# Google Cloud Platform Activity Events

This document lists the events and parameters for
various types of
Google Cloud Platform activity events. You can retrieve these events by
calling [Activities.list()](https://developers.google.com/workspace/admin/reports/v1/reference/activities/list)
with `applicationName=gcp`.

## Cloud OS Login


Interaction with the Cloud OS Login API.
Events of this type are returned with `type=CLOUD_OSLOGIN`.

### Add an SSH public key

User added an SSH public key.

| Event details ||
|---|---|
| Event name | `IMPORT_SSH_PUBLIC_KEY` |
| Parameters | |---|---| | `USER_EMAIL` | `string` The email address of the acting user. | |
| Sample request | `GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/gcp?eventName=IMPORT_SSH_PUBLIC_KEY&maxResults=10&access_token=YOUR_ACCESS_TOKEN` |
| Admin Console message format | `{USER_EMAIL} added an SSH public key.` |

### Delete a POSIX account

User deleted a POSIX account.

| Event details ||
|---|---|
| Event name | `DELETE_POSIX_ACCOUNT` |
| Parameters | |---|---| | `USER_EMAIL` | `string` The email address of the acting user. | |
| Sample request | `GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/gcp?eventName=DELETE_POSIX_ACCOUNT&maxResults=10&access_token=YOUR_ACCESS_TOKEN` |
| Admin Console message format | `{USER_EMAIL} deleted a POSIX account.` |

### Delete an SSH public key

User deleted an SSH public key.

| Event details ||
|---|---|
| Event name | `DELETE_SSH_PUBLIC_KEY` |
| Parameters | |---|---| | `USER_EMAIL` | `string` The email address of the acting user. | |
| Sample request | `GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/gcp?eventName=DELETE_SSH_PUBLIC_KEY&maxResults=10&access_token=YOUR_ACCESS_TOKEN` |
| Admin Console message format | `{USER_EMAIL} deleted an SSH public key.` |

### Retrieve an SSH public key

User retrieved SSH public key.

| Event details ||
|---|---|
| Event name | `GET_SSH_PUBLIC_KEY` |
| Parameters | |---|---| | `USER_EMAIL` | `string` The email address of the acting user. | |
| Sample request | `GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/gcp?eventName=GET_SSH_PUBLIC_KEY&maxResults=10&access_token=YOUR_ACCESS_TOKEN` |
| Admin Console message format | `{USER_EMAIL} retrieved an SSH public key.` |

### Retrieve the login profile

User retrieved the login profile.

| Event details ||
|---|---|
| Event name | `GET_LOGIN_PROFILE` |
| Parameters | |---|---| | `USER_EMAIL` | `string` The email address of the acting user. | |
| Sample request | `GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/gcp?eventName=GET_LOGIN_PROFILE&maxResults=10&access_token=YOUR_ACCESS_TOKEN` |
| Admin Console message format | `{USER_EMAIL} retrieved the profile information used for logging in to a virtual machine on Google Compute Engine.` |

### Update an SSH public key

User updated an SSH public key.

| Event details ||
|---|---|
| Event name | `UPDATE_SSH_PUBLIC_KEY` |
| Parameters | |---|---| | `USER_EMAIL` | `string` The email address of the acting user. | |
| Sample request | `GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/gcp?eventName=UPDATE_SSH_PUBLIC_KEY&maxResults=10&access_token=YOUR_ACCESS_TOKEN` |
| Admin Console message format | `{USER_EMAIL} updated an SSH public key.` |