). For example, when a user creates a document, several events are generated, with only the create event having primary_event=true. But when a user shares a document with multiple other users in one action, an access change event having primary_event=true is created for each sharee. Possible values: false Boolean value false. true Boolean value true. reason string Reason for label addition, removal, or value change event. Possible values: copy Reason for change Drive item copy. default_label Reason for change default label behavior. dlp_action Reason for change DLP. reason_unspecified Reason for change unspecified. user_action Reason for change is a user action. shared_drive_id string The unique identifier of the shared drive. Only populated for events or items from a shared drive. visibility string Visibility of Target File. Possible values: people_with_link Anyone with the link can access. people_within_domain_with_link Anyone with the link within the audience can access. private Private. public_in_the_domain Anyone within the audience can access. public_on_the_web Public on the web. shared_externally Shared with explicit users/groups external to the domain. shared_internally Shared with explicit users/groups internal to the domain. unknown Unknown visibility.
Sample request	GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/drive?eventName=label_added&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format	{actor} applied Label {label_title}.

Label applied on creation

Label was applied automatically when the Drive item was created.

Event details
Event name	label_added_by_item_create
Parameters	doc_id string Document Id. doc_title string Document title. doc_type string Document type. Possible values: document Doc type document. drawing Doc type drawing. folder Doc type folder. form Doc type form. html Doc type HTML. jam Doc type Jam. jpeg Doc type JPEG. mp4 Doc type MP4. mpeg Doc type MPEG. msexcel Doc type MS Excel. mspowerpoint Doc type MS Powerpoint. msword Doc type MS Word. pdf Doc type PDF. png Doc type PNG. presentation Doc type presentation. quicktime Doc type Quicktime. script Doc type is Google Script. shortcut Doc type is Google Shortcut. sites Doc type is Google Sites. spreadsheet Doc type spreadsheet. shared_drive Doc type is a shared drive. txt Doc type txt. unknown Doc type unknown. is_encrypted boolean Whether the file is client side encrypted. label string The unique Identifier of a Label. label_title string Label title. originating_app_id string The Google Cloud Project ID of the application that performed the action. Use the Drive REST API to retrieve the app title. owner string Email address of the document's owner. For items contained in a shared drive, the owner is the name of the shared drive. owner_is_shared_drive boolean Boolean flag denoting whether owner is a shared drive. owner_shared_drive_id string The shared drive root id if the document owner is shared drive. primary_event boolean Whether this is a primary event. A single user action in Drive may generate several events, multiple of which can be primary (primary_event=true). The remaining events are deemed to be side effects of the primary event(s) (primary_event=false). For example, when a user creates a document, several events are generated, with only the create event having primary_event=true. But when a user shares a document with multiple other users in one action, an access change event having primary_event=true is created for each sharee. Possible values: false Boolean value false. true Boolean value true. reason string Reason for label addition, removal, or value change event. Possible values: copy Reason for change Drive item copy. default_label Reason for change default label behavior. dlp_action Reason for change DLP. reason_unspecified Reason for change unspecified. user_action Reason for change is a user action. shared_drive_id string The unique identifier of the shared drive. Only populated for events or items from a shared drive. visibility string Visibility of Target File. Possible values: people_with_link Anyone with the link can access. people_within_domain_with_link Anyone with the link within the audience can access. private Private. public_in_the_domain Anyone within the audience can access. public_on_the_web Public on the web. shared_externally Shared with explicit users/groups external to the domain. shared_internally Shared with explicit users/groups internal to the domain. unknown Unknown visibility.
Sample request	GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/drive?eventName=label_added_by_item_create&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format	Label {label_title} was automatically applied on creation.

Label field value changed

Label Field value was changed.

Event details
Event name	label_field_changed
Parameters	doc_id string Document Id. doc_title string Document title. doc_type string Document type. Possible values: document Doc type document. drawing Doc type drawing. folder Doc type folder. form Doc type form. html Doc type HTML. jam Doc type Jam. jpeg Doc type JPEG. mp4 Doc type MP4. mpeg Doc type MPEG. msexcel Doc type MS Excel. mspowerpoint Doc type MS Powerpoint. msword Doc type MS Word. pdf Doc type PDF. png Doc type PNG. presentation Doc type presentation. quicktime Doc type Quicktime. script Doc type is Google Script. shortcut Doc type is Google Shortcut. sites Doc type is Google Sites. spreadsheet Doc type spreadsheet. shared_drive Doc type is a shared drive. txt Doc type txt. unknown Doc type unknown. field string Label Field display name. field_id string Label Field ID. is_encrypted boolean Whether the file is client side encrypted. label string The unique Identifier of a Label. label_title string Label title. new_value string New Value. new_value_id string New Value IDs. old_value string Old Value. old_value_id string Old Value IDs. originating_app_id string The Google Cloud Project ID of the application that performed the action. Use the Drive REST API to retrieve the app title. owner string Email address of the document's owner. For items contained in a shared drive, the owner is the name of the shared drive. owner_is_shared_drive boolean Boolean flag denoting whether owner is a shared drive. owner_shared_drive_id string The shared drive root id if the document owner is shared drive. primary_event boolean Whether this is a primary event. A single user action in Drive may generate several events, multiple of which can be primary (primary_event=true). The remaining events are deemed to be side effects of the primary event(s) (primary_event=false). For example, when a user creates a document, several events are generated, with only the create event having primary_event=true. But when a user shares a document with multiple other users in one action, an access change event having primary_event=true is created for each sharee. Possible values: false Boolean value false. true Boolean value true. reason string Reason for label addition, removal, or value change event. Possible values: copy Reason for change Drive item copy. default_label Reason for change default label behavior. dlp_action Reason for change DLP. reason_unspecified Reason for change unspecified. user_action Reason for change is a user action. shared_drive_id string The unique identifier of the shared drive. Only populated for events or items from a shared drive. visibility string Visibility of Target File. Possible values: people_with_link Anyone with the link can access. people_within_domain_with_link Anyone with the link within the audience can access. private Private. public_in_the_domain Anyone within the audience can access. public_on_the_web Public on the web. shared_externally Shared with explicit users/groups external to the domain. shared_internally Shared with explicit users/groups internal to the domain. unknown Unknown visibility.
Sample request	GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/drive?eventName=label_field_changed&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format	{actor} changed the value of field {field} (Label: {label_title}) from '{old_value}' to '{new_value}'.

Label removed

Label was removed.

Event details
Event name	label_removed
Parameters	doc_id string Document Id. doc_title string Document title. doc_type string Document type. Possible values: document Doc type document. drawing Doc type drawing. folder Doc type folder. form Doc type form. html Doc type HTML. jam Doc type Jam. jpeg Doc type JPEG. mp4 Doc type MP4. mpeg Doc type MPEG. msexcel Doc type MS Excel. mspowerpoint Doc type MS Powerpoint. msword Doc type MS Word. pdf Doc type PDF. png Doc type PNG. presentation Doc type presentation. quicktime Doc type Quicktime. script Doc type is Google Script. shortcut Doc type is Google Shortcut. sites Doc type is Google Sites. spreadsheet Doc type spreadsheet. shared_drive Doc type is a shared drive. txt Doc type txt. unknown Doc type unknown. is_encrypted boolean Whether the file is client side encrypted. label string The unique Identifier of a Label. label_title string Label title. originating_app_id string The Google Cloud Project ID of the application that performed the action. Use the Drive REST API to retrieve the app title. owner string Email address of the document's owner. For items contained in a shared drive, the owner is the name of the shared drive. owner_is_shared_drive boolean Boolean flag denoting whether owner is a shared drive. owner_shared_drive_id string The shared drive root id if the document owner is shared drive. primary_event boolean Whether this is a primary event. A single user action in Drive may generate several events, multiple of which can be primary (primary_event=true). The remaining events are deemed to be side effects of the primary event(s) (primary_event=false). For example, when a user creates a document, several events are generated, with only the create event having primary_event=true. But when a user shares a document with multiple other users in one action, an access change event having primary_event=true is created for each sharee. Possible values: false Boolean value false. true Boolean value true. reason string Reason for label addition, removal, or value change event. Possible values: copy Reason for change Drive item copy. default_label Reason for change default label behavior. dlp_action Reason for change DLP. reason_unspecified Reason for change unspecified. user_action Reason for change is a user action. shared_drive_id string The unique identifier of the shared drive. Only populated for events or items from a shared drive. visibility string Visibility of Target File. Possible values: people_with_link Anyone with the link can access. people_within_domain_with_link Anyone with the link within the audience can access. private Private. public_in_the_domain Anyone within the audience can access. public_on_the_web Public on the web. shared_externally Shared with explicit users/groups external to the domain. shared_internally Shared with explicit users/groups internal to the domain. unknown Unknown visibility.
Sample request	GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/drive?eventName=label_removed&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format	{actor} removed Label {label_title}.

Lock

Document lock.

Event details
Event name	add_lock
Parameters	actor_is_collaborator_account boolean Whether actor is a collaborator account. billable boolean Whether this activity is billable. doc_id string Document Id. doc_title string Document title. doc_type string Document type. Possible values: document Doc type document. drawing Doc type drawing. folder Doc type folder. form Doc type form. html Doc type HTML. jam Doc type Jam. jpeg Doc type JPEG. mp4 Doc type MP4. mpeg Doc type MPEG. msexcel Doc type MS Excel. mspowerpoint Doc type MS Powerpoint. msword Doc type MS Word. pdf Doc type PDF. png Doc type PNG. presentation Doc type presentation. quicktime Doc type Quicktime. script Doc type is Google Script. shortcut Doc type is Google Shortcut. sites Doc type is Google Sites. spreadsheet Doc type spreadsheet. shared_drive Doc type is a shared drive. txt Doc type txt. unknown Doc type unknown. is_encrypted boolean Whether the file is client side encrypted. originating_app_id string The Google Cloud Project ID of the application that performed the action. Use the Drive REST API to retrieve the app title. owner string Email address of the document's owner. For items contained in a shared drive, the owner is the name of the shared drive. owner_is_shared_drive boolean Boolean flag denoting whether owner is a shared drive. owner_shared_drive_id string The shared drive root id if the document owner is shared drive. primary_event boolean Whether this is a primary event. A single user action in Drive may generate several events, multiple of which can be primary (primary_event=true). The remaining events are deemed to be side effects of the primary event(s) (primary_event=false). For example, when a user creates a document, several events are generated, with only the create event having primary_event=true. But when a user shares a document with multiple other users in one action, an access change event having primary_event=true is created for each sharee. Possible values: false Boolean value false. true Boolean value true. shared_drive_id string The unique identifier of the shared drive. Only populated for events or items from a shared drive. visibility string Visibility of Target File. Possible values: people_with_link Anyone with the link can access. people_within_domain_with_link Anyone with the link within the audience can access. private Private. public_in_the_domain Anyone within the audience can access. public_on_the_web Public on the web. shared_externally Shared with explicit users/groups external to the domain. shared_internally Shared with explicit users/groups internal to the domain. unknown Unknown visibility.
Sample request	GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/drive?eventName=add_lock&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format	{actor} locked an item

Move

Document move.

Event details
Event name	move
Parameters	actor_is_collaborator_account boolean Whether actor is a collaborator account. billable boolean Whether this activity is billable. destination_folder_id string Destination folder Id. destination_folder_title string Destination folder title. doc_id string Document Id. doc_title string Document title. doc_type string Document type. Possible values: document Doc type document. drawing Doc type drawing. folder Doc type folder. form Doc type form. html Doc type HTML. jam Doc type Jam. jpeg Doc type JPEG. mp4 Doc type MP4. mpeg Doc type MPEG. msexcel Doc type MS Excel. mspowerpoint Doc type MS Powerpoint. msword Doc type MS Word. pdf Doc type PDF. png Doc type PNG. presentation Doc type presentation. quicktime Doc type Quicktime. script Doc type is Google Script. shortcut Doc type is Google Shortcut. sites Doc type is Google Sites. spreadsheet Doc type spreadsheet. shared_drive Doc type is a shared drive. txt Doc type txt. unknown Doc type unknown. is_encrypted boolean Whether the file is client side encrypted. originating_app_id string The Google Cloud Project ID of the application that performed the action. Use the Drive REST API to retrieve the app title. owner string Email address of the document's owner. For items contained in a shared drive, the owner is the name of the shared drive. owner_is_shared_drive boolean Boolean flag denoting whether owner is a shared drive. owner_shared_drive_id string The shared drive root id if the document owner is shared drive. primary_event boolean Whether this is a primary event. A single user action in Drive may generate several events, multiple of which can be primary (primary_event=true). The remaining events are deemed to be side effects of the primary event(s) (primary_event=false). For example, when a user creates a document, several events are generated, with only the create event having primary_event=true. But when a user shares a document with multiple other users in one action, an access change event having primary_event=true is created for each sharee. Possible values: false Boolean value false. true Boolean value true. source_folder_id string Source folder Id. source_folder_title string Source folder title. shared_drive_id string The unique identifier of the shared drive. Only populated for events or items from a shared drive. visibility string Visibility of Target File. Possible values: people_with_link Anyone with the link can access. people_within_domain_with_link Anyone with the link within the audience can access. private Private. public_in_the_domain Anyone within the audience can access. public_on_the_web Public on the web. shared_externally Shared with explicit users/groups external to the domain. shared_internally Shared with explicit users/groups internal to the domain. unknown Unknown visibility.
Sample request	GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/drive?eventName=move&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format	{actor} moved an item from {source_folder_title} to {destination_folder_title}

Preview

Document preview.

Event details
Event name	preview
Parameters	actor_is_collaborator_account boolean Whether actor is a collaborator account. billable boolean Whether this activity is billable. doc_id string Document Id. doc_title string Document title. doc_type string Document type. Possible values: document Doc type document. drawing Doc type drawing. folder Doc type folder. form Doc type form. html Doc type HTML. jam Doc type Jam. jpeg Doc type JPEG. mp4 Doc type MP4. mpeg Doc type MPEG. msexcel Doc type MS Excel. mspowerpoint Doc type MS Powerpoint. msword Doc type MS Word. pdf Doc type PDF. png Doc type PNG. presentation Doc type presentation. quicktime Doc type Quicktime. script Doc type is Google Script. shortcut Doc type is Google Shortcut. sites Doc type is Google Sites. spreadsheet Doc type spreadsheet. shared_drive Doc type is a shared drive. txt Doc type txt. unknown Doc type unknown. is_encrypted boolean Whether the file is client side encrypted. originating_app_id string The Google Cloud Project ID of the application that performed the action. Use the Drive REST API to retrieve the app title. owner string Email address of the document's owner. For items contained in a shared drive, the owner is the name of the shared drive. owner_is_shared_drive boolean Boolean flag denoting whether owner is a shared drive. owner_shared_drive_id string The shared drive root id if the document owner is shared drive. primary_event boolean Whether this is a primary event. A single user action in Drive may generate several events, multiple of which can be primary (primary_event=true). The remaining events are deemed to be side effects of the primary event(s) (primary_event=false). For example, when a user creates a document, several events are generated, with only the create event having primary_event=true. But when a user shares a document with multiple other users in one action, an access change event having primary_event=true is created for each sharee. Possible values: false Boolean value false. true Boolean value true. shared_drive_id string The unique identifier of the shared drive. Only populated for events or items from a shared drive. visibility string Visibility of Target File. Possible values: people_with_link Anyone with the link can access. people_within_domain_with_link Anyone with the link within the audience can access. private Private. public_in_the_domain Anyone within the audience can access. public_on_the_web Public on the web. shared_externally Shared with explicit users/groups external to the domain. shared_internally Shared with explicit users/groups internal to the domain. unknown Unknown visibility.
Sample request	GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/drive?eventName=preview&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format	{actor} previewed an item

Print

Document print.

Event details
Event name	print
Parameters	actor_is_collaborator_account boolean Whether actor is a collaborator account. billable boolean Whether this activity is billable. doc_id string Document Id. doc_title string Document title. doc_type string Document type. Possible values: document Doc type document. drawing Doc type drawing. folder Doc type folder. form Doc type form. html Doc type HTML. jam Doc type Jam. jpeg Doc type JPEG. mp4 Doc type MP4. mpeg Doc type MPEG. msexcel Doc type MS Excel. mspowerpoint Doc type MS Powerpoint. msword Doc type MS Word. pdf Doc type PDF. png Doc type PNG. presentation Doc type presentation. quicktime Doc type Quicktime. script Doc type is Google Script. shortcut Doc type is Google Shortcut. sites Doc type is Google Sites. spreadsheet Doc type spreadsheet. shared_drive Doc type is a shared drive. txt Doc type txt. unknown Doc type unknown. is_encrypted boolean Whether the file is client side encrypted. originating_app_id string The Google Cloud Project ID of the application that performed the action. Use the Drive REST API to retrieve the app title. owner string Email address of the document's owner. For items contained in a shared drive, the owner is the name of the shared drive. owner_is_shared_drive boolean Boolean flag denoting whether owner is a shared drive. owner_shared_drive_id string The shared drive root id if the document owner is shared drive. primary_event boolean Whether this is a primary event. A single user action in Drive may generate several events, multiple of which can be primary (primary_event=true). The remaining events are deemed to be side effects of the primary event(s) (primary_event=false). For example, when a user creates a document, several events are generated, with only the create event having primary_event=true. But when a user shares a document with multiple other users in one action, an access change event having primary_event=true is created for each sharee. Possible values: false Boolean value false. true Boolean value true. shared_drive_id string The unique identifier of the shared drive. Only populated for events or items from a shared drive. visibility string Visibility of Target File. Possible values: people_with_link Anyone with the link can access. people_within_domain_with_link Anyone with the link within the audience can access. private Private. public_in_the_domain Anyone within the audience can access. public_on_the_web Public on the web. shared_externally Shared with explicit users/groups external to the domain. shared_internally Shared with explicit users/groups internal to the domain. unknown Unknown visibility.
Sample request	GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/drive?eventName=print&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format	{actor} printed an item

Remove from folder

Document remove from folder.

Event details
Event name	remove_from_folder
Parameters	actor_is_collaborator_account boolean Whether actor is a collaborator account. billable boolean Whether this activity is billable. doc_id string Document Id. doc_title string Document title. doc_type string Document type. Possible values: document Doc type document. drawing Doc type drawing. folder Doc type folder. form Doc type form. html Doc type HTML. jam Doc type Jam. jpeg Doc type JPEG. mp4 Doc type MP4. mpeg Doc type MPEG. msexcel Doc type MS Excel. mspowerpoint Doc type MS Powerpoint. msword Doc type MS Word. pdf Doc type PDF. png Doc type PNG. presentation Doc type presentation. quicktime Doc type Quicktime. script Doc type is Google Script. shortcut Doc type is Google Shortcut. sites Doc type is Google Sites. spreadsheet Doc type spreadsheet. shared_drive Doc type is a shared drive. txt Doc type txt. unknown Doc type unknown. is_encrypted boolean Whether the file is client side encrypted. originating_app_id string The Google Cloud Project ID of the application that performed the action. Use the Drive REST API to retrieve the app title. owner string Email address of the document's owner. For items contained in a shared drive, the owner is the name of the shared drive. owner_is_shared_drive boolean Boolean flag denoting whether owner is a shared drive. owner_shared_drive_id string The shared drive root id if the document owner is shared drive. primary_event boolean Whether this is a primary event. A single user action in Drive may generate several events, multiple of which can be primary (primary_event=true). The remaining events are deemed to be side effects of the primary event(s) (primary_event=false). For example, when a user creates a document, several events are generated, with only the create event having primary_event=true. But when a user shares a document with multiple other users in one action, an access change event having primary_event=true is created for each sharee. Possible values: false Boolean value false. true Boolean value true. source_folder_id string Source folder Id. source_folder_title string Source folder title. shared_drive_id string The unique identifier of the shared drive. Only populated for events or items from a shared drive. visibility string Visibility of Target File. Possible values: people_with_link Anyone with the link can access. people_within_domain_with_link Anyone with the link within the audience can access. private Private. public_in_the_domain Anyone within the audience can access. public_on_the_web Public on the web. shared_externally Shared with explicit users/groups external to the domain. shared_internally Shared with explicit users/groups internal to the domain. unknown Unknown visibility.
Sample request	GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/drive?eventName=remove_from_folder&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format	{actor} removed an item from {source_folder_title}

Rename

Document rename.

Event details
Event name	rename
Parameters	actor_is_collaborator_account boolean Whether actor is a collaborator account. billable boolean Whether this activity is billable. doc_id string Document Id. doc_title string Document title. doc_type string Document type. Possible values: document Doc type document. drawing Doc type drawing. folder Doc type folder. form Doc type form. html Doc type HTML. jam Doc type Jam. jpeg Doc type JPEG. mp4 Doc type MP4. mpeg Doc type MPEG. msexcel Doc type MS Excel. mspowerpoint Doc type MS Powerpoint. msword Doc type MS Word. pdf Doc type PDF. png Doc type PNG. presentation Doc type presentation. quicktime Doc type Quicktime. script Doc type is Google Script. shortcut Doc type is Google Shortcut. sites Doc type is Google Sites. spreadsheet Doc type spreadsheet. shared_drive Doc type is a shared drive. txt Doc type txt. unknown Doc type unknown. is_encrypted boolean Whether the file is client side encrypted. new_value string New Value. old_value string Old Value. originating_app_id string The Google Cloud Project ID of the application that performed the action. Use the Drive REST API to retrieve the app title. owner string Email address of the document's owner. For items contained in a shared drive, the owner is the name of the shared drive. owner_is_shared_drive boolean Boolean flag denoting whether owner is a shared drive. owner_shared_drive_id string The shared drive root id if the document owner is shared drive. primary_event boolean Whether this is a primary event. A single user action in Drive may generate several events, multiple of which can be primary (primary_event=true). The remaining events are deemed to be side effects of the primary event(s) (primary_event=false). For example, when a user creates a document, several events are generated, with only the create event having primary_event=true. But when a user shares a document with multiple other users in one action, an access change event having primary_event=true is created for each sharee. Possible values: false Boolean value false. true Boolean value true. shared_drive_id string The unique identifier of the shared drive. Only populated for events or items from a shared drive. visibility string Visibility of Target File. Possible values: people_with_link Anyone with the link can access. people_within_domain_with_link Anyone with the link within the audience can access. private Private. public_in_the_domain Anyone within the audience can access. public_on_the_web Public on the web. shared_externally Shared with explicit users/groups external to the domain. shared_internally Shared with explicit users/groups internal to the domain. unknown Unknown visibility.
Sample request	GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/drive?eventName=rename&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format	{actor} renamed {old_value} to {new_value}

Report abuse

Event details
Event name	report_abuse
Parameters	actor_is_collaborator_account boolean Whether actor is a collaborator account. billable boolean Whether this activity is billable. doc_id string Document Id. doc_title string Document title. doc_type string Document type. Possible values: document Doc type document. drawing Doc type drawing. folder Doc type folder. form Doc type form. html Doc type HTML. jam Doc type Jam. jpeg Doc type JPEG. mp4 Doc type MP4. mpeg Doc type MPEG. msexcel Doc type MS Excel. mspowerpoint Doc type MS Powerpoint. msword Doc type MS Word. pdf Doc type PDF. png Doc type PNG. presentation Doc type presentation. quicktime Doc type Quicktime. script Doc type is Google Script. shortcut Doc type is Google Shortcut. sites Doc type is Google Sites. spreadsheet Doc type spreadsheet. shared_drive Doc type is a shared drive. txt Doc type txt. unknown Doc type unknown. is_encrypted boolean Whether the file is client side encrypted. originating_app_id string The Google Cloud Project ID of the application that performed the action. Use the Drive REST API to retrieve the app title. owner string Email address of the document's owner. For items contained in a shared drive, the owner is the name of the shared drive. owner_is_shared_drive boolean Boolean flag denoting whether owner is a shared drive. owner_shared_drive_id string The shared drive root id if the document owner is shared drive. primary_event boolean Whether this is a primary event. A single user action in Drive may generate several events, multiple of which can be primary (primary_event=true). The remaining events are deemed to be side effects of the primary event(s) (primary_event=false). For example, when a user creates a document, several events are generated, with only the create event having primary_event=true. But when a user shares a document with multiple other users in one action, an access change event having primary_event=true is created for each sharee. Possible values: false Boolean value false. true Boolean value true. shared_drive_id string The unique identifier of the shared drive. Only populated for events or items from a shared drive. visibility string Visibility of Target File. Possible values: people_with_link Anyone with the link can access. people_within_domain_with_link Anyone with the link within the audience can access. private Private. public_in_the_domain Anyone within the audience can access. public_on_the_web Public on the web. shared_externally Shared with explicit users/groups external to the domain. shared_internally Shared with explicit users/groups internal to the domain. unknown Unknown visibility.
Sample request	GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/drive?eventName=report_abuse&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format	An abuse report was submitted for an item

Restore

Document restore.

Event details
Event name	untrash
Parameters	actor_is_collaborator_account boolean Whether actor is a collaborator account. billable boolean Whether this activity is billable. doc_id string Document Id. doc_title string Document title. doc_type string Document type. Possible values: document Doc type document. drawing Doc type drawing. folder Doc type folder. form Doc type form. html Doc type HTML. jam Doc type Jam. jpeg Doc type JPEG. mp4 Doc type MP4. mpeg Doc type MPEG. msexcel Doc type MS Excel. mspowerpoint Doc type MS Powerpoint. msword Doc type MS Word. pdf Doc type PDF. png Doc type PNG. presentation Doc type presentation. quicktime Doc type Quicktime. script Doc type is Google Script. shortcut Doc type is Google Shortcut. sites Doc type is Google Sites. spreadsheet Doc type spreadsheet. shared_drive Doc type is a shared drive. txt Doc type txt. unknown Doc type unknown. is_encrypted boolean Whether the file is client side encrypted. originating_app_id string The Google Cloud Project ID of the application that performed the action. Use the Drive REST API to retrieve the app title. owner string Email address of the document's owner. For items contained in a shared drive, the owner is the name of the shared drive. owner_is_shared_drive boolean Boolean flag denoting whether owner is a shared drive. owner_shared_drive_id string The shared drive root id if the document owner is shared drive. primary_event boolean Whether this is a primary event. A single user action in Drive may generate several events, multiple of which can be primary (primary_event=true). The remaining events are deemed to be side effects of the primary event(s) (primary_event=false). For example, when a user creates a document, several events are generated, with only the create event having primary_event=true. But when a user shares a document with multiple other users in one action, an access change event having primary_event=true is created for each sharee. Possible values: false Boolean value false. true Boolean value true. shared_drive_id string The unique identifier of the shared drive. Only populated for events or items from a shared drive. visibility string Visibility of Target File. Possible values: people_with_link Anyone with the link can access. people_within_domain_with_link Anyone with the link within the audience can access. private Private. public_in_the_domain Anyone within the audience can access. public_on_the_web Public on the web. shared_externally Shared with explicit users/groups external to the domain. shared_internally Shared with explicit users/groups internal to the domain. unknown Unknown visibility.
Sample request	GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/drive?eventName=untrash&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format	{actor} restored an item

Revision deleted

A revision of an item was deleted.

Event details
Event name	delete_revision
Parameters	actor_is_collaborator_account boolean Whether actor is a collaborator account. billable boolean Whether this activity is billable. doc_id string Document Id. doc_title string Document title. doc_type string Document type. Possible values: document Doc type document. drawing Doc type drawing. folder Doc type folder. form Doc type form. html Doc type HTML. jam Doc type Jam. jpeg Doc type JPEG. mp4 Doc type MP4. mpeg Doc type MPEG. msexcel Doc type MS Excel. mspowerpoint Doc type MS Powerpoint. msword Doc type MS Word. pdf Doc type PDF. png Doc type PNG. presentation Doc type presentation. quicktime Doc type Quicktime. script Doc type is Google Script. shortcut Doc type is Google Shortcut. sites Doc type is Google Sites. spreadsheet Doc type spreadsheet. shared_drive Doc type is a shared drive. txt Doc type txt. unknown Doc type unknown. is_encrypted boolean Whether the file is client side encrypted. originating_app_id string The Google Cloud Project ID of the application that performed the action. Use the Drive REST API to retrieve the app title. owner string Email address of the document's owner. For items contained in a shared drive, the owner is the name of the shared drive. owner_is_shared_drive boolean Boolean flag denoting whether owner is a shared drive. owner_shared_drive_id string The shared drive root id if the document owner is shared drive. primary_event boolean Whether this is a primary event. A single user action in Drive may generate several events, multiple of which can be primary (primary_event=true). The remaining events are deemed to be side effects of the primary event(s) (primary_event=false). For example, when a user creates a document, several events are generated, with only the create event having primary_event=true. But when a user shares a document with multiple other users in one action, an access change event having primary_event=true is created for each sharee. Possible values: false Boolean value false. true Boolean value true. revision_create_timestamp integer The timestamp when the revision was originally created (in epoch microseconds). revision_id string The ID of the revision. shared_drive_id string The unique identifier of the shared drive. Only populated for events or items from a shared drive. visibility string Visibility of Target File. Possible values: people_with_link Anyone with the link can access. people_within_domain_with_link Anyone with the link within the audience can access. private Private. public_in_the_domain Anyone within the audience can access. public_on_the_web Public on the web. shared_externally Shared with explicit users/groups external to the domain. shared_internally Shared with explicit users/groups internal to the domain. unknown Unknown visibility.
Sample request	GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/drive?eventName=delete_revision&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format	{actor} deleted a revision of this item

Revision pinned

A revision of an item was pinned, indicating that the revision should be kept forever.

Event details
Event name	pin_revision
Parameters	actor_is_collaborator_account boolean Whether actor is a collaborator account. billable boolean Whether this activity is billable. doc_id string Document Id. doc_title string Document title. doc_type string Document type. Possible values: document Doc type document. drawing Doc type drawing. folder Doc type folder. form Doc type form. html Doc type HTML. jam Doc type Jam. jpeg Doc type JPEG. mp4 Doc type MP4. mpeg Doc type MPEG. msexcel Doc type MS Excel. mspowerpoint Doc type MS Powerpoint. msword Doc type MS Word. pdf Doc type PDF. png Doc type PNG. presentation Doc type presentation. quicktime Doc type Quicktime. script Doc type is Google Script. shortcut Doc type is Google Shortcut. sites Doc type is Google Sites. spreadsheet Doc type spreadsheet. shared_drive Doc type is a shared drive. txt Doc type txt. unknown Doc type unknown. is_encrypted boolean Whether the file is client side encrypted. originating_app_id string The Google Cloud Project ID of the application that performed the action. Use the Drive REST API to retrieve the app title. owner string Email address of the document's owner. For items contained in a shared drive, the owner is the name of the shared drive. owner_is_shared_drive boolean Boolean flag denoting whether owner is a shared drive. owner_shared_drive_id string The shared drive root id if the document owner is shared drive. primary_event boolean Whether this is a primary event. A single user action in Drive may generate several events, multiple of which can be primary (primary_event=true). The remaining events are deemed to be side effects of the primary event(s) (primary_event=false). For example, when a user creates a document, several events are generated, with only the create event having primary_event=true. But when a user shares a document with multiple other users in one action, an access change event having primary_event=true is created for each sharee. Possible values: false Boolean value false. true Boolean value true. revision_create_timestamp integer The timestamp when the revision was originally created (in epoch microseconds). revision_id string The ID of the revision. shared_drive_id string The unique identifier of the shared drive. Only populated for events or items from a shared drive. visibility string Visibility of Target File. Possible values: people_with_link Anyone with the link can access. people_within_domain_with_link Anyone with the link within the audience can access. private Private. public_in_the_domain Anyone within the audience can access. public_on_the_web Public on the web. shared_externally Shared with explicit users/groups external to the domain. shared_internally Shared with explicit users/groups internal to the domain. unknown Unknown visibility.
Sample request	GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/drive?eventName=pin_revision&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format	{actor} pinned a revision of this item

Revision unpinned

A revision of an item was unpinned, indicating that the revision should not be kept forever.

Event details
Event name	unpin_revision
Parameters	actor_is_collaborator_account boolean Whether actor is a collaborator account. billable boolean Whether this activity is billable. doc_id string Document Id. doc_title string Document title. doc_type string Document type. Possible values: document Doc type document. drawing Doc type drawing. folder Doc type folder. form Doc type form. html Doc type HTML. jam Doc type Jam. jpeg Doc type JPEG. mp4 Doc type MP4. mpeg Doc type MPEG. msexcel Doc type MS Excel. mspowerpoint Doc type MS Powerpoint. msword Doc type MS Word. pdf Doc type PDF. png Doc type PNG. presentation Doc type presentation. quicktime Doc type Quicktime. script Doc type is Google Script. shortcut Doc type is Google Shortcut. sites Doc type is Google Sites. spreadsheet Doc type spreadsheet. shared_drive Doc type is a shared drive. txt Doc type txt. unknown Doc type unknown. is_encrypted boolean Whether the file is client side encrypted. originating_app_id string The Google Cloud Project ID of the application that performed the action. Use the Drive REST API to retrieve the app title. owner string Email address of the document's owner. For items contained in a shared drive, the owner is the name of the shared drive. owner_is_shared_drive boolean Boolean flag denoting whether owner is a shared drive. owner_shared_drive_id string The shared drive root id if the document owner is shared drive. primary_event boolean Whether this is a primary event. A single user action in Drive may generate several events, multiple of which can be primary (primary_event=true). The remaining events are deemed to be side effects of the primary event(s) (primary_event=false). For example, when a user creates a document, several events are generated, with only the create event having primary_event=true. But when a user shares a document with multiple other users in one action, an access change event having primary_event=true is created for each sharee. Possible values: false Boolean value false. true Boolean value true. revision_create_timestamp integer The timestamp when the revision was originally created (in epoch microseconds). revision_id string The ID of the revision. shared_drive_id string The unique identifier of the shared drive. Only populated for events or items from a shared drive. visibility string Visibility of Target File. Possible values: people_with_link Anyone with the link can access. people_within_domain_with_link Anyone with the link within the audience can access. private Private. public_in_the_domain Anyone within the audience can access. public_on_the_web Public on the web. shared_externally Shared with explicit users/groups external to the domain. shared_internally Shared with explicit users/groups internal to the domain. unknown Unknown visibility.
Sample request	GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/drive?eventName=unpin_revision&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format	{actor} unpinned a revision of this item

Script trigger created

Creation of an Apps Script trigger.

Event details
Event name	create_script_trigger
Parameters	actor_is_collaborator_account boolean Whether actor is a collaborator account. billable boolean Whether this activity is billable. doc_id string Document Id. doc_title string Document title. doc_type string Document type. Possible values: document Doc type document. drawing Doc type drawing. folder Doc type folder. form Doc type form. html Doc type HTML. jam Doc type Jam. jpeg Doc type JPEG. mp4 Doc type MP4. mpeg Doc type MPEG. msexcel Doc type MS Excel. mspowerpoint Doc type MS Powerpoint. msword Doc type MS Word. pdf Doc type PDF. png Doc type PNG. presentation Doc type presentation. quicktime Doc type Quicktime. script Doc type is Google Script. shortcut Doc type is Google Shortcut. sites Doc type is Google Sites. spreadsheet Doc type spreadsheet. shared_drive Doc type is a shared drive. txt Doc type txt. unknown Doc type unknown. is_encrypted boolean Whether the file is client side encrypted. originating_app_id string The Google Cloud Project ID of the application that performed the action. Use the Drive REST API to retrieve the app title. owner string Email address of the document's owner. For items contained in a shared drive, the owner is the name of the shared drive. owner_is_shared_drive boolean Boolean flag denoting whether owner is a shared drive. owner_shared_drive_id string The shared drive root id if the document owner is shared drive. primary_event boolean Whether this is a primary event. A single user action in Drive may generate several events, multiple of which can be primary (primary_event=true). The remaining events are deemed to be side effects of the primary event(s) (primary_event=false). For example, when a user creates a document, several events are generated, with only the create event having primary_event=true. But when a user shares a document with multiple other users in one action, an access change event having primary_event=true is created for each sharee. Possible values: false Boolean value false. true Boolean value true. script_container_app string The container application of a container-bound Apps Script file. See the Container-bound Scripts documentation for more information about container applications. Possible values: document Google Docs application. form Google Forms application. sites Google Sites application. slides Google Slides application. spreadsheet Google Sheets application. unknown Unknown application. script_container_id string The container ID of a container-bound Apps Script file. See the Container-bound Scripts documentation for more information about container applications. script_trigger_id string The ID of an Apps Script trigger. script_trigger_source_app string The source providing a trigger. See the Apps Script Installable Triggers documentation for more information about script triggers. Possible values: calendar Google Calendar application. clock System time. document Google Docs application. form Google Forms application. slides Google Slides application. spreadsheet Google Sheets application. unknown Unknown application. script_trigger_type string Script trigger type. See the Apps Script Installable Triggers documentation for more information about script triggers. Possible values: event_any On any event. event_on_change On change. event_on_edit On edit. event_on_event_created On calendar event created. event_on_event_deleted On calendar event deleted. event_on_event_updated On calendar event updated. event_on_form_submit On form submit. event_on_open On open. timed_oneshot Oneshot. timed_recurring Recurring. trigger_type_unspecified Trigger type unspecified. shared_drive_id string The unique identifier of the shared drive. Only populated for events or items from a shared drive. visibility string Visibility of Target File. Possible values: people_with_link Anyone with the link can access. people_within_domain_with_link Anyone with the link within the audience can access. private Private. public_in_the_domain Anyone within the audience can access. public_on_the_web Public on the web. shared_externally Shared with explicit users/groups external to the domain. shared_internally Shared with explicit users/groups internal to the domain. unknown Unknown visibility.
Sample request	GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/drive?eventName=create_script_trigger&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format	{actor} created a script trigger

Script trigger deleted

Deletion of an Apps Script trigger.

Event details
Event name	delete_script_trigger
Parameters	actor_is_collaborator_account boolean Whether actor is a collaborator account. billable boolean Whether this activity is billable. doc_id string Document Id. doc_title string Document title. doc_type string Document type. Possible values: document Doc type document. drawing Doc type drawing. folder Doc type folder. form Doc type form. html Doc type HTML. jam Doc type Jam. jpeg Doc type JPEG. mp4 Doc type MP4. mpeg Doc type MPEG. msexcel Doc type MS Excel. mspowerpoint Doc type MS Powerpoint. msword Doc type MS Word. pdf Doc type PDF. png Doc type PNG. presentation Doc type presentation. quicktime Doc type Quicktime. script Doc type is Google Script. shortcut Doc type is Google Shortcut. sites Doc type is Google Sites. spreadsheet Doc type spreadsheet. shared_drive Doc type is a shared drive. txt Doc type txt. unknown Doc type unknown. is_encrypted boolean Whether the file is client side encrypted. originating_app_id string The Google Cloud Project ID of the application that performed the action. Use the Drive REST API to retrieve the app title. owner string Email address of the document's owner. For items contained in a shared drive, the owner is the name of the shared drive. owner_is_shared_drive boolean Boolean flag denoting whether owner is a shared drive. owner_shared_drive_id string The shared drive root id if the document owner is shared drive. primary_event boolean Whether this is a primary event. A single user action in Drive may generate several events, multiple of which can be primary (primary_event=true). The remaining events are deemed to be side effects of the primary event(s) (primary_event=false). For example, when a user creates a document, several events are generated, with only the create event having primary_event=true. But when a user shares a document with multiple other users in one action, an access change event having primary_event=true is created for each sharee. Possible values: false Boolean value false. true Boolean value true. script_container_app string The container application of a container-bound Apps Script file. See the Container-bound Scripts documentation for more information about container applications. Possible values: document Google Docs application. form Google Forms application. sites Google Sites application. slides Google Slides application. spreadsheet Google Sheets application. unknown Unknown application. script_container_id string The container ID of a container-bound Apps Script file. See the Container-bound Scripts documentation for more information about container applications. script_trigger_id string The ID of an Apps Script trigger. script_trigger_source_app string The source providing a trigger. See the Apps Script Installable Triggers documentation for more information about script triggers. Possible values: calendar Google Calendar application. clock System time. document Google Docs application. form Google Forms application. slides Google Slides application. spreadsheet Google Sheets application. unknown Unknown application. script_trigger_type string Script trigger type. See the Apps Script Installable Triggers documentation for more information about script triggers. Possible values: event_any On any event. event_on_change On change. event_on_edit On edit. event_on_event_created On calendar event created. event_on_event_deleted On calendar event deleted. event_on_event_updated On calendar event updated. event_on_form_submit On form submit. event_on_open On open. timed_oneshot Oneshot. timed_recurring Recurring. trigger_type_unspecified Trigger type unspecified. shared_drive_id string The unique identifier of the shared drive. Only populated for events or items from a shared drive. visibility string Visibility of Target File. Possible values: people_with_link Anyone with the link can access. people_within_domain_with_link Anyone with the link within the audience can access. private Private. public_in_the_domain Anyone within the audience can access. public_on_the_web Public on the web. shared_externally Shared with explicit users/groups external to the domain. shared_internally Shared with explicit users/groups internal to the domain. unknown Unknown visibility.
Sample request	GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/drive?eventName=delete_script_trigger&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format	{actor} deleted a script trigger

Sheets ImportRange

Event details
Event name	sheets_import_range
Parameters	doc_id string Document Id. doc_title string Document title. doc_type string Document type. is_encrypted boolean Whether the file is client side encrypted. originating_app_id string The Google Cloud Project ID of the application that performed the action. Use the Drive REST API to retrieve the app title. owner string Email address of the document's owner. For items contained in a shared drive, the owner is the name of the shared drive. owner_is_shared_drive boolean Boolean flag denoting whether owner is a shared drive. owner_shared_drive_id string The shared drive root id if the document owner is shared drive. primary_event boolean Whether this is a primary event. A single user action in Drive may generate several events, multiple of which can be primary (primary_event=true). The remaining events are deemed to be side effects of the primary event(s) (primary_event=false). For example, when a user creates a document, several events are generated, with only the create event having primary_event=true. But when a user shares a document with multiple other users in one action, an access change event having primary_event=true is created for each sharee. sheets_import_range_recipient_doc string Sheets ImportRange recipient doc. shared_drive_id string The unique identifier of the shared drive. Only populated for events or items from a shared drive. visibility string Visibility of Target File. Possible values: people_with_link Anyone with the link can access. people_within_domain_with_link Anyone with the link within the audience can access. private Private. public_in_the_domain Anyone within the audience can access. public_on_the_web Public on the web. shared_externally Shared with explicit users/groups external to the domain. shared_internally Shared with explicit users/groups internal to the domain. unknown Unknown visibility.
Sample request	GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/drive?eventName=sheets_import_range&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format	{sheets_import_range_recipient_doc} imported range from an item

Source Copy

Source document copy.

Event details
Event name	source_copy
Parameters	actor_is_collaborator_account boolean Whether actor is a collaborator account. billable boolean Whether this activity is billable. copy_type string Doc copy type. Possible values: external Copy type external. internal Copy type internal. doc_id string Document Id. doc_title string Document title. doc_type string Document type. Possible values: document Doc type document. drawing Doc type drawing. folder Doc type folder. form Doc type form. html Doc type HTML. jam Doc type Jam. jpeg Doc type JPEG. mp4 Doc type MP4. mpeg Doc type MPEG. msexcel Doc type MS Excel. mspowerpoint Doc type MS Powerpoint. msword Doc type MS Word. pdf Doc type PDF. png Doc type PNG. presentation Doc type presentation. quicktime Doc type Quicktime. script Doc type is Google Script. shortcut Doc type is Google Shortcut. sites Doc type is Google Sites. spreadsheet Doc type spreadsheet. shared_drive Doc type is a shared drive. txt Doc type txt. unknown Doc type unknown. encryption_change string The encryption change that happened as part of this copy. An unset value indicates that no encryption change happened. Possible values: decrypted_copy An unencrypted item was created from an encrypted item. encrypted_copy An encrypted item was created from an unencrypted item. is_encrypted boolean Whether the file is client side encrypted. new_value string New Value. old_value string Old Value. originating_app_id string The Google Cloud Project ID of the application that performed the action. Use the Drive REST API to retrieve the app title. owner string Email address of the document's owner. For items contained in a shared drive, the owner is the name of the shared drive. owner_is_shared_drive boolean Boolean flag denoting whether owner is a shared drive. owner_shared_drive_id string The shared drive root id if the document owner is shared drive. primary_event boolean Whether this is a primary event. A single user action in Drive may generate several events, multiple of which can be primary (primary_event=true). The remaining events are deemed to be side effects of the primary event(s) (primary_event=false). For example, when a user creates a document, several events are generated, with only the create event having primary_event=true. But when a user shares a document with multiple other users in one action, an access change event having primary_event=true is created for each sharee. Possible values: false Boolean value false. true Boolean value true. shared_drive_id string The unique identifier of the shared drive. Only populated for events or items from a shared drive. visibility string Visibility of Target File. Possible values: people_with_link Anyone with the link can access. people_within_domain_with_link Anyone with the link within the audience can access. private Private. public_in_the_domain Anyone within the audience can access. public_on_the_web Public on the web. shared_externally Shared with explicit users/groups external to the domain. shared_internally Shared with explicit users/groups internal to the domain. unknown Unknown visibility.
Sample request	GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/drive?eventName=source_copy&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format	{actor} copied this item, creating a new item {copy_type} your organization {new_value}

Suggestion accepted

A suggestion was accepted.

Event details
Event name	accept_suggestion
Parameters	actor_is_collaborator_account boolean Whether actor is a collaborator account. billable boolean Whether this activity is billable. doc_id string Document Id. doc_title string Document title. doc_type string Document type. Possible values: document Doc type document. drawing Doc type drawing. folder Doc type folder. form Doc type form. html Doc type HTML. jam Doc type Jam. jpeg Doc type JPEG. mp4 Doc type MP4. mpeg Doc type MPEG. msexcel Doc type MS Excel. mspowerpoint Doc type MS Powerpoint. msword Doc type MS Word. pdf Doc type PDF. png Doc type PNG. presentation Doc type presentation. quicktime Doc type Quicktime. script Doc type is Google Script. shortcut Doc type is Google Shortcut. sites Doc type is Google Sites. spreadsheet Doc type spreadsheet. shared_drive Doc type is a shared drive. txt Doc type txt. unknown Doc type unknown. is_encrypted boolean Whether the file is client side encrypted. originating_app_id string The Google Cloud Project ID of the application that performed the action. Use the Drive REST API to retrieve the app title. owner string Email address of the document's owner. For items contained in a shared drive, the owner is the name of the shared drive. owner_is_shared_drive boolean Boolean flag denoting whether owner is a shared drive. owner_shared_drive_id string The shared drive root id if the document owner is shared drive. primary_event boolean Whether this is a primary event. A single user action in Drive may generate several events, multiple of which can be primary (primary_event=true). The remaining events are deemed to be side effects of the primary event(s) (primary_event=false). For example, when a user creates a document, several events are generated, with only the create event having primary_event=true. But when a user shares a document with multiple other users in one action, an access change event having primary_event=true is created for each sharee. Possible values: false Boolean value false. true Boolean value true. shared_drive_id string The unique identifier of the shared drive. Only populated for events or items from a shared drive. visibility string Visibility of Target File. Possible values: people_with_link Anyone with the link can access. people_within_domain_with_link Anyone with the link within the audience can access. private Private. public_in_the_domain Anyone within the audience can access. public_on_the_web Public on the web. shared_externally Shared with explicit users/groups external to the domain. shared_internally Shared with explicit users/groups internal to the domain. unknown Unknown visibility.
Sample request	GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/drive?eventName=accept_suggestion&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format	{actor} accepted a suggestion

Suggestion created

A suggestion was created.

Event details
Event name	create_suggestion
Parameters	actor_is_collaborator_account boolean Whether actor is a collaborator account. billable boolean Whether this activity is billable. doc_id string Document Id. doc_title string Document title. doc_type string Document type. Possible values: document Doc type document. drawing Doc type drawing. folder Doc type folder. form Doc type form. html Doc type HTML. jam Doc type Jam. jpeg Doc type JPEG. mp4 Doc type MP4. mpeg Doc type MPEG. msexcel Doc type MS Excel. mspowerpoint Doc type MS Powerpoint. msword Doc type MS Word. pdf Doc type PDF. png Doc type PNG. presentation Doc type presentation. quicktime Doc type Quicktime. script Doc type is Google Script. shortcut Doc type is Google Shortcut. sites Doc type is Google Sites. spreadsheet Doc type spreadsheet. shared_drive Doc type is a shared drive. txt Doc type txt. unknown Doc type unknown. is_encrypted boolean Whether the file is client side encrypted. originating_app_id string The Google Cloud Project ID of the application that performed the action. Use the Drive REST API to retrieve the app title. owner string Email address of the document's owner. For items contained in a shared drive, the owner is the name of the shared drive. owner_is_shared_drive boolean Boolean flag denoting whether owner is a shared drive. owner_shared_drive_id string The shared drive root id if the document owner is shared drive. primary_event boolean Whether this is a primary event. A single user action in Drive may generate several events, multiple of which can be primary (primary_event=true). The remaining events are deemed to be side effects of the primary event(s) (primary_event=false). For example, when a user creates a document, several events are generated, with only the create event having primary_event=true. But when a user shares a document with multiple other users in one action, an access change event having primary_event=true is created for each sharee. Possible values: false Boolean value false. true Boolean value true. shared_drive_id string The unique identifier of the shared drive. Only populated for events or items from a shared drive. visibility string Visibility of Target File. Possible values: people_with_link Anyone with the link can access. people_within_domain_with_link Anyone with the link within the audience can access. private Private. public_in_the_domain Anyone within the audience can access. public_on_the_web Public on the web. shared_externally Shared with explicit users/groups external to the domain. shared_internally Shared with explicit users/groups internal to the domain. unknown Unknown visibility.
Sample request	GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/drive?eventName=create_suggestion&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format	{actor} created a suggestion

Suggestion deleted

A suggestion was deleted.

Event details
Event name	delete_suggestion
Parameters	actor_is_collaborator_account boolean Whether actor is a collaborator account. billable boolean Whether this activity is billable. doc_id string Document Id. doc_title string Document title. doc_type string Document type. Possible values: document Doc type document. drawing Doc type drawing. folder Doc type folder. form Doc type form. html Doc type HTML. jam Doc type Jam. jpeg Doc type JPEG. mp4 Doc type MP4. mpeg Doc type MPEG. msexcel Doc type MS Excel. mspowerpoint Doc type MS Powerpoint. msword Doc type MS Word. pdf Doc type PDF. png Doc type PNG. presentation Doc type presentation. quicktime Doc type Quicktime. script Doc type is Google Script. shortcut Doc type is Google Shortcut. sites Doc type is Google Sites. spreadsheet Doc type spreadsheet. shared_drive Doc type is a shared drive. txt Doc type txt. unknown Doc type unknown. is_encrypted boolean Whether the file is client side encrypted. originating_app_id string The Google Cloud Project ID of the application that performed the action. Use the Drive REST API to retrieve the app title. owner string Email address of the document's owner. For items contained in a shared drive, the owner is the name of the shared drive. owner_is_shared_drive boolean Boolean flag denoting whether owner is a shared drive. owner_shared_drive_id string The shared drive root id if the document owner is shared drive. primary_event boolean Whether this is a primary event. A single user action in Drive may generate several events, multiple of which can be primary (primary_event=true). The remaining events are deemed to be side effects of the primary event(s) (primary_event=false). For example, when a user creates a document, several events are generated, with only the create event having primary_event=true. But when a user shares a document with multiple other users in one action, an access change event having primary_event=true is created for each sharee. Possible values: false Boolean value false. true Boolean value true. shared_drive_id string The unique identifier of the shared drive. Only populated for events or items from a shared drive. visibility string Visibility of Target File. Possible values: people_with_link Anyone with the link can access. people_within_domain_with_link Anyone with the link within the audience can access. private Private. public_in_the_domain Anyone within the audience can access. public_on_the_web Public on the web. shared_externally Shared with explicit users/groups external to the domain. shared_internally Shared with explicit users/groups internal to the domain. unknown Unknown visibility.
Sample request	GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/drive?eventName=delete_suggestion&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format	{actor} deleted a suggestion

Suggestion rejected

A suggestion was rejected.

Event details
Event name	reject_suggestion
Parameters	actor_is_collaborator_account boolean Whether actor is a collaborator account. billable boolean Whether this activity is billable. doc_id string Document Id. doc_title string Document title. doc_type string Document type. Possible values: document Doc type document. drawing Doc type drawing. folder Doc type folder. form Doc type form. html Doc type HTML. jam Doc type Jam. jpeg Doc type JPEG. mp4 Doc type MP4. mpeg Doc type MPEG. msexcel Doc type MS Excel. mspowerpoint Doc type MS Powerpoint. msword Doc type MS Word. pdf Doc type PDF. png Doc type PNG. presentation Doc type presentation. quicktime Doc type Quicktime. script Doc type is Google Script. shortcut Doc type is Google Shortcut. sites Doc type is Google Sites. spreadsheet Doc type spreadsheet. shared_drive Doc type is a shared drive. txt Doc type txt. unknown Doc type unknown. is_encrypted boolean Whether the file is client side encrypted. originating_app_id string The Google Cloud Project ID of the application that performed the action. Use the Drive REST API to retrieve the app title. owner string Email address of the document's owner. For items contained in a shared drive, the owner is the name of the shared drive. owner_is_shared_drive boolean Boolean flag denoting whether owner is a shared drive. owner_shared_drive_id string The shared drive root id if the document owner is shared drive. primary_event boolean Whether this is a primary event. A single user action in Drive may generate several events, multiple of which can be primary (primary_event=true). The remaining events are deemed to be side effects of the primary event(s) (primary_event=false). For example, when a user creates a document, several events are generated, with only the create event having primary_event=true. But when a user shares a document with multiple other users in one action, an access change event having primary_event=true is created for each sharee. Possible values: false Boolean value false. true Boolean value true. shared_drive_id string The unique identifier of the shared drive. Only populated for events or items from a shared drive. visibility string Visibility of Target File. Possible values: people_with_link Anyone with the link can access. people_within_domain_with_link Anyone with the link within the audience can access. private Private. public_in_the_domain Anyone within the audience can access. public_on_the_web Public on the web. shared_externally Shared with explicit users/groups external to the domain. shared_internally Shared with explicit users/groups internal to the domain. unknown Unknown visibility.
Sample request	GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/drive?eventName=reject_suggestion&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format	{actor} rejected a suggestion

Trash

Document trash.

Event details
Event name	trash
Parameters	< actor_is_collaborator_account boolean Whether actor is a collaborator account. billable boolean Whether this activity is billable. doc_id string Document Id. doc_title string Document title.