Access Evaluation Audit Activity Events

This document lists the events and parameters for various types of Access Evaluation Audit activity events. You can retrieve these events by calling Activities.list with applicationName=access_evaluation.

Access Token Evaluation

An access token evaluation was performed. Events of this type are returned with type=access_token_evaluation.

Access Token Request

An access token request was evaluated successfully to allow access.

Event details
Event name	allow_token_request
Parameters	client_type string Client Type of the client ID. Possible values: CONNECTED_DEVICE A connected device client. NATIVE_ANDROID An Android application. NATIVE_APPLICATION A native application. NATIVE_CHROME_EXTENSION A Chrome application. NATIVE_DEVICE A native device application. NATIVE_IOS An iOS application. NATIVE_SONY A native Sony application. TYPE_UNSPECIFIED An unspecified client type. WEB A web application. configuration_source string The Configuration Source. Possible values: APP_ACCESS_CONTROL Admin has set a policy in API Controls. CONFIGURATION_SOURCE_UNSPECIFIED Admin has not set any policy that blocks access for this application. DOMAIN_WIDE_DELEGATION Admin has domain wide delegated the application. GOOGLE_WORKSPACE_MARKETPLACE Admin has installed the application in Google Workspace Marketplace. MOBILE_DEVICE_MANAGEMENT Admin has set a policy in Google Endpoint Management. device_id string The Device ID. scope_data message The Scope Data. scopes_requested string Scopes for which the access was requested.
Sample request	GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/access_evaluation?eventName=allow_token_request&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format	{actor} token request from {APPLICATION_NAME_IDENTIFIER} was allowed due to {configuration_source}

Allow Token Impersonation

A Token impersonation was evaluated successfully to allow access.

Event details
Event name	allow_token_impersonation
Parameters	client_type string Client Type of the client ID. Possible values: CONNECTED_DEVICE A connected device client. NATIVE_ANDROID An Android application. NATIVE_APPLICATION A native application. NATIVE_CHROME_EXTENSION A Chrome application. NATIVE_DEVICE A native device application. NATIVE_IOS An iOS application. NATIVE_SONY A native Sony application. TYPE_UNSPECIFIED An unspecified client type. WEB A web application. configuration_source string The Configuration Source. Possible values: APP_ACCESS_CONTROL Admin has set a policy in API Controls. CONFIGURATION_SOURCE_UNSPECIFIED Admin has not set any policy that blocks access for this application. DOMAIN_WIDE_DELEGATION Admin has domain wide delegated the application. GOOGLE_WORKSPACE_MARKETPLACE Admin has installed the application in Google Workspace Marketplace. MOBILE_DEVICE_MANAGEMENT Admin has set a policy in Google Endpoint Management. device_id string The Device ID. scope_data message The Scope Data. scopes_requested string Scopes for which the access was requested. service_account string The Service Account.
Sample request	GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/access_evaluation?eventName=allow_token_impersonation&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format	{service_account} impersonation access for {actor} was allowed due to {configuration_source}

Credential Validation

An end user credential was validated against security policies. Events of this type are returned with type=credential_validation.

Allow Credential Validation Request

An end user credential was validated successfully against security policies to allow access.

Event details
Event name	allow_credential_validation_request
Parameters	scopes_requested string Scopes for which the access was requested.
Sample request	GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/access_evaluation?eventName=allow_credential_validation_request&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format	{actor} credential validation request from {APPLICATION_NAME_IDENTIFIER} was allowed due to security policy configuration