Vault Audit Activity Events

This document lists the events and parameters for various types of Vault Audit activity events. You can retrieve these events by calling Activities.list() with applicationName=vault.

Event Type: User Action

User Action Event Type. Events of this type are returned with type=user_action.

Add Collaborator Begin

Event details
Event name	add_collaborator_begin
Parameters	additional_details string Additional details pertaining to an audit log. matter_id string The Matter ID an audit pertains to. organizational_unit_name string The organizational unit name. query string The user inputted query for search and exports. resource_name string The resource name of the action, such as hold name or saved query name. resource_url string The document URL of the document view. target_user string The targeted user (such as user put on hold).
Sample request	GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/vault?eventName=add_collaborator_begin&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format	Collaborator addition began

Add Collaborator End

Event details
Event name	add_collaborator_end
Parameters	additional_details string Additional details pertaining to an audit log. matter_id string The Matter ID an audit pertains to. organizational_unit_name string The organizational unit name. query string The user inputted query for search and exports. resource_name string The resource name of the action, such as hold name or saved query name. resource_url string The document URL of the document view. target_user string The targeted user (such as user put on hold).
Sample request	GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/vault?eventName=add_collaborator_end&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format	Collaborator addition ended

Add Litigation Hold Begin

Event details
Event name	add_litigation_hold_begin
Parameters	additional_details string Additional details pertaining to an audit log. matter_id string The Matter ID an audit pertains to. organizational_unit_name string The organizational unit name. query string The user inputted query for search and exports. resource_name string The resource name of the action, such as hold name or saved query name. resource_url string The document URL of the document view. target_user string The targeted user (such as user put on hold).
Sample request	GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/vault?eventName=add_litigation_hold_begin&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format	Litigation hold addition began

Add Litigation Hold End

Event details
Event name	add_litigation_hold_end
Parameters	additional_details string Additional details pertaining to an audit log. matter_id string The Matter ID an audit pertains to. organizational_unit_name string The organizational unit name. query string The user inputted query for search and exports. resource_name string The resource name of the action, such as hold name or saved query name. resource_url string The document URL of the document view. target_user string The targeted user (such as user put on hold).
Sample request	GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/vault?eventName=add_litigation_hold_end&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format	Litigation hold addition ended

Add Preservation Rule Begin

Event details
Event name	add_preservation_rule_begin
Parameters	additional_details string Additional details pertaining to an audit log. matter_id string The Matter ID an audit pertains to. organizational_unit_name string The organizational unit name. query string The user inputted query for search and exports. resource_name string The resource name of the action, such as hold name or saved query name. resource_url string The document URL of the document view. target_user string The targeted user (such as user put on hold).
Sample request	GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/vault?eventName=add_preservation_rule_begin&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format	Preservation rule addition began

Add Preservation Rule End

Event details
Event name	add_preservation_rule_end
Parameters	additional_details string Additional details pertaining to an audit log. matter_id string The Matter ID an audit pertains to. organizational_unit_name string The organizational unit name. query string The user inputted query for search and exports. resource_name string The resource name of the action, such as hold name or saved query name. resource_url string The document URL of the document view. target_user string The targeted user (such as user put on hold).
Sample request	GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/vault?eventName=add_preservation_rule_end&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format	Preservation rule addition ended

Add Retention Rule Begin

Event details
Event name	add_retention_rule_begin
Parameters	additional_details string Additional details pertaining to an audit log. matter_id string The Matter ID an audit pertains to. organizational_unit_name string The organizational unit name. query string The user inputted query for search and exports. resource_name string The resource name of the action, such as hold name or saved query name. resource_url string The document URL of the document view. target_user string The targeted user (such as user put on hold).
Sample request	GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/vault?eventName=add_retention_rule_begin&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format	Retention rule addition began

Add Retention Rule End

Event details
Event name	add_retention_rule_end
Parameters	additional_details string Additional details pertaining to an audit log. matter_id string The Matter ID an audit pertains to. organizational_unit_name string The organizational unit name. query string The user inputted query for search and exports. resource_name string The resource name of the action, such as hold name or saved query name. resource_url string The document URL of the document view. target_user string The targeted user (such as user put on hold).
Sample request	GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/vault?eventName=add_retention_rule_end&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format	Retention rule addition ended

Close Investigation Begin

Event details
Event name	close_investigation_begin
Parameters	additional_details string Additional details pertaining to an audit log. matter_id string The Matter ID an audit pertains to. organizational_unit_name string The organizational unit name. query string The user inputted query for search and exports. resource_name string The resource name of the action, such as hold name or saved query name. resource_url string The document URL of the document view. target_user string The targeted user (such as user put on hold).
Sample request	GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/vault?eventName=close_investigation_begin&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format	Investigation closure began

Close Investigation End

Event details
Event name	close_investigation_end
Parameters	additional_details string Additional details pertaining to an audit log. matter_id string The Matter ID an audit pertains to. organizational_unit_name string The organizational unit name. query string The user inputted query for search and exports. resource_name string The resource name of the action, such as hold name or saved query name. resource_url string The document URL of the document view. target_user string The targeted user (such as user put on hold).
Sample request	GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/vault?eventName=close_investigation_end&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format	Investigation closure ended

Convert Saved Query To Collection Begin

Event details
Event name	convert_saved_query_to_collection_begin
Parameters	additional_details string Additional details pertaining to an audit log. matter_id string The Matter ID an audit pertains to. organizational_unit_name string The organizational unit name. query string The user inputted query for search and exports. resource_name string The resource name of the action, such as hold name or saved query name. resource_url string The document URL of the document view. target_user string The targeted user (such as user put on hold).
Sample request	GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/vault?eventName=convert_saved_query_to_collection_begin&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format	Saved query to collection conversion began

Convert Saved Query To Collection End

Event details
Event name	convert_saved_query_to_collection_end
Parameters	additional_details string Additional details pertaining to an audit log. matter_id string The Matter ID an audit pertains to. organizational_unit_name string The organizational unit name. query string The user inputted query for search and exports. resource_name string The resource name of the action, such as hold name or saved query name. resource_url string The document URL of the document view. target_user string The targeted user (such as user put on hold).
Sample request	GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/vault?eventName=convert_saved_query_to_collection_end&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format	Saved query to collection conversion ended

Create Export Begin

Event details
Event name	create_export_begin
Parameters	additional_details string Additional details pertaining to an audit log. matter_id string The Matter ID an audit pertains to. organizational_unit_name string The organizational unit name. query string The user inputted query for search and exports. resource_name string The resource name of the action, such as hold name or saved query name. resource_url string The document URL of the document view. target_user string The targeted user (such as user put on hold).
Sample request	GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/vault?eventName=create_export_begin&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format	Export creation began

Create Export End

Event details
Event name	create_export_end
Parameters	additional_details string Additional details pertaining to an audit log. matter_id string The Matter ID an audit pertains to. organizational_unit_name string The organizational unit name. query string The user inputted query for search and exports. resource_name string The resource name of the action, such as hold name or saved query name. resource_url string The document URL of the document view. target_user string The targeted user (such as user put on hold).
Sample request	GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/vault?eventName=create_export_end&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format	Export creation ended

Create Investigation Begin

Event details
Event name	create_investigation_begin
Parameters	additional_details string Additional details pertaining to an audit log. matter_id string The Matter ID an audit pertains to. organizational_unit_name string The organizational unit name. query string The user inputted query for search and exports. resource_name string The resource name of the action, such as hold name or saved query name. resource_url string The document URL of the document view. target_user string The targeted user (such as user put on hold).
Sample request	GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/vault?eventName=create_investigation_begin&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format	Investigation creation began

Create Investigation End

Event details
Event name	create_investigation_end
Parameters	additional_details string Additional details pertaining to an audit log. matter_id string The Matter ID an audit pertains to. organizational_unit_name string The organizational unit name. query string The user inputted query for search and exports. resource_name string The resource name of the action, such as hold name or saved query name. resource_url string The document URL of the document view. target_user string The targeted user (such as user put on hold).
Sample request	GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/vault?eventName=create_investigation_end&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format	Investigation creation ended

Create Saved Query Begin

Event details
Event name	create_saved_query_begin
Parameters	additional_details string Additional details pertaining to an audit log. matter_id string The Matter ID an audit pertains to. organizational_unit_name string The organizational unit name. query string The user inputted query for search and exports. resource_name string The resource name of the action, such as hold name or saved query name. resource_url string The document URL of the document view. target_user string The targeted user (such as user put on hold).
Sample request	GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/vault?eventName=create_saved_query_begin&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format	Saved query creation began

Create Saved Query End

Event details
Event name	create_saved_query_end
Parameters	additional_details string Additional details pertaining to an audit log. matter_id string The Matter ID an audit pertains to. organizational_unit_name string The organizational unit name. query string The user inputted query for search and exports. resource_name string The resource name of the action, such as hold name or saved query name. resource_url string The document URL of the document view. target_user string The targeted user (such as user put on hold).
Sample request	GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/vault?eventName=create_saved_query_end&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format	Saved query creation ended

Delete Export Begin

Event details
Event name	delete_export_begin
Parameters	additional_details string Additional details pertaining to an audit log. matter_id string The Matter ID an audit pertains to. organizational_unit_name string The organizational unit name. query string The user inputted query for search and exports. resource_name string The resource name of the action, such as hold name or saved query name. resource_url string The document URL of the document view. target_user string The targeted user (such as user put on hold).
Sample request	GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/vault?eventName=delete_export_begin&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format	Export deletion began

Delete Export End

Event details
Event name	delete_export_end
Parameters	additional_details string Additional details pertaining to an audit log. matter_id string The Matter ID an audit pertains to. organizational_unit_name string The organizational unit name. query string The user inputted query for search and exports. resource_name string The resource name of the action, such as hold name or saved query name. resource_url string The document URL of the document view. target_user string The targeted user (such as user put on hold).
Sample request	GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/vault?eventName=delete_export_end&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format	Export deletion ended

Delete Export Fail

Event details
Event name	delete_export_fail
Parameters	additional_details string Additional details pertaining to an audit log. matter_id string The Matter ID an audit pertains to. organizational_unit_name string The organizational unit name. query string The user inputted query for search and exports. resource_name string The resource name of the action, such as hold name or saved query name. resource_url string The document URL of the document view. target_user string The targeted user (such as user put on hold).
Sample request	GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/vault?eventName=delete_export_fail&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format	Export deletion failed

Delete Investigation Begin

Event details
Event name	delete_investigation_begin
Parameters	additional_details string Additional details pertaining to an audit log. matter_id string The Matter ID an audit pertains to. organizational_unit_name string The organizational unit name. query string The user inputted query for search and exports. resource_name string The resource name of the action, such as hold name or saved query name. resource_url string The document URL of the document view. target_user string The targeted user (such as user put on hold).
Sample request	GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/vault?eventName=delete_investigation_begin&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format	Investigation deletion began

Delete Investigation End

Event details
Event name	delete_investigation_end
Parameters	additional_details string Additional details pertaining to an audit log. matter_id string The Matter ID an audit pertains to. organizational_unit_name string The organizational unit name. query string The user inputted query for search and exports. resource_name string The resource name of the action, such as hold name or saved query name. resource_url string The document URL of the document view. target_user string The targeted user (such as user put on hold).
Sample request	GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/vault?eventName=delete_investigation_end&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format	Investigation deletion ended

Delete Preservation Rule Begin

Event details
Event name	delete_preservation_rule_begin
Parameters	additional_details string Additional details pertaining to an audit log. matter_id string The Matter ID an audit pertains to. organizational_unit_name string The organizational unit name. query string The user inputted query for search and exports. resource_name string The resource name of the action, such as hold name or saved query name. resource_url string The document URL of the document view. target_user string The targeted user (such as user put on hold).
Sample request	GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/vault?eventName=delete_preservation_rule_begin&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format	Preservation rule deletion began

Delete Preservation Rule End

Event details
Event name	delete_preservation_rule_end
Parameters	additional_details string Additional details pertaining to an audit log. matter_id string The Matter ID an audit pertains to. organizational_unit_name string The organizational unit name. query string The user inputted query for search and exports. resource_name string The resource name of the action, such as hold name or saved query name. resource_url string The document URL of the document view. target_user string The targeted user (such as user put on hold).
Sample request	GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/vault?eventName=delete_preservation_rule_end&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format	Preservation rule deletion ended

Delete Retention Rule Begin

Event details
Event name	delete_retention_rule_begin
Parameters	additional_details string Additional details pertaining to an audit log. matter_id string The Matter ID an audit pertains to. organizational_unit_name string The organizational unit name. query string The user inputted query for search and exports. resource_name string The resource name of the action, such as hold name or saved query name. resource_url string The document URL of the document view. target_user string The targeted user (such as user put on hold).
Sample request	GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/vault?eventName=delete_retention_rule_begin&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format	Retention rule deletion began

Delete Retention Rule End

Event details
Event name	delete_retention_rule_end
Parameters	additional_details string Additional details pertaining to an audit log. matter_id string The Matter ID an audit pertains to. organizational_unit_name string The organizational unit name. query string The user inputted query for search and exports. resource_name string The resource name of the action, such as hold name or saved query name. resource_url string The document URL of the document view. target_user string The targeted user (such as user put on hold).
Sample request	GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/vault?eventName=delete_retention_rule_end&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format	Retention rule deletion ended

Delete Saved Query Begin

Event details
Event name	delete_saved_query_begin
Parameters	additional_details string Additional details pertaining to an audit log. matter_id string The Matter ID an audit pertains to. organizational_unit_name string The organizational unit name. query string The user inputted query for search and exports. resource_name string The resource name of the action, such as hold name or saved query name. resource_url string The document URL of the document view. target_user string The targeted user (such as user put on hold).
Sample request	GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/vault?eventName=delete_saved_query_begin&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format	Saved query deletion began

Delete Saved Query End

Event details
Event name	delete_saved_query_end
Parameters	additional_details string Additional details pertaining to an audit log. matter_id string The Matter ID an audit pertains to. organizational_unit_name string The organizational unit name. query string The user inputted query for search and exports. resource_name string The resource name of the action, such as hold name or saved query name. resource_url string The document URL of the document view. target_user string The targeted user (such as user put on hold).
Sample request	GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/vault?eventName=delete_saved_query_end&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format	Saved query deletion ended

Download Count Per Account CSV

Event details
Event name	download_count_per_account_csv
Parameters	additional_details string Additional details pertaining to an audit log. matter_id string The Matter ID an audit pertains to. organizational_unit_name string The organizational unit name. query string The user inputted query for search and exports. resource_name string The resource name of the action, such as hold name or saved query name. resource_url string The document URL of the document view. target_user string The targeted user (such as user put on hold).
Sample request	GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/vault?eventName=download_count_per_account_csv&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format	User downloaded count CSV results

Download Cross Matter Litigation Hold Report

Event details
Event name	download_cross_matter_litigation_hold_report
Parameters	additional_details string Additional details pertaining to an audit log. matter_id string The Matter ID an audit pertains to. organizational_unit_name string The organizational unit name. query string The user inputted query for search and exports. resource_name string The resource name of the action, such as hold name or saved query name. resource_url string The document URL of the document view. target_user string The targeted user (such as user put on hold).
Sample request	GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/vault?eventName=download_cross_matter_litigation_hold_report&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format	User downloaded cross matter litigation hold report

Download Per Matter Litigation Hold Report

Event details
Event name	download_per_matter_litigation_hold_report
Parameters	additional_details string Additional details pertaining to an audit log. matter_id string The Matter ID an audit pertains to. organizational_unit_name string The organizational unit name. query string The user inputted query for search and exports. resource_name string The resource name of the action, such as hold name or saved query name. resource_url string The document URL of the document view. target_user string The targeted user (such as user put on hold).
Sample request	GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/vault?eventName=download_per_matter_litigation_hold_report&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format	User downloaded per matter litigation hold report

Export

Event details
Event name	export
Parameters	additional_details string Additional details pertaining to an audit log. matter_id string The Matter ID an audit pertains to. organizational_unit_name string The organizational unit name. query string The user inputted query for search and exports. resource_name string The resource name of the action, such as hold name or saved query name. resource_url string The document URL of the document view. target_user string The targeted user (such as user put on hold).
Sample request	GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/vault?eventName=export&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format	User performed an export

Export File Download

Event details
Event name	export_file_download
Parameters	additional_details string Additional details pertaining to an audit log. matter_id string The Matter ID an audit pertains to. organizational_unit_name string The organizational unit name. query string The user inputted query for search and exports. resource_name string The resource name of the action, such as hold name or saved query name. resource_url string The document URL of the document view. target_user string The targeted user (such as user put on hold).
Sample request	GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/vault?eventName=export_file_download&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format	User downloaded an export file

Get Count Operation

Event details
Event name	get_count_operation
Parameters	additional_details string Additional details pertaining to an audit log. matter_id string The Matter ID an audit pertains to. organizational_unit_name string The organizational unit name. query string The user inputted query for search and exports. resource_name string The resource name of the action, such as hold name or saved query name. resource_url string The document URL of the document view. target_user string The targeted user (such as user put on hold).
Sample request	GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/vault?eventName=get_count_operation&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format	User viewed search count

Legacy Export Download

Event details
Event name	legacy_export_download
Parameters	additional_details string Additional details pertaining to an audit log. matter_id string The Matter ID an audit pertains to. organizational_unit_name string The organizational unit name. query string The user inputted query for search and exports. resource_name string The resource name of the action, such as hold name or saved query name. resource_url string The document URL of the document view. target_user string The targeted user (such as user put on hold).
Sample request	GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/vault?eventName=legacy_export_download&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format	User downloaded a legacy export

Modify Default Retention Period Begin

Event details
Event name	modify_default_retention_period_begin
Parameters	additional_details string Additional details pertaining to an audit log. matter_id string The Matter ID an audit pertains to. organizational_unit_name string The organizational unit name. query string The user inputted query for search and exports. resource_name string The resource name of the action, such as hold name or saved query name. resource_url string The document URL of the document view. target_user string The targeted user (such as user put on hold).
Sample request	GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/vault?eventName=modify_default_retention_period_begin&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format	Default retention period modification began

Modify Default Retention Period End

Event details
Event name	modify_default_retention_period_end
Parameters	additional_details string Additional details pertaining to an audit log. matter_id string The Matter ID an audit pertains to. organizational_unit_name string The organizational unit name. query string The user inputted query for search and exports. resource_name string The resource name of the action, such as hold name or saved query name. resource_url string The document URL of the document view. target_user string The targeted user (such as user put on hold).
Sample request	GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/vault?eventName=modify_default_retention_period_end&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format	Default retention period modification ended

Obsolete API Exports List

Event details
Event name	obsolete_api_exports_list
Parameters	additional_details string Additional details pertaining to an audit log. matter_id string The Matter ID an audit pertains to. organizational_unit_name string The organizational unit name. query string The user inputted query for search and exports. resource_name string The resource name of the action, such as hold name or saved query name. resource_url string The document URL of the document view. target_user string The targeted user (such as user put on hold).
Sample request	GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/vault?eventName=obsolete_api_exports_list&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format	Exports listed through the API

Obsolete API Holds Insert

Event details
Event name	obsolete_api_holds_insert
Parameters	additional_details string Additional details pertaining to an audit log. matter_id string The Matter ID an audit pertains to. organizational_unit_name string The organizational unit name. query string The user inputted query for search and exports. resource_name string The resource name of the action, such as hold name or saved query name. resource_url string The document URL of the document view. target_user string The targeted user (such as user put on hold).
Sample request	GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/vault?eventName=obsolete_api_holds_insert&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format	Holds inserted through the API

Obsolete API Holds List

Event details
Event name	obsolete_api_holds_list
Parameters	additional_details string Additional details pertaining to an audit log. matter_id string The Matter ID an audit pertains to. organizational_unit_name string The organizational unit name. query string The user inputted query for search and exports. resource_name string The resource name of the action, such as hold name or saved query name. resource_url string The document URL of the document view. target_user string The targeted user (such as user put on hold).
Sample request	GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/vault?eventName=obsolete_api_holds_list&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format	Holds listed through the API

Obsolete API Matters Delete

Event details
Event name	obsolete_api_matters_delete
Parameters	additional_details string Additional details pertaining to an audit log. matter_id string The Matter ID an audit pertains to. organizational_unit_name string The organizational unit name. query string The user inputted query for search and exports. resource_name string The resource name of the action, such as hold name or saved query name. resource_url string The document URL of the document view. target_user string The targeted user (such as user put on hold).
Sample request	GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/vault?eventName=obsolete_api_matters_delete&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format	Matters deleted through the API

Obsolete API Matters Get

Event details
Event name	obsolete_api_matters_get
Parameters	additional_details string Additional details pertaining to an audit log. matter_id string The Matter ID an audit pertains to. organizational_unit_name string The organizational unit name. query string The user inputted query for search and exports. resource_name string The resource name of the action, such as hold name or saved query name. resource_url string The document URL of the document view. target_user string The targeted user (such as user put on hold).
Sample request	GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/vault?eventName=obsolete_api_matters_get&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format	Matter details retrieved through the API

Obsolete API Matters Insert

Event details
Event name	obsolete_api_matters_insert
Parameters	additional_details string Additional details pertaining to an audit log. matter_id string The Matter ID an audit pertains to. organizational_unit_name string The organizational unit name. query string The user inputted query for search and exports. resource_name string The resource name of the action, such as hold name or saved query name. resource_url string The document URL of the document view. target_user string The targeted user (such as user put on hold).
Sample request	GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/vault?eventName=obsolete_api_matters_insert&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format	Matters inserted through the API

Obsolete API Matters List

Event details
Event name	obsolete_api_matters_list
Parameters	additional_details string Additional details pertaining to an audit log. matter_id string The Matter ID an audit pertains to. organizational_unit_name string The organizational unit name. query string The user inputted query for search and exports. resource_name string The resource name of the action, such as hold name or saved query name. resource_url string The document URL of the document view. target_user string The targeted user (such as user put on hold).
Sample request	GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/vault?eventName=obsolete_api_matters_list&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format	Matters listed through the API

Obsolete API Matters Update

Event details
Event name	obsolete_api_matters_update
Parameters	additional_details string Additional details pertaining to an audit log. matter_id string The Matter ID an audit pertains to. organizational_unit_name string The organizational unit name. query string The user inputted query for search and exports. resource_name string The resource name of the action, such as hold name or saved query name. resource_url string The document URL of the document view. target_user string The targeted user (such as user put on hold).
Sample request	GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/vault?eventName=obsolete_api_matters_update&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format	A matter updated through the API

Obsolete Preview Retention Rule Count

Event details
Event name	obsolete_preview_retention_rule_count
Parameters	additional_details string Additional details pertaining to an audit log. matter_id string The Matter ID an audit pertains to. organizational_unit_name string The organizational unit name. query string The user inputted query for search and exports. resource_name string The resource name of the action, such as hold name or saved query name. resource_url string The document URL of the document view. target_user string The targeted user (such as user put on hold).
Sample request	GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/vault?eventName=obsolete_preview_retention_rule_count&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format	User previewed retention rule count

Preview Retention Rule

Event details
Event name	preview_retention_rule
Parameters	additional_details string Additional details pertaining to an audit log. matter_id string The Matter ID an audit pertains to. organizational_unit_name string The organizational unit name. query string The user inputted query for search and exports. resource_name string The resource name of the action, such as hold name or saved query name. resource_url string The document URL of the document view. target_user string The targeted user (such as user put on hold).
Sample request	GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/vault?eventName=preview_retention_rule&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format	User previewed retention rule

Remove Collaborator Begin

Event details
Event name	remove_collaborator_begin
Parameters	additional_details string Additional details pertaining to an audit log. matter_id string The Matter ID an audit pertains to. organizational_unit_name string The organizational unit name. query string The user inputted query for search and exports. resource_name string The resource name of the action, such as hold name or saved query name. resource_url string The document URL of the document view. target_user string The targeted user (such as user put on hold).
Sample request	GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/vault?eventName=remove_collaborator_begin&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format	Collaborator removal began

Remove Collaborator End

Event details
Event name	remove_collaborator_end
Parameters	additional_details string Additional details pertaining to an audit log. matter_id string The Matter ID an audit pertains to. organizational_unit_name string The organizational unit name. query string The user inputted query for search and exports. resource_name string The resource name of the action, such as hold name or saved query name. resource_url string The document URL of the document view. target_user string The targeted user (such as user put on hold).
Sample request	GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/vault?eventName=remove_collaborator_end&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format	Collaborator removal ended

Remove Litigation Hold Begin

Event details
Event name	remove_litigation_hold_begin
Parameters	additional_details string Additional details pertaining to an audit log. matter_id string The Matter ID an audit pertains to. organizational_unit_name string The organizational unit name. query string The user inputted query for search and exports. resource_name string The resource name of the action, such as hold name or saved query name. resource_url string The document URL of the document view. target_user string The targeted user (such as user put on hold).
Sample request	GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/vault?eventName=remove_litigation_hold_begin&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format	Litigation hold removal began

Remove Litigation Hold End

Event details
Event name	remove_litigation_hold_end
Parameters	additional_details string Additional details pertaining to an audit log. matter_id string The Matter ID an audit pertains to. organizational_unit_name string The organizational unit name. query string The user inputted query for search and exports. resource_name string The resource name of the action, such as hold name or saved query name. resource_url string The document URL of the document view. target_user string The targeted user (such as user put on hold).
Sample request	GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/vault?eventName=remove_litigation_hold_end&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format	Litigation hold removal ended

Reopen Investigation Begin

Event details
Event name	reopen_investigation_begin
Parameters	additional_details string Additional details pertaining to an audit log. matter_id string The Matter ID an audit pertains to. organizational_unit_name string The organizational unit name. query string The user inputted query for search and exports. resource_name string The resource name of the action, such as hold name or saved query name. resource_url string The document URL of the document view. target_user string The targeted user (such as user put on hold).
Sample request	GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/vault?eventName=reopen_investigation_begin&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format	Investigation reopening began

Reopen Investigation End

Event details
Event name	reopen_investigation_end
Parameters	additional_details string Additional details pertaining to an audit log. matter_id string The Matter ID an audit pertains to. organizational_unit_name string The organizational unit name. query string The user inputted query for search and exports. resource_name string The resource name of the action, such as hold name or saved query name. resource_url string The document URL of the document view. target_user string The targeted user (such as user put on hold).
Sample request	GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/vault?eventName=reopen_investigation_end&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format	Investigation reopening ended

Restore Investigation Begin

Event details
Event name	restore_investigation_begin
Parameters	additional_details string Additional details pertaining to an audit log. matter_id string The Matter ID an audit pertains to. organizational_unit_name string The organizational unit name. query string The user inputted query for search and exports. resource_name string The resource name of the action, such as hold name or saved query name. resource_url string The document URL of the document view. target_user string The targeted user (such as user put on hold).
Sample request	GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/vault?eventName=restore_investigation_begin&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format	Investigation restoration began

Restore Investigation End

Event details
Event name	restore_investigation_end
Parameters	additional_details string Additional details pertaining to an audit log. matter_id string The Matter ID an audit pertains to. organizational_unit_name string The organizational unit name. query string The user inputted query for search and exports. resource_name string The resource name of the action, such as hold name or saved query name. resource_url string The document URL of the document view. target_user string The targeted user (such as user put on hold).
Sample request	GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/vault?eventName=restore_investigation_end&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format	Investigation restoration ended

Search

Event details
Event name	search
Parameters	additional_details string Additional details pertaining to an audit log. matter_id string The Matter ID an audit pertains to. organizational_unit_name string The organizational unit name. query string The user inputted query for search and exports. resource_name string The resource name of the action, such as hold name or saved query name. resource_url string The document URL of the document view. target_user string The targeted user (such as user put on hold).
Sample request	GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/vault?eventName=search&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format	User performed a search

Search Count

Event details
Event name	search_count
Parameters	additional_details string Additional details pertaining to an audit log. matter_id string The Matter ID an audit pertains to. organizational_unit_name string The organizational unit name. query string The user inputted query for search and exports. resource_name string The resource name of the action, such as hold name or saved query name. resource_url string The document URL of the document view. target_user string The targeted user (such as user put on hold).
Sample request	GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/vault?eventName=search_count&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format	User ran a count search

Update Investigation Details Begin

Event details
Event name	update_investigation_details_begin
Parameters	additional_details string Additional details pertaining to an audit log. matter_id string The Matter ID an audit pertains to. organizational_unit_name string The organizational unit name. query string The user inputted query for search and exports. resource_name string The resource name of the action, such as hold name or saved query name. resource_url string The document URL of the document view. target_user string The targeted user (such as user put on hold).
Sample request	GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/vault?eventName=update_investigation_details_begin&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format	Investigation details update began

Update Investigation Details End

Event details
Event name	update_investigation_details_end
Parameters	additional_details string Additional details pertaining to an audit log. matter_id string The Matter ID an audit pertains to. organizational_unit_name string The organizational unit name. query string The user inputted query for search and exports. resource_name string The resource name of the action, such as hold name or saved query name. resource_url string The document URL of the document view. target_user string The targeted user (such as user put on hold).
Sample request	GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/vault?eventName=update_investigation_details_end&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format	Investigation details update ended

Update Preservation Rule Add Holds Begin

Event details
Event name	update_preservation_rule_add_holds_begin
Parameters	additional_details string Additional details pertaining to an audit log. matter_id string The Matter ID an audit pertains to. organizational_unit_name string The organizational unit name. query string The user inputted query for search and exports. resource_name string The resource name of the action, such as hold name or saved query name. resource_url string The document URL of the document view. target_user string The targeted user (such as user put on hold).
Sample request	GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/vault?eventName=update_preservation_rule_add_holds_begin&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format	Preservation rule addition update began

Update Preservation Rule Add Holds End

Event details
Event name	update_preservation_rule_add_holds_end
Parameters	additional_details string Additional details pertaining to an audit log. matter_id string The Matter ID an audit pertains to. organizational_unit_name string The organizational unit name. query string The user inputted query for search and exports. resource_name string The resource name of the action, such as hold name or saved query name. resource_url string The document URL of the document view. target_user string The targeted user (such as user put on hold).
Sample request	GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/vault?eventName=update_preservation_rule_add_holds_end&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format	Preservation rule addition update ended

Update Preservation Rule Query Begin

Event details
Event name	update_preservation_rule_query_begin
Parameters	additional_details string Additional details pertaining to an audit log. matter_id string The Matter ID an audit pertains to. organizational_unit_name string The organizational unit name. query string The user inputted query for search and exports. resource_name string The resource name of the action, such as hold name or saved query name. resource_url string The document URL of the document view. target_user string The targeted user (such as user put on hold).
Sample request	GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/vault?eventName=update_preservation_rule_query_begin&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format	Preservation rule query update began

Update Preservation Rule Query End

Event details
Event name	update_preservation_rule_query_end
Parameters	additional_details string Additional details pertaining to an audit log. matter_id string The Matter ID an audit pertains to. organizational_unit_name string The organizational unit name. query string The user inputted query for search and exports. resource_name string The resource name of the action, such as hold name or saved query name. resource_url string The document URL of the document view. target_user string The targeted user (such as user put on hold).
Sample request	GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/vault?eventName=update_preservation_rule_query_end&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format	Preservation rule query update ended

Update Preservation Rule Remove Holds Begin

Event details
Event name	update_preservation_rule_remove_holds_begin
Parameters	additional_details string Additional details pertaining to an audit log. matter_id string The Matter ID an audit pertains to. organizational_unit_name string The organizational unit name. query string The user inputted query for search and exports. resource_name string The resource name of the action, such as hold name or saved query name. resource_url string The document URL of the document view. target_user string The targeted user (such as user put on hold).
Sample request	GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/vault?eventName=update_preservation_rule_remove_holds_begin&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format	Preservation rule removal update began

Update Preservation Rule Remove Holds End

Event details
Event name	update_preservation_rule_remove_holds_end
Parameters	additional_details string Additional details pertaining to an audit log. matter_id string The Matter ID an audit pertains to. organizational_unit_name string The organizational unit name. query string The user inputted query for search and exports. resource_name string The resource name of the action, such as hold name or saved query name. resource_url string The document URL of the document view. target_user string The targeted user (such as user put on hold).
Sample request	GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/vault?eventName=update_preservation_rule_remove_holds_end&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format	Preservation rule removal update ended

Update Retention Rule Begin

Event details
Event name	update_retention_rule_begin
Parameters	additional_details string Additional details pertaining to an audit log. matter_id string The Matter ID an audit pertains to. organizational_unit_name string The organizational unit name. query string The user inputted query for search and exports. resource_name string The resource name of the action, such as hold name or saved query name. resource_url string The document URL of the document view. target_user string The targeted user (such as user put on hold).
Sample request	GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/vault?eventName=update_retention_rule_begin&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format	Retention rule update began

Update Retention Rule End

Event details
Event name	update_retention_rule_end
Parameters	additional_details string Additional details pertaining to an audit log. matter_id string The Matter ID an audit pertains to. organizational_unit_name string The organizational unit name. query string The user inputted query for search and exports. resource_name string The resource name of the action, such as hold name or saved query name. resource_url string The document URL of the document view. target_user string The targeted user (such as user put on hold).
Sample request	GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/vault?eventName=update_retention_rule_end&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format	Retention rule update ended

Update Retention Settings

Event details
Event name	update_retention_settings
Parameters	additional_details string Additional details pertaining to an audit log. matter_id string The Matter ID an audit pertains to. organizational_unit_name string The organizational unit name. query string The user inputted query for search and exports. resource_name string The resource name of the action, such as hold name or saved query name. resource_url string The document URL of the document view. target_user string The targeted user (such as user put on hold).
Sample request	GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/vault?eventName=update_retention_settings&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format	User updated retention settings

Update Saved Query Details Begin

Event details
Event name	update_saved_query_details_begin
Parameters	additional_details string Additional details pertaining to an audit log. matter_id string The Matter ID an audit pertains to. organizational_unit_name string The organizational unit name. query string The user inputted query for search and exports. resource_name string The resource name of the action, such as hold name or saved query name. resource_url string The document URL of the document view. target_user string The targeted user (such as user put on hold).
Sample request	GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/vault?eventName=update_saved_query_details_begin&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format	Saved query details update began

Update Saved Query Details End

Event details
Event name	update_saved_query_details_end
Parameters	additional_details string Additional details pertaining to an audit log. matter_id string The Matter ID an audit pertains to. organizational_unit_name string The organizational unit name. query string The user inputted query for search and exports. resource_name string The resource name of the action, such as hold name or saved query name. resource_url string The document URL of the document view. target_user string The targeted user (such as user put on hold).
Sample request	GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/vault?eventName=update_saved_query_details_end&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format	Saved query details update ended

View Cross Matter Litigation Hold Report

Event details
Event name	view_cross_matter_litigation_hold_report
Parameters	additional_details string Additional details pertaining to an audit log. matter_id string The Matter ID an audit pertains to. organizational_unit_name string The organizational unit name. query string The user inputted query for search and exports. resource_name string The resource name of the action, such as hold name or saved query name. resource_url string The document URL of the document view. target_user string The targeted user (such as user put on hold).
Sample request	GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/vault?eventName=view_cross_matter_litigation_hold_report&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format	User viewed a cross matter litigation hold report

View Custodian Litigation Hold Report

Event details
Event name	view_custodian_litigation_hold_report
Parameters	additional_details string Additional details pertaining to an audit log. matter_id string The Matter ID an audit pertains to. organizational_unit_name string The organizational unit name. query string The user inputted query for search and exports. resource_name string The resource name of the action, such as hold name or saved query name. resource_url string The document URL of the document view. target_user string The targeted user (such as user put on hold).
Sample request	GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/vault?eventName=view_custodian_litigation_hold_report&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format	User viewed a custodian litigation hold report

View Document

Event details
Event name	view_document
Parameters	additional_details string Additional details pertaining to an audit log. matter_id string The Matter ID an audit pertains to. organizational_unit_name string The organizational unit name. query string The user inputted query for search and exports. resource_name string The resource name of the action, such as hold name or saved query name. resource_url string The document URL of the document view. target_user string The targeted user (such as user put on hold).
Sample request	GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/vault?eventName=view_document&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format	User viewed a document

View Document Information

Event details
Event name	view_document_information
Parameters	additional_details string Additional details pertaining to an audit log. matter_id string The Matter ID an audit pertains to. organizational_unit_name string The organizational unit name. query string The user inputted query for search and exports. resource_name string The resource name of the action, such as hold name or saved query name. resource_url string The document URL of the document view. target_user string The targeted user (such as user put on hold).
Sample request	GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/vault?eventName=view_document_information&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format	User viewed a document’s information

View External Document

Event details
Event name	view_external_document
Parameters	additional_details string Additional details pertaining to an audit log. matter_id string The Matter ID an audit pertains to. organizational_unit_name string The organizational unit name. query string The user inputted query for search and exports. resource_name string The resource name of the action, such as hold name or saved query name. resource_url string The document URL of the document view. target_user string The targeted user (such as user put on hold).
Sample request	GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/vault?eventName=view_external_document&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format	User viewed an external document

View Investigation

Event details
Event name	view_investigation
Parameters	additional_details string Additional details pertaining to an audit log. matter_id string The Matter ID an audit pertains to. organizational_unit_name string The organizational unit name. query string The user inputted query for search and exports. resource_name string The resource name of the action, such as hold name or saved query name. resource_url string The document URL of the document view. target_user string The targeted user (such as user put on hold).
Sample request	GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/vault?eventName=view_investigation&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format	User viewed a matter

View Matter Audit Log

Event details
Event name	view_matter_audit_log
Parameters	additional_details string Additional details pertaining to an audit log. matter_id string The Matter ID an audit pertains to. organizational_unit_name string The organizational unit name. query string The user inputted query for search and exports. resource_name string The resource name of the action, such as hold name or saved query name. resource_url string The document URL of the document view. target_user string The targeted user (such as user put on hold).
Sample request	GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/vault?eventName=view_matter_audit_log&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format	User viewed a matter’s log events

View Per Matter Litigation Hold Report

Event details
Event name	view_per_matter_litigation_hold_report
Parameters	additional_details string Additional details pertaining to an audit log. matter_id string The Matter ID an audit pertains to. organizational_unit_name string The organizational unit name. query string The user inputted query for search and exports. resource_name string The resource name of the action, such as hold name or saved query name. resource_url string The document URL of the document view. target_user string The targeted user (such as user put on hold).
Sample request	GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/vault?eventName=view_per_matter_litigation_hold_report&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format	User viewed a matter litigation hold report

View Retention Policy

Event details
Event name	view_retention_policy
Parameters	additional_details string Additional details pertaining to an audit log. matter_id string The Matter ID an audit pertains to. organizational_unit_name string The organizational unit name. query string The user inputted query for search and exports. resource_name string The resource name of the action, such as hold name or saved query name. resource_url string The document URL of the document view. target_user string The targeted user (such as user put on hold).
Sample request	GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/vault?eventName=view_retention_policy&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format	User viewed retention policy

View Retention Settings

Event details
Event name	view_retention_settings
Parameters	additional_details string Additional details pertaining to an audit log. matter_id string The Matter ID an audit pertains to. organizational_unit_name string The organizational unit name. query string The user inputted query for search and exports. resource_name string The resource name of the action, such as hold name or saved query name. resource_url string The document URL of the document view. target_user string The targeted user (such as user put on hold).
Sample request	GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/vault?eventName=view_retention_settings&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format	User viewed retention settings

View System Audit Log

Event details
Event name	view_system_audit_log
Parameters	additional_details string Additional details pertaining to an audit log. matter_id string The Matter ID an audit pertains to. organizational_unit_name string The organizational unit name. query string The user inputted query for search and exports. resource_name string The resource name of the action, such as hold name or saved query name. resource_url string The document URL of the document view. target_user string The targeted user (such as user put on hold).
Sample request	GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/vault?eventName=view_system_audit_log&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format	User viewed the system’s log events