Reports API: Drive Activity Report

The Drive activity report returns information about how your account's users manage, modify, and share their Google Drive documents. This information gives you key insights into better content management and possible data leaks. Each report uses the basic report endpoint request with report- specific parameters such as an administrator's name or a specific Google Drive change. The maximum time period for each report is the last 180 days.

This document assumes you have successfully completed the API's setup and configuration steps.

The Google Drive activity report report may be used only for lawful purposes in accounts which have license assigned for one of the following SKUs:

  • G Suite Business
  • G Suite for Education
  • G Suite Enterprise

For information about the request's query strings and the response properties, see the API Reference. For information about specific events related to Google Drive, see Drive event names.

Retrieve Google Drive events for a domain

To retrieve all instances of the editing of your domain's Google Drive documents, use the following GET HTTP request and include the authorization token described in the authorization documentation.

The following example gets a report on the last 25 of your account's Drive events for the past 180 days. For an example of an API response, see the JSON response example.

GET https://www.googleapis.com/admin/reports/v1/activity/users/all
/applications/drive?maxResults=25

The following example gets a report on all of a customer's Drive events for the past 180 days. The customerId specifies which customer the report is to be retrieved for.

GET https://www.googleapis.com/admin/reports/v1/activity/users/all
/applications/drive?customerId=ABC123xyz

Retrieve Google Drive events by user

To retrieve a report of Google Drive activities of a specific user, use the following GET HTTP request using the authorization token described in the authorization documentation. The userKey is the primary email address the user in the report.

The following example retrieves a report on all changes for an account done by a specific user. For an example of an API response, see the sample JSON response:

GET https://www.googleapis.com/admin/reports/v1/activity/users/liz@example.com
/applications/drive

Retrieve Google Drive events for Team Drives

To retrieve a report of Google Drive activities for a specific Team Drive, use the following GET HTTP request using the authorization token described in the authorization documentation. The userKey is the primary email address the user in the report.

The following example retrieves a report on all changes for a specific Team Drive:

GET https://www.googleapis.com/admin/reports/v1/activity/users/all
/applications/drive?filters=team_drive_id==<id of Team Drive>

To retrieve events for a Team Drive itself, filter using the doc_type. The following example retrieves events affecting all Team Drives, but not the items contained within:

GET https://www.googleapis.com/admin/reports/v1/activity/users/all
/applications/drive?filters=doc_type=team_drive

To retrieve events for membership changes, query for the team_drive_membership_change event. The following example reports on all member additions to Team Drives:

GET https://www.googleapis.com/admin/reports/v1/activity/users/all
/applications/drive?evetName=team_drive_membership_change&
filters=membership_change_type==add_to_team_drive

Retrieve Google Drive events by event name

To retrieve a report of all instances of specific event type such as creating or editing a document, use the following GET HTTP request using the authorization token described in the authorization documentation. The userKey is the primary email address of the user in the report.

The following example retrieves a report on all account documentation creation activities. For an example of an API response, see the sample JSON response:

GET https://www.googleapis.com/admin/reports/v1/activity/users/all/applications/drive?eventName=create

Example JSON response

A successful response returns an HTTP 200 status code. Along with the status code, the response returns a report of the Drive. The Admin console can export this report in Comma-Separated Values (CSV) format. For more information, see the administration help center. For the eventName information, see the Drive event names reference information. For more information about the request's query strings and the response properties, see the API Reference.

{
 "kind": "reports#auditActivities",
 "nextPageToken": "next page's token",
 "items": [
  {
   "kind": "audit#activity",
   "id": {
    "time": "2014-03-17T15:39:18.460Z",
    "uniqQualifier": "report's unique ID",
    "applicationName": "drive",
    "customerId": "ABC123xyz"
   },
   "actor": {
   "callerType": "USER",
   "email": "liz@example.com",
   "profileId": "user's unique G Suite profile ID",
   "key": "consumer key of requestor in an OAuth 2LO request"
   },
   "ownerDomain": "domain of the source owner",
   "ipAddress": "user's IP address",
   "events": [
    {
     "type": "access",
     "name": "edit",
     "parameters": [
      {
        "name": "primary_event",
        "boolValue": true
      },
      {
        "name": "owner_is_team_drive",
        "boolValue": false
      },      {
        "name": "doc_id",
        "value": "1DWuYM3ot_sAyEQqOz0xWJ9bVMSYzOmRNeBqbgtSwuK8"
      },
      {
        "name": "doc_title",
        "value": "Meeting notes"
      },
      {
        "name": "doc_type",
        "value": "document"
      },
      {
        "name": "owner",
        "value": "mary@example.com"
      }
      ]
     }
    ]
   },
  ]
 }

Send feedback about...

Reports API
Reports API