This document lists the events and parameters for
various types of
Gmail activity events. You can retrieve these events by
calling [Activities.list()](https://developers.google.com/workspace/admin/reports/v1/reference/activities/list)
with `applicationName=gmail`.

## Gmail audit event type


The type of Gmail audit events exported to Google Workspace customers.
Events of this type are returned with `type=delivery_type`.

### Gmail audit event

<br />

> [!NOTE]
> **Note:** For Gmail requests, `startTime` and `endTime` must be provided and the difference must not be greater than 30 days.

.

<br />

Event details Event name `delivery` Parameters `event_info` `message`


General information about the event. The listed nested parameter can be used as a filter using the full parameter name.

- `event_info.mail_event_type` (integer)

  Logged event type. Since `eventName` is always a constant (`delivery`) for Gmail audit logs, this field helps determine the actual event that occurred.

  Possible values are:
  - `0`: Unknown mail event type. This stage during mail delivery isn't surfaced in the Security Investigation Tool. For details, go to `https://support.google.com/a/answer/12384955#message_info.action_type`.
  - `1`: Message sent
  - `2`: Message received
  - `3`: A Gmail user manually applied a spam classification to the message. For example, the user marked the message as spam, phishing, or not spam.
  - `4`: Gmail flagged the message as spam after delivery. Several factors can cause this, including poor sender reputation or new virus hashes.
  - `5`: Message quarantined
  - `6`: Message released from quarantine
  - `7`: Message opened for the first time
  - `8`: Message marked as unread
  - `9`: Message replied to for the first time
  - `10`: Message forwarded for the first time
  - `11`: Message autoforwarded with a Gmail account forwarding setting
  - `12`: Message moved to Inbox
  - `13`: Message moved to Trash
  - `14`: Message removed from Trash
  - `15`: Link in message body was clicked
  - `16`: Link in message attachment link was clicked during attachment preview
  - `17`: One or more message attachments were downloaded
  - `18`: One or more message attachments saved to Google Drive
  - `19`: One or more Google Drive items in the message were saved to the recipient's Google Drive
  - `20`: Classification label applied to message
  - `21`: Message classification label change
  - `22`: Classification label removed from message
  - `23`: Classification label applied to all message attachments
  - `24`: Classification label changed on all message attachments
  - `25`: Classification label removed from all message attachments
  - `26`: Message archived
  - `27`: Message permanently deleted
  - `28`: One or more message attachments previewed
  - `29`: Message saved as draft
  - `30`: Message couldn't be delivered, and bounced
  - `31`: Message viewed, including first and following readings. For details on a known iOS issue, go to Google Workspace known issues.
  - `32`: Message downloaded
  - `33`: An application accessed a message on behalf of a user
  - `34`: Receive rate limited---Message was rejected or throttled due to receiving rate limits (DoS)
  - `35`: Email send process initiated by user or API

  .

  <br />

Sample request `GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/gmail?eventName=delivery&maxResults=10&access_token=YOUR_ACCESS_TOKEN` Admin Console message format `An event happened during mail delivery`