# AccountWarning

- [JSON representation](https://developers.google.com/workspace/admin/alertcenter/reference/rest/v1beta1/AccountWarning#SCHEMA_REPRESENTATION)
- [LoginDetails](https://developers.google.com/workspace/admin/alertcenter/reference/rest/v1beta1/AccountWarning#LoginDetails)
  - [JSON representation](https://developers.google.com/workspace/admin/alertcenter/reference/rest/v1beta1/AccountWarning#LoginDetails.SCHEMA_REPRESENTATION)

Alerts for user account warning events.

| JSON representation |
|---|
| ``` { "email": string, "loginDetails": { object (`https://developers.google.com/workspace/admin/alertcenter/reference/rest/v1beta1/AccountWarning#LoginDetails`) } } ``` |

| Fields ||
|---|---|
| `email` | `string` Required. The email of the user that this event belongs to. |
| `loginDetails` | ``object (`https://developers.google.com/workspace/admin/alertcenter/reference/rest/v1beta1/AccountWarning#LoginDetails`)`` Optional. Details of the login action associated with the warning event. This is only available for: - Suspicious login - Suspicious login (less secure app) - Suspicious programmatic login - User suspended (suspicious activity) |

## LoginDetails

The details of the login action.

| JSON representation |
|---|
| ``` { "loginTime": string, "ipAddress": string } ``` |

| Fields ||
|---|---|
| `loginTime` | ``string (`https://protobuf.dev/reference/protobuf/google.protobuf#timestamp` format)`` Optional. The successful login time that is associated with the warning event. This isn't present for blocked login attempts. |
| `ipAddress` | `string` Optional. The human-readable IP address (for example, `11.22.33.44`) that is associated with the warning event. |