# User Accounts Audit Activity Events

This document lists the events and parameters for
various types of
User Accounts Audit activity events. You can retrieve these events by
calling [Activities.list()](https://developers.google.com/workspace/admin/reports/v1/reference/activities/list)
with `applicationName=user_accounts`.

## 2-step verification enrollment changed


Events of this type are returned with `type=2sv_change`.

### 2-step verification disable

| Event details ||
|---|---|
| Event name | `2sv_disable` |
| Sample request | `GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/user_accounts?eventName=2sv_disable&maxResults=10&access_token=YOUR_ACCESS_TOKEN` |
| Admin Console message format | `{actor} has disabled 2-step verification` |

### 2-step verification enroll

| Event details ||
|---|---|
| Event name | `2sv_enroll` |
| Sample request | `GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/user_accounts?eventName=2sv_enroll&maxResults=10&access_token=YOUR_ACCESS_TOKEN` |
| Admin Console message format | `{actor} has enrolled for 2-step verification` |

## Account password changed


Events of this type are returned with `type=password_change`.

### Account password change

| Event details ||
|---|---|
| Event name | `password_edit` |
| Sample request | `GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/user_accounts?eventName=password_edit&maxResults=10&access_token=YOUR_ACCESS_TOKEN` |
| Admin Console message format | `{actor} has changed Account password` |

## Account recovery info changed


Account recovery information changed.
Events of this type are returned with `type=recovery_info_change`.

### Account recovery email change

| Event details ||
|---|---|
| Event name | `recovery_email_edit` |
| Sample request | `GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/user_accounts?eventName=recovery_email_edit&maxResults=10&access_token=YOUR_ACCESS_TOKEN` |
| Admin Console message format | `{actor} has changed Account recovery email` |

### Account recovery phone change

| Event details ||
|---|---|
| Event name | `recovery_phone_edit` |
| Sample request | `GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/user_accounts?eventName=recovery_phone_edit&maxResults=10&access_token=YOUR_ACCESS_TOKEN` |
| Admin Console message format | `{actor} has changed Account recovery phone` |

### Account recovery secret question/answer change

| Event details ||
|---|---|
| Event name | `recovery_secret_qa_edit` |
| Sample request | `GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/user_accounts?eventName=recovery_secret_qa_edit&maxResults=10&access_token=YOUR_ACCESS_TOKEN` |
| Admin Console message format | `{actor} has changed Account recovery secret question/answer` |

## Advanced Protection enrollment changed


Events of this type are returned with `type=titanium_change`.

### Advanced Protection enroll

| Event details ||
|---|---|
| Event name | `titanium_enroll` |
| Sample request | `GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/user_accounts?eventName=titanium_enroll&maxResults=10&access_token=YOUR_ACCESS_TOKEN` |
| Admin Console message format | `{actor} has enrolled for Advanced Protection` |

### Advanced Protection unenroll

| Event details ||
|---|---|
| Event name | `titanium_unenroll` |
| Sample request | `GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/user_accounts?eventName=titanium_unenroll&maxResults=10&access_token=YOUR_ACCESS_TOKEN` |
| Admin Console message format | `{actor} has disabled Advanced Protection` |

## Email forwarding settings changed


Events of this type are returned with `type=email_forwarding_change`.

### Out of domain email forwarding enabled

| Event details ||
|---|---|
| Event name | `email_forwarding_out_of_domain` |
| Sample request | `GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/user_accounts?eventName=email_forwarding_out_of_domain&maxResults=10&access_token=YOUR_ACCESS_TOKEN` |
| Admin Console message format | `{actor} has enabled out of domain email forwarding to {email_forwarding_destination_address}.` |