Retrieves a list of activities for a specific customer's account and application such as the Admin console application or the Google Drive application. For more information, see the guides for administrator and Google Drive activity reports. For more information about the activity report's parameters, see the activity parameters reference guides.
list_next(previous_request=*, previous_response=*)
Retrieves the next page of results.
Start receiving notifications for account activities. For more information, see Receiving Push Notifications.
list(userKey=*, applicationName=*, startTime=None, filters=None, eventName=None, actorIpAddress=None, pageToken=None, orgUnitID=None, maxResults=None, endTime=None, customerId=None)
Retrieves a list of activities for a specific customer's account and application such as the Admin console application or the Google Drive application. For more information, see the guides for administrator and Google Drive activity reports. For more information about the activity report's parameters, see the activity parameters reference guides.
Args:
userKey: string, Represents the profile ID or the user email for which the data should be filtered. Can be all for all information, or userKey for a user's unique G Suite profile ID or their primary email address. (required)
applicationName: string, Application name for which the events are to be retrieved. (required)
Allowed values
access_transparency - The G Suite Access Transparency activity reports return information about different types of Access Transparency activity events.
admin - The Admin console application's activity reports return account information about different types of administrator activity events.
calendar - The G Suite Calendar application's activity reports return information about various Calendar activity events.
chat - The Chat activity reports return information about various Chat activity events.
drive - The Google Drive application's activity reports return information about various Google Drive activity events. The Drive activity report is only available for G Suite Business customers.
gcp - The Google Cloud Platform application's activity reports return information about various GCP activity events.
gplus - The Google+ application's activity reports return information about various Google+ activity events.
groups - The Google Groups application's activity reports return information about various Groups activity events.
groups_enterprise - The Enterprise Groups activity reports return information about various Enterprise group activity events.
jamboard - The Jamboard activity reports return information about various Jamboard activity events.
login - The Login application's activity reports return account information about different types of Login activity events.
meet - The Meet Audit activity report return information about different types of Meet Audit activity events.
mobile - The Mobile Audit activity report return information about different types of Mobile Audit activity events.
rules - The Rules activity report return information about different types of Rules activity events.
saml - The SAML activity report return information about different types of SAML activity events.
token - The Token application's activity reports return account information about different types of Token activity events.
user_accounts - The User Accounts application's activity reports return account information about different types of User Accounts activity events.
startTime: string, Sets the beginning of the range of time shown in the report. The date is in the RFC 3339 format, for example 2010-10-28T10:26:35.000Z. The report returns all activities from startTime until endTime. The startTime must be before the endTime (if specified) and the current time when the request is made, or the API returns an error.
filters: string, The filters query string is a comma-separated list. The list is composed of event parameters that are manipulated by relational operators. Event parameters are in the form [parameter1 name][relational operator][parameter1 value],[parameter2 name][relational operator][parameter2 value],...
These event parameters are associated with a specific eventName. An empty report is returned if the filtered request's parameter does not belong to the eventName. For more information about eventName parameters, see the list of event names for various applications above in applicationName.
In the following Admin Activity example, the <> operator is URL-encoded in the request's query string (%3C%3E):
GET...&eventName=CHANGE_CALENDAR_SETTING &filters=NEW_VALUE%3C%3EREAD_ONLY_ACCESS
In the following Drive example, the list can be a view or edit event's doc_id parameter with a value that is manipulated by an 'equal to' (==) or 'not equal to' (<>) relational operator. In the first example, the report returns each edited document's doc_id. In the second example, the report returns each viewed document's doc_id that equals the value 12345 and does not return any viewed document's which have a doc_id value of 98765. The <> operator is URL-encoded in the request's query string (%3C%3E):
GET...&eventName=edit&filters=doc_id GET...&eventName=view&filters=doc_id==12345,doc_id%3C%3E98765
The relational operators include:
- == - 'equal to'.
- <> - 'not equal to'. It is URL-encoded (%3C%3E).
- < - 'less than'. It is URL-encoded (%3C).
- <= - 'less than or equal to'. It is URL-encoded (%3C=).
- > - 'greater than'. It is URL-encoded (%3E).
- >= - 'greater than or equal to'. It is URL-encoded (%3E=).
Note: The API doesn't accept multiple values of a parameter. If a particular parameter is supplied more than once in the API request, the API only accepts the last value of that request parameter.
In addition, if an invalid request parameter is supplied in the API request, the API ignores that request parameter and returns the response corresponding to the remaining valid request parameters. If no parameters are requested, all parameters are returned.
eventName: string, The name of the event being queried by the API. Each eventName is related to a specific G Suite service or feature which the API organizes into types of events. An example is the Google Calendar events in the Admin console application's reports. The Calendar Settings type structure has all of the Calendar eventName activities reported by the API. When an administrator changes a Calendar setting, the API reports this activity in the Calendar Settings type and eventName parameters. For more information about eventName query strings and parameters, see the list of event names for various applications above in applicationName.
actorIpAddress: string, The Internet Protocol (IP) Address of host where the event was performed. This is an additional way to filter a report's summary using the IP address of the user whose activity is being reported. This IP address may or may not reflect the user's physical location. For example, the IP address can be the user's proxy server's address or a virtual private network (VPN) address. This parameter supports both IPv4 and IPv6 address versions.
pageToken: string, The token to specify next page. A report with multiple pages has a nextPageToken property in the response. In your follow-on request getting the next page of the report, enter the nextPageToken value in the pageToken query string.
orgUnitID: string, ID of the organizational unit to report on. Activity records will be shown only for users who belong to the specified organizational unit. Data before Dec 17, 2018 doesn't appear in the filtered results.
maxResults: integer, Determines how many activity records are shown on each response page. For example, if the request sets maxResults=1 and the report has two activities, the report has two pages. The response's nextPageToken property has the token to the second page. The maxResults query string is optional in the request. The default value is 1000.
endTime: string, Sets the end of the range of time shown in the report. The date is in the RFC 3339 format, for example 2010-10-28T10:26:35.000Z. The default value is the approximate time of the API request. An API report has three basic time concepts:
- Date of the API's request for a report: When the API created and retrieved the report.
- Report's start time: The beginning of the timespan shown in the report. The startTime must be before the endTime (if specified) and the current time when the request is made, or the API returns an error.
- Report's end time: The end of the timespan shown in the report. For example, the timespan of events summarized in a report can start in April and end in May. The report itself can be requested in August. If the endTime is not specified, the report returns all activities from the startTime until the current time or the most recent 180 days if the startTime is more than 180 days in the past.
customerId: string, The unique ID of the customer to retrieve data for.
Returns:
An object of the form:
{ # JSON template for a collection of activites.
"nextPageToken": "A String", # Token for retrieving the follow-on next page of the report. The nextPageToken value is used in the request's pageToken query string.
"items": [ # Each activity record in the response.
{ # JSON template for the activity resource.
"kind": "admin#reports#activity", # The type of API resource. For an activity report, the value is audit#activity.
"ownerDomain": "A String", # This is the domain that is affected by the report's event. For example domain of Admin console or the Drive application's document owner.
"actor": { # User doing the action.
"profileId": "A String", # The unique G Suite profile ID of the actor. May be absent if the actor is not a G Suite user.
"email": "A String", # The primary email address of the actor. May be absent if there is no email address associated with the actor.
"key": "A String", # Only present when callerType is KEY. Can be the consumer_key of the requestor for OAuth 2LO API requests or an identifier for robot accounts.
"callerType": "A String", # The type of actor.
},
"id": { # Unique identifier for each activity record.
"applicationName": "A String", # Application name to which the event belongs. For possible values see the list of applications above in applicationName.
"uniqueQualifier": "A String", # Unique qualifier if multiple events have the same time.
"customerId": "A String", # The unique identifier for a G suite account.
"time": "A String", # Time of occurrence of the activity. This is in UNIX epoch time in seconds.
},
"etag": "A String", # ETag of the entry.
"ipAddress": "A String", # IP address of the user doing the action. This is the Internet Protocol (IP) address of the user when logging into G Suite which may or may not reflect the user's physical location. For example, the IP address can be the user's proxy server's address or a virtual private network (VPN) address. The API supports IPv4 and IPv6.
"events": [ # Activity events in the report.
{
"type": "A String", # Type of event. The G Suite service or feature that an administrator changes is identified in the type property which identifies an event using the eventName property. For a full list of the API's type categories, see the list of event names for various applications above in applicationName.
"name": "A String", # Name of the event. This is the specific name of the activity reported by the API. And each eventName is related to a specific G Suite service or feature which the API organizes into types of events.
# For eventName request parameters in general:
# - If no eventName is given, the report returns all possible instances of an eventName.
# - When you request an eventName, the API's response returns all activities which contain that eventName. It is possible that the returned activities will have other eventName properties in addition to the one requested.
# For more information about eventName properties, see the list of event names for various applications above in applicationName.
"parameters": [ # Parameter value pairs for various applications. For more information about eventName parameters, see the list of event names for various applications above in applicationName.
{
"name": "A String", # The name of the parameter.
"messageValue": { # Nested parameter value pairs associated with this parameter. Complex value type for a parameter are returned as a list of parameter values. For example, the address parameter may have a value as [{parameter: [{name: city, value: abc}]}]
"parameter": [ # Parameter values
{ # JSON template for a parameter used in various reports.
"name": "A String", # The name of the parameter.
"intValue": "A String", # Integer value of the parameter.
"value": "A String", # String value of the parameter.
"multiIntValue": [ # Multiple integer values of the parameter.
"A String",
],
"boolValue": True or False, # Boolean value of the parameter.
"multiValue": [ # Multiple string values of the parameter.
"A String",
],
"multiBoolValue": [ # Multiple boolean values of the parameter.
True or False,
],
},
],
},
"intValue": "A String", # Integer value of the parameter.
"value": "A String", # String value of the parameter.
"boolValue": True or False, # Boolean value of the parameter.
"multiValue": [ # String values of the parameter.
"A String",
],
"multiIntValue": [ # Integer values of the parameter.
"A String",
],
"multiMessageValue": [ # List of messageValue objects.
{
"parameter": [ # Parameter values
{ # JSON template for a parameter used in various reports.
"name": "A String", # The name of the parameter.
"intValue": "A String", # Integer value of the parameter.
"value": "A String", # String value of the parameter.
"multiIntValue": [ # Multiple integer values of the parameter.
"A String",
],
"boolValue": True or False, # Boolean value of the parameter.
"multiValue": [ # Multiple string values of the parameter.
"A String",
],
"multiBoolValue": [ # Multiple boolean values of the parameter.
True or False,
],
},
],
},
],
},
],
},
],
},
],
"kind": "admin#reports#activities", # The type of API resource. For an activity report, the value is reports#activities.
"etag": "A String", # ETag of the resource.
}
list_next(previous_request=*, previous_response=*)
Retrieves the next page of results.
Args:
previous_request: The request for the previous page. (required)
previous_response: The response from the request for the previous page. (required)
Returns:
A request object that you can call 'execute()' on to request the next
page. Returns None if there are no more items in the collection.
watch(userKey=*, applicationName=*, body=None, startTime=None, filters=None, eventName=None, actorIpAddress=None, pageToken=None, orgUnitID=None, maxResults=None, endTime=None, customerId=None)
Start receiving notifications for account activities. For more information, see Receiving Push Notifications.
Args:
userKey: string, Represents the profile ID or the user email for which the data should be filtered. Can be all for all information, or userKey for a user's unique G Suite profile ID or their primary email address. (required)
applicationName: string, Application name for which the events are to be retrieved. (required)
Allowed values
access_transparency - The G Suite Access Transparency activity reports return information about different types of Access Transparency activity events.
admin - The Admin console application's activity reports return account information about different types of administrator activity events.
calendar - The G Suite Calendar application's activity reports return information about various Calendar activity events.
chat - The Chat activity reports return information about various Chat activity events.
drive - The Google Drive application's activity reports return information about various Google Drive activity events. The Drive activity report is only available for G Suite Business customers.
gcp - The Google Cloud Platform application's activity reports return information about various GCP activity events.
gplus - The Google+ application's activity reports return information about various Google+ activity events.
groups - The Google Groups application's activity reports return information about various Groups activity events.
groups_enterprise - The Enterprise Groups activity reports return information about various Enterprise group activity events.
jamboard - The Jamboard activity reports return information about various Jamboard activity events.
login - The Login application's activity reports return account information about different types of Login activity events.
meet - The Meet Audit activity report return information about different types of Meet Audit activity events.
mobile - The Mobile Audit activity report return information about different types of Mobile Audit activity events.
rules - The Rules activity report return information about different types of Rules activity events.
saml - The SAML activity report return information about different types of SAML activity events.
token - The Token application's activity reports return account information about different types of Token activity events.
user_accounts - The User Accounts application's activity reports return account information about different types of User Accounts activity events.
body: object, The request body.
The object takes the form of:
{ # An notification channel used to watch for resource changes.
"resourceUri": "A String", # A version-specific identifier for the watched resource.
"kind": "api#channel", # Identifies this as a notification channel used to watch for changes to a resource, which is "api#channel".
"resourceId": "A String", # An opaque ID that identifies the resource being watched on this channel. Stable across different API versions.
"payload": True or False, # A Boolean value to indicate whether payload is wanted. Optional.
"token": "A String", # An arbitrary string delivered to the target address with each notification delivered over this channel. Optional.
"params": { # Additional parameters controlling delivery channel behavior. Optional.
"a_key": "A String", # Declares a new parameter by name.
},
"expiration": "A String", # Date and time of notification channel expiration, expressed as a Unix timestamp, in milliseconds. Optional.
"address": "A String", # The address where notifications are delivered for this channel.
"type": "A String", # The type of delivery mechanism used for this channel.
"id": "A String", # A UUID or similar unique string that identifies this channel.
}
startTime: string, Sets the beginning of the range of time shown in the report. The date is in the RFC 3339 format, for example 2010-10-28T10:26:35.000Z. The report returns all activities from startTime until endTime. The startTime must be before the endTime (if specified) and the current time when the request is made, or the API returns an error.
filters: string, The filters query string is a comma-separated list. The list is composed of event parameters that are manipulated by relational operators. Event parameters are in the form [parameter1 name][relational operator][parameter1 value],[parameter2 name][relational operator][parameter2 value],...
These event parameters are associated with a specific eventName. An empty report is returned if the filtered request's parameter does not belong to the eventName. For more information about eventName parameters, see the list of event names for various applications above in applicationName.
In the following Admin Activity example, the <> operator is URL-encoded in the request's query string (%3C%3E):
GET...&eventName=CHANGE_CALENDAR_SETTING &filters=NEW_VALUE%3C%3EREAD_ONLY_ACCESS
In the following Drive example, the list can be a view or edit event's doc_id parameter with a value that is manipulated by an 'equal to' (==) or 'not equal to' (<>) relational operator. In the first example, the report returns each edited document's doc_id. In the second example, the report returns each viewed document's doc_id that equals the value 12345 and does not return any viewed document's which have a doc_id value of 98765. The <> operator is URL-encoded in the request's query string (%3C%3E):
GET...&eventName=edit&filters=doc_id GET...&eventName=view&filters=doc_id==12345,doc_id%3C%3E98765
The relational operators include:
- == - 'equal to'.
- <> - 'not equal to'. It is URL-encoded (%3C%3E).
- < - 'less than'. It is URL-encoded (%3C).
- <= - 'less than or equal to'. It is URL-encoded (%3C=).
- > - 'greater than'. It is URL-encoded (%3E).
- >= - 'greater than or equal to'. It is URL-encoded (%3E=).
Note: The API doesn't accept multiple values of a parameter. If a particular parameter is supplied more than once in the API request, the API only accepts the last value of that request parameter.
In addition, if an invalid request parameter is supplied in the API request, the API ignores that request parameter and returns the response corresponding to the remaining valid request parameters. If no parameters are requested, all parameters are returned.
eventName: string, The name of the event being queried by the API. Each eventName is related to a specific G Suite service or feature which the API organizes into types of events. An example is the Google Calendar events in the Admin console application's reports. The Calendar Settings type structure has all of the Calendar eventName activities reported by the API. When an administrator changes a Calendar setting, the API reports this activity in the Calendar Settings type and eventName parameters. For more information about eventName query strings and parameters, see the list of event names for various applications above in applicationName.
actorIpAddress: string, The Internet Protocol (IP) Address of host where the event was performed. This is an additional way to filter a report's summary using the IP address of the user whose activity is being reported. This IP address may or may not reflect the user's physical location. For example, the IP address can be the user's proxy server's address or a virtual private network (VPN) address. This parameter supports both IPv4 and IPv6 address versions.
pageToken: string, The token to specify next page. A report with multiple pages has a nextPageToken property in the response. In your follow-on request getting the next page of the report, enter the nextPageToken value in the pageToken query string.
orgUnitID: string, ID of the organizational unit to report on. Activity records will be shown only for users who belong to the specified organizational unit. Data before Dec 17, 2018 doesn't appear in the filtered results.
maxResults: integer, Determines how many activity records are shown on each response page. For example, if the request sets maxResults=1 and the report has two activities, the report has two pages. The response's nextPageToken property has the token to the second page. The maxResults query string is optional in the request. The default value is 1000.
endTime: string, Sets the end of the range of time shown in the report. The date is in the RFC 3339 format, for example 2010-10-28T10:26:35.000Z. The default value is the approximate time of the API request. An API report has three basic time concepts:
- Date of the API's request for a report: When the API created and retrieved the report.
- Report's start time: The beginning of the timespan shown in the report. The startTime must be before the endTime (if specified) and the current time when the request is made, or the API returns an error.
- Report's end time: The end of the timespan shown in the report. For example, the timespan of events summarized in a report can start in April and end in May. The report itself can be requested in August. If the endTime is not specified, the report returns all activities from the startTime until the current time or the most recent 180 days if the startTime is more than 180 days in the past.
customerId: string, The unique ID of the customer to retrieve data for.
Returns:
An object of the form:
{ # An notification channel used to watch for resource changes.
"resourceUri": "A String", # A version-specific identifier for the watched resource.
"kind": "api#channel", # Identifies this as a notification channel used to watch for changes to a resource, which is "api#channel".
"resourceId": "A String", # An opaque ID that identifies the resource being watched on this channel. Stable across different API versions.
"payload": True or False, # A Boolean value to indicate whether payload is wanted. Optional.
"token": "A String", # An arbitrary string delivered to the target address with each notification delivered over this channel. Optional.
"params": { # Additional parameters controlling delivery channel behavior. Optional.
"a_key": "A String", # Declares a new parameter by name.
},
"expiration": "A String", # Date and time of notification channel expiration, expressed as a Unix timestamp, in milliseconds. Optional.
"address": "A String", # The address where notifications are delivered for this channel.
"type": "A String", # The type of delivery mechanism used for this channel.
"id": "A String", # A UUID or similar unique string that identifies this channel.
}