Stay organized with collections
Save and categorize content based on your preferences.
This document lists the events and parameters for
various types of
Vault Audit activity events. You can retrieve these events by
calling Activities.list()
with applicationName=vault.
Event Type: User Action
User Action Event Type.
Events of this type are returned with type=user_action.
Add Collaborator Begin
Event details
Event name
add_collaborator_begin
Parameters
additional_details
string
Additional details pertaining to an audit log.
matter_id
string
The Matter ID an audit pertains to.
organizational_unit_name
string
The organizational unit name.
query
string
The user inputted query for search and exports.
resource_name
string
The resource name of the action, such as hold name or saved query name.
resource_url
string
The document URL of the document view.
target_user
string
The targeted user (such as user put on hold).
Sample request
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/vault?eventName=add_collaborator_begin&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format
Collaborator addition began
Add Collaborator End
Event details
Event name
add_collaborator_end
Parameters
additional_details
string
Additional details pertaining to an audit log.
matter_id
string
The Matter ID an audit pertains to.
organizational_unit_name
string
The organizational unit name.
query
string
The user inputted query for search and exports.
resource_name
string
The resource name of the action, such as hold name or saved query name.
resource_url
string
The document URL of the document view.
target_user
string
The targeted user (such as user put on hold).
Sample request
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/vault?eventName=add_collaborator_end&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format
Collaborator addition ended
Add Litigation Hold Begin
Event details
Event name
add_litigation_hold_begin
Parameters
additional_details
string
Additional details pertaining to an audit log.
matter_id
string
The Matter ID an audit pertains to.
organizational_unit_name
string
The organizational unit name.
query
string
The user inputted query for search and exports.
resource_name
string
The resource name of the action, such as hold name or saved query name.
resource_url
string
The document URL of the document view.
target_user
string
The targeted user (such as user put on hold).
Sample request
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/vault?eventName=add_litigation_hold_begin&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format
Litigation hold addition began
Add Litigation Hold End
Event details
Event name
add_litigation_hold_end
Parameters
additional_details
string
Additional details pertaining to an audit log.
matter_id
string
The Matter ID an audit pertains to.
organizational_unit_name
string
The organizational unit name.
query
string
The user inputted query for search and exports.
resource_name
string
The resource name of the action, such as hold name or saved query name.
resource_url
string
The document URL of the document view.
target_user
string
The targeted user (such as user put on hold).
Sample request
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/vault?eventName=add_litigation_hold_end&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format
Litigation hold addition ended
Add Preservation Rule Begin
Event details
Event name
add_preservation_rule_begin
Parameters
additional_details
string
Additional details pertaining to an audit log.
matter_id
string
The Matter ID an audit pertains to.
organizational_unit_name
string
The organizational unit name.
query
string
The user inputted query for search and exports.
resource_name
string
The resource name of the action, such as hold name or saved query name.
resource_url
string
The document URL of the document view.
target_user
string
The targeted user (such as user put on hold).
Sample request
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/vault?eventName=add_preservation_rule_begin&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format
Preservation rule addition began
Add Preservation Rule End
Event details
Event name
add_preservation_rule_end
Parameters
additional_details
string
Additional details pertaining to an audit log.
matter_id
string
The Matter ID an audit pertains to.
organizational_unit_name
string
The organizational unit name.
query
string
The user inputted query for search and exports.
resource_name
string
The resource name of the action, such as hold name or saved query name.
resource_url
string
The document URL of the document view.
target_user
string
The targeted user (such as user put on hold).
Sample request
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/vault?eventName=add_preservation_rule_end&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format
Preservation rule addition ended
Add Retention Rule Begin
Event details
Event name
add_retention_rule_begin
Parameters
additional_details
string
Additional details pertaining to an audit log.
matter_id
string
The Matter ID an audit pertains to.
organizational_unit_name
string
The organizational unit name.
query
string
The user inputted query for search and exports.
resource_name
string
The resource name of the action, such as hold name or saved query name.
resource_url
string
The document URL of the document view.
target_user
string
The targeted user (such as user put on hold).
Sample request
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/vault?eventName=add_retention_rule_begin&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format
Retention rule addition began
Add Retention Rule End
Event details
Event name
add_retention_rule_end
Parameters
additional_details
string
Additional details pertaining to an audit log.
matter_id
string
The Matter ID an audit pertains to.
organizational_unit_name
string
The organizational unit name.
query
string
The user inputted query for search and exports.
resource_name
string
The resource name of the action, such as hold name or saved query name.
resource_url
string
The document URL of the document view.
target_user
string
The targeted user (such as user put on hold).
Sample request
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/vault?eventName=add_retention_rule_end&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format
Retention rule addition ended
Close Investigation Begin
Event details
Event name
close_investigation_begin
Parameters
additional_details
string
Additional details pertaining to an audit log.
matter_id
string
The Matter ID an audit pertains to.
organizational_unit_name
string
The organizational unit name.
query
string
The user inputted query for search and exports.
resource_name
string
The resource name of the action, such as hold name or saved query name.
resource_url
string
The document URL of the document view.
target_user
string
The targeted user (such as user put on hold).
Sample request
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/vault?eventName=close_investigation_begin&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format
Investigation closure began
Close Investigation End
Event details
Event name
close_investigation_end
Parameters
additional_details
string
Additional details pertaining to an audit log.
matter_id
string
The Matter ID an audit pertains to.
organizational_unit_name
string
The organizational unit name.
query
string
The user inputted query for search and exports.
resource_name
string
The resource name of the action, such as hold name or saved query name.
resource_url
string
The document URL of the document view.
target_user
string
The targeted user (such as user put on hold).
Sample request
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/vault?eventName=close_investigation_end&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format
Investigation closure ended
Convert Saved Query To Collection Begin
Event details
Event name
convert_saved_query_to_collection_begin
Parameters
additional_details
string
Additional details pertaining to an audit log.
matter_id
string
The Matter ID an audit pertains to.
organizational_unit_name
string
The organizational unit name.
query
string
The user inputted query for search and exports.
resource_name
string
The resource name of the action, such as hold name or saved query name.
resource_url
string
The document URL of the document view.
target_user
string
The targeted user (such as user put on hold).
Sample request
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/vault?eventName=convert_saved_query_to_collection_begin&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format
Saved query to collection conversion began
Convert Saved Query To Collection End
Event details
Event name
convert_saved_query_to_collection_end
Parameters
additional_details
string
Additional details pertaining to an audit log.
matter_id
string
The Matter ID an audit pertains to.
organizational_unit_name
string
The organizational unit name.
query
string
The user inputted query for search and exports.
resource_name
string
The resource name of the action, such as hold name or saved query name.
resource_url
string
The document URL of the document view.
target_user
string
The targeted user (such as user put on hold).
Sample request
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/vault?eventName=convert_saved_query_to_collection_end&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format
Saved query to collection conversion ended
Create Export Begin
Event details
Event name
create_export_begin
Parameters
additional_details
string
Additional details pertaining to an audit log.
matter_id
string
The Matter ID an audit pertains to.
organizational_unit_name
string
The organizational unit name.
query
string
The user inputted query for search and exports.
resource_name
string
The resource name of the action, such as hold name or saved query name.
resource_url
string
The document URL of the document view.
target_user
string
The targeted user (such as user put on hold).
Sample request
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/vault?eventName=create_export_begin&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format
Export creation began
Create Export End
Event details
Event name
create_export_end
Parameters
additional_details
string
Additional details pertaining to an audit log.
matter_id
string
The Matter ID an audit pertains to.
organizational_unit_name
string
The organizational unit name.
query
string
The user inputted query for search and exports.
resource_name
string
The resource name of the action, such as hold name or saved query name.
resource_url
string
The document URL of the document view.
target_user
string
The targeted user (such as user put on hold).
Sample request
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/vault?eventName=create_export_end&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format
Export creation ended
Create Investigation Begin
Event details
Event name
create_investigation_begin
Parameters
additional_details
string
Additional details pertaining to an audit log.
matter_id
string
The Matter ID an audit pertains to.
organizational_unit_name
string
The organizational unit name.
query
string
The user inputted query for search and exports.
resource_name
string
The resource name of the action, such as hold name or saved query name.
resource_url
string
The document URL of the document view.
target_user
string
The targeted user (such as user put on hold).
Sample request
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/vault?eventName=create_investigation_begin&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format
Investigation creation began
Create Investigation End
Event details
Event name
create_investigation_end
Parameters
additional_details
string
Additional details pertaining to an audit log.
matter_id
string
The Matter ID an audit pertains to.
organizational_unit_name
string
The organizational unit name.
query
string
The user inputted query for search and exports.
resource_name
string
The resource name of the action, such as hold name or saved query name.
resource_url
string
The document URL of the document view.
target_user
string
The targeted user (such as user put on hold).
Sample request
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/vault?eventName=create_investigation_end&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format
Investigation creation ended
Create Saved Query Begin
Event details
Event name
create_saved_query_begin
Parameters
additional_details
string
Additional details pertaining to an audit log.
matter_id
string
The Matter ID an audit pertains to.
organizational_unit_name
string
The organizational unit name.
query
string
The user inputted query for search and exports.
resource_name
string
The resource name of the action, such as hold name or saved query name.
resource_url
string
The document URL of the document view.
target_user
string
The targeted user (such as user put on hold).
Sample request
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/vault?eventName=create_saved_query_begin&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format
Saved query creation began
Create Saved Query End
Event details
Event name
create_saved_query_end
Parameters
additional_details
string
Additional details pertaining to an audit log.
matter_id
string
The Matter ID an audit pertains to.
organizational_unit_name
string
The organizational unit name.
query
string
The user inputted query for search and exports.
resource_name
string
The resource name of the action, such as hold name or saved query name.
resource_url
string
The document URL of the document view.
target_user
string
The targeted user (such as user put on hold).
Sample request
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/vault?eventName=create_saved_query_end&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format
Saved query creation ended
Delete Export Begin
Event details
Event name
delete_export_begin
Parameters
additional_details
string
Additional details pertaining to an audit log.
matter_id
string
The Matter ID an audit pertains to.
organizational_unit_name
string
The organizational unit name.
query
string
The user inputted query for search and exports.
resource_name
string
The resource name of the action, such as hold name or saved query name.
resource_url
string
The document URL of the document view.
target_user
string
The targeted user (such as user put on hold).
Sample request
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/vault?eventName=delete_export_begin&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format
Export deletion began
Delete Export End
Event details
Event name
delete_export_end
Parameters
additional_details
string
Additional details pertaining to an audit log.
matter_id
string
The Matter ID an audit pertains to.
organizational_unit_name
string
The organizational unit name.
query
string
The user inputted query for search and exports.
resource_name
string
The resource name of the action, such as hold name or saved query name.
resource_url
string
The document URL of the document view.
target_user
string
The targeted user (such as user put on hold).
Sample request
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/vault?eventName=delete_export_end&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format
Export deletion ended
Delete Export Fail
Event details
Event name
delete_export_fail
Parameters
additional_details
string
Additional details pertaining to an audit log.
matter_id
string
The Matter ID an audit pertains to.
organizational_unit_name
string
The organizational unit name.
query
string
The user inputted query for search and exports.
resource_name
string
The resource name of the action, such as hold name or saved query name.
resource_url
string
The document URL of the document view.
target_user
string
The targeted user (such as user put on hold).
Sample request
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/vault?eventName=delete_export_fail&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format
Export deletion failed
Delete Investigation Begin
Event details
Event name
delete_investigation_begin
Parameters
additional_details
string
Additional details pertaining to an audit log.
matter_id
string
The Matter ID an audit pertains to.
organizational_unit_name
string
The organizational unit name.
query
string
The user inputted query for search and exports.
resource_name
string
The resource name of the action, such as hold name or saved query name.
resource_url
string
The document URL of the document view.
target_user
string
The targeted user (such as user put on hold).
Sample request
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/vault?eventName=delete_investigation_begin&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format
Investigation deletion began
Delete Investigation End
Event details
Event name
delete_investigation_end
Parameters
additional_details
string
Additional details pertaining to an audit log.
matter_id
string
The Matter ID an audit pertains to.
organizational_unit_name
string
The organizational unit name.
query
string
The user inputted query for search and exports.
resource_name
string
The resource name of the action, such as hold name or saved query name.
resource_url
string
The document URL of the document view.
target_user
string
The targeted user (such as user put on hold).
Sample request
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/vault?eventName=delete_investigation_end&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format
Investigation deletion ended
Delete Preservation Rule Begin
Event details
Event name
delete_preservation_rule_begin
Parameters
additional_details
string
Additional details pertaining to an audit log.
matter_id
string
The Matter ID an audit pertains to.
organizational_unit_name
string
The organizational unit name.
query
string
The user inputted query for search and exports.
resource_name
string
The resource name of the action, such as hold name or saved query name.
resource_url
string
The document URL of the document view.
target_user
string
The targeted user (such as user put on hold).
Sample request
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/vault?eventName=delete_preservation_rule_begin&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format
Preservation rule deletion began
Delete Preservation Rule End
Event details
Event name
delete_preservation_rule_end
Parameters
additional_details
string
Additional details pertaining to an audit log.
matter_id
string
The Matter ID an audit pertains to.
organizational_unit_name
string
The organizational unit name.
query
string
The user inputted query for search and exports.
resource_name
string
The resource name of the action, such as hold name or saved query name.
resource_url
string
The document URL of the document view.
target_user
string
The targeted user (such as user put on hold).
Sample request
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/vault?eventName=delete_preservation_rule_end&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format
Preservation rule deletion ended
Delete Retention Rule Begin
Event details
Event name
delete_retention_rule_begin
Parameters
additional_details
string
Additional details pertaining to an audit log.
matter_id
string
The Matter ID an audit pertains to.
organizational_unit_name
string
The organizational unit name.
query
string
The user inputted query for search and exports.
resource_name
string
The resource name of the action, such as hold name or saved query name.
resource_url
string
The document URL of the document view.
target_user
string
The targeted user (such as user put on hold).
Sample request
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/vault?eventName=delete_retention_rule_begin&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format
Retention rule deletion began
Delete Retention Rule End
Event details
Event name
delete_retention_rule_end
Parameters
additional_details
string
Additional details pertaining to an audit log.
matter_id
string
The Matter ID an audit pertains to.
organizational_unit_name
string
The organizational unit name.
query
string
The user inputted query for search and exports.
resource_name
string
The resource name of the action, such as hold name or saved query name.
resource_url
string
The document URL of the document view.
target_user
string
The targeted user (such as user put on hold).
Sample request
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/vault?eventName=delete_retention_rule_end&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format
Retention rule deletion ended
Delete Saved Query Begin
Event details
Event name
delete_saved_query_begin
Parameters
additional_details
string
Additional details pertaining to an audit log.
matter_id
string
The Matter ID an audit pertains to.
organizational_unit_name
string
The organizational unit name.
query
string
The user inputted query for search and exports.
resource_name
string
The resource name of the action, such as hold name or saved query name.
resource_url
string
The document URL of the document view.
target_user
string
The targeted user (such as user put on hold).
Sample request
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/vault?eventName=delete_saved_query_begin&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format
Saved query deletion began
Delete Saved Query End
Event details
Event name
delete_saved_query_end
Parameters
additional_details
string
Additional details pertaining to an audit log.
matter_id
string
The Matter ID an audit pertains to.
organizational_unit_name
string
The organizational unit name.
query
string
The user inputted query for search and exports.
resource_name
string
The resource name of the action, such as hold name or saved query name.
resource_url
string
The document URL of the document view.
target_user
string
The targeted user (such as user put on hold).
Sample request
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/vault?eventName=delete_saved_query_end&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format
Saved query deletion ended
Download Count Per Account CSV
Event details
Event name
download_count_per_account_csv
Parameters
additional_details
string
Additional details pertaining to an audit log.
matter_id
string
The Matter ID an audit pertains to.
organizational_unit_name
string
The organizational unit name.
query
string
The user inputted query for search and exports.
resource_name
string
The resource name of the action, such as hold name or saved query name.
resource_url
string
The document URL of the document view.
target_user
string
The targeted user (such as user put on hold).
Sample request
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/vault?eventName=download_count_per_account_csv&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format
User downloaded count CSV results
Download Cross Matter Litigation Hold Report
Event details
Event name
download_cross_matter_litigation_hold_report
Parameters
additional_details
string
Additional details pertaining to an audit log.
matter_id
string
The Matter ID an audit pertains to.
organizational_unit_name
string
The organizational unit name.
query
string
The user inputted query for search and exports.
resource_name
string
The resource name of the action, such as hold name or saved query name.
resource_url
string
The document URL of the document view.
target_user
string
The targeted user (such as user put on hold).
Sample request
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/vault?eventName=download_cross_matter_litigation_hold_report&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format
User downloaded cross matter litigation hold report
Download Per Matter Litigation Hold Report
Event details
Event name
download_per_matter_litigation_hold_report
Parameters
additional_details
string
Additional details pertaining to an audit log.
matter_id
string
The Matter ID an audit pertains to.
organizational_unit_name
string
The organizational unit name.
query
string
The user inputted query for search and exports.
resource_name
string
The resource name of the action, such as hold name or saved query name.
resource_url
string
The document URL of the document view.
target_user
string
The targeted user (such as user put on hold).
Sample request
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/vault?eventName=download_per_matter_litigation_hold_report&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format
User downloaded per matter litigation hold report
Export
Event details
Event name
export
Parameters
additional_details
string
Additional details pertaining to an audit log.
matter_id
string
The Matter ID an audit pertains to.
organizational_unit_name
string
The organizational unit name.
query
string
The user inputted query for search and exports.
resource_name
string
The resource name of the action, such as hold name or saved query name.
resource_url
string
The document URL of the document view.
target_user
string
The targeted user (such as user put on hold).
Sample request
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/vault?eventName=export&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format
User performed an export
Export File Download
Event details
Event name
export_file_download
Parameters
additional_details
string
Additional details pertaining to an audit log.
matter_id
string
The Matter ID an audit pertains to.
organizational_unit_name
string
The organizational unit name.
query
string
The user inputted query for search and exports.
resource_name
string
The resource name of the action, such as hold name or saved query name.
resource_url
string
The document URL of the document view.
target_user
string
The targeted user (such as user put on hold).
Sample request
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/vault?eventName=export_file_download&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format
User downloaded an export file
Get Count Operation
Event details
Event name
get_count_operation
Parameters
additional_details
string
Additional details pertaining to an audit log.
matter_id
string
The Matter ID an audit pertains to.
organizational_unit_name
string
The organizational unit name.
query
string
The user inputted query for search and exports.
resource_name
string
The resource name of the action, such as hold name or saved query name.
resource_url
string
The document URL of the document view.
target_user
string
The targeted user (such as user put on hold).
Sample request
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/vault?eventName=get_count_operation&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format
User viewed search count
Legacy Export Download
Event details
Event name
legacy_export_download
Parameters
additional_details
string
Additional details pertaining to an audit log.
matter_id
string
The Matter ID an audit pertains to.
organizational_unit_name
string
The organizational unit name.
query
string
The user inputted query for search and exports.
resource_name
string
The resource name of the action, such as hold name or saved query name.
resource_url
string
The document URL of the document view.
target_user
string
The targeted user (such as user put on hold).
Sample request
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/vault?eventName=legacy_export_download&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format
User downloaded a legacy export
Modify Default Retention Period Begin
Event details
Event name
modify_default_retention_period_begin
Parameters
additional_details
string
Additional details pertaining to an audit log.
matter_id
string
The Matter ID an audit pertains to.
organizational_unit_name
string
The organizational unit name.
query
string
The user inputted query for search and exports.
resource_name
string
The resource name of the action, such as hold name or saved query name.
resource_url
string
The document URL of the document view.
target_user
string
The targeted user (such as user put on hold).
Sample request
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/vault?eventName=modify_default_retention_period_begin&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format
Default retention period modification began
Modify Default Retention Period End
Event details
Event name
modify_default_retention_period_end
Parameters
additional_details
string
Additional details pertaining to an audit log.
matter_id
string
The Matter ID an audit pertains to.
organizational_unit_name
string
The organizational unit name.
query
string
The user inputted query for search and exports.
resource_name
string
The resource name of the action, such as hold name or saved query name.
resource_url
string
The document URL of the document view.
target_user
string
The targeted user (such as user put on hold).
Sample request
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/vault?eventName=modify_default_retention_period_end&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format
Default retention period modification ended
Obsolete API Exports List
Event details
Event name
obsolete_api_exports_list
Parameters
additional_details
string
Additional details pertaining to an audit log.
matter_id
string
The Matter ID an audit pertains to.
organizational_unit_name
string
The organizational unit name.
query
string
The user inputted query for search and exports.
resource_name
string
The resource name of the action, such as hold name or saved query name.
resource_url
string
The document URL of the document view.
target_user
string
The targeted user (such as user put on hold).
Sample request
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/vault?eventName=obsolete_api_exports_list&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format
Exports listed through the API
Obsolete API Holds Insert
Event details
Event name
obsolete_api_holds_insert
Parameters
additional_details
string
Additional details pertaining to an audit log.
matter_id
string
The Matter ID an audit pertains to.
organizational_unit_name
string
The organizational unit name.
query
string
The user inputted query for search and exports.
resource_name
string
The resource name of the action, such as hold name or saved query name.
resource_url
string
The document URL of the document view.
target_user
string
The targeted user (such as user put on hold).
Sample request
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/vault?eventName=obsolete_api_holds_insert&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format
Holds inserted through the API
Obsolete API Holds List
Event details
Event name
obsolete_api_holds_list
Parameters
additional_details
string
Additional details pertaining to an audit log.
matter_id
string
The Matter ID an audit pertains to.
organizational_unit_name
string
The organizational unit name.
query
string
The user inputted query for search and exports.
resource_name
string
The resource name of the action, such as hold name or saved query name.
resource_url
string
The document URL of the document view.
target_user
string
The targeted user (such as user put on hold).
Sample request
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/vault?eventName=obsolete_api_holds_list&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format
Holds listed through the API
Obsolete API Matters Delete
Event details
Event name
obsolete_api_matters_delete
Parameters
additional_details
string
Additional details pertaining to an audit log.
matter_id
string
The Matter ID an audit pertains to.
organizational_unit_name
string
The organizational unit name.
query
string
The user inputted query for search and exports.
resource_name
string
The resource name of the action, such as hold name or saved query name.
resource_url
string
The document URL of the document view.
target_user
string
The targeted user (such as user put on hold).
Sample request
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/vault?eventName=obsolete_api_matters_delete&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format
Matters deleted through the API
Obsolete API Matters Get
Event details
Event name
obsolete_api_matters_get
Parameters
additional_details
string
Additional details pertaining to an audit log.
matter_id
string
The Matter ID an audit pertains to.
organizational_unit_name
string
The organizational unit name.
query
string
The user inputted query for search and exports.
resource_name
string
The resource name of the action, such as hold name or saved query name.
resource_url
string
The document URL of the document view.
target_user
string
The targeted user (such as user put on hold).
Sample request
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/vault?eventName=obsolete_api_matters_get&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format
Matter details retrieved through the API
Obsolete API Matters Insert
Event details
Event name
obsolete_api_matters_insert
Parameters
additional_details
string
Additional details pertaining to an audit log.
matter_id
string
The Matter ID an audit pertains to.
organizational_unit_name
string
The organizational unit name.
query
string
The user inputted query for search and exports.
resource_name
string
The resource name of the action, such as hold name or saved query name.
resource_url
string
The document URL of the document view.
target_user
string
The targeted user (such as user put on hold).
Sample request
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/vault?eventName=obsolete_api_matters_insert&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format
Matters inserted through the API
Obsolete API Matters List
Event details
Event name
obsolete_api_matters_list
Parameters
additional_details
string
Additional details pertaining to an audit log.
matter_id
string
The Matter ID an audit pertains to.
organizational_unit_name
string
The organizational unit name.
query
string
The user inputted query for search and exports.
resource_name
string
The resource name of the action, such as hold name or saved query name.
resource_url
string
The document URL of the document view.
target_user
string
The targeted user (such as user put on hold).
Sample request
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/vault?eventName=obsolete_api_matters_list&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format
Matters listed through the API
Obsolete API Matters Update
Event details
Event name
obsolete_api_matters_update
Parameters
additional_details
string
Additional details pertaining to an audit log.
matter_id
string
The Matter ID an audit pertains to.
organizational_unit_name
string
The organizational unit name.
query
string
The user inputted query for search and exports.
resource_name
string
The resource name of the action, such as hold name or saved query name.
resource_url
string
The document URL of the document view.
target_user
string
The targeted user (such as user put on hold).
Sample request
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/vault?eventName=obsolete_api_matters_update&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format
A matter updated through the API
Obsolete Preview Retention Rule Count
Event details
Event name
obsolete_preview_retention_rule_count
Parameters
additional_details
string
Additional details pertaining to an audit log.
matter_id
string
The Matter ID an audit pertains to.
organizational_unit_name
string
The organizational unit name.
query
string
The user inputted query for search and exports.
resource_name
string
The resource name of the action, such as hold name or saved query name.
resource_url
string
The document URL of the document view.
target_user
string
The targeted user (such as user put on hold).
Sample request
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/vault?eventName=obsolete_preview_retention_rule_count&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format
User previewed retention rule count
Preview Retention Rule
Event details
Event name
preview_retention_rule
Parameters
additional_details
string
Additional details pertaining to an audit log.
matter_id
string
The Matter ID an audit pertains to.
organizational_unit_name
string
The organizational unit name.
query
string
The user inputted query for search and exports.
resource_name
string
The resource name of the action, such as hold name or saved query name.
resource_url
string
The document URL of the document view.
target_user
string
The targeted user (such as user put on hold).
Sample request
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/vault?eventName=preview_retention_rule&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format
User previewed retention rule
Remove Collaborator Begin
Event details
Event name
remove_collaborator_begin
Parameters
additional_details
string
Additional details pertaining to an audit log.
matter_id
string
The Matter ID an audit pertains to.
organizational_unit_name
string
The organizational unit name.
query
string
The user inputted query for search and exports.
resource_name
string
The resource name of the action, such as hold name or saved query name.
resource_url
string
The document URL of the document view.
target_user
string
The targeted user (such as user put on hold).
Sample request
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/vault?eventName=remove_collaborator_begin&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format
Collaborator removal began
Remove Collaborator End
Event details
Event name
remove_collaborator_end
Parameters
additional_details
string
Additional details pertaining to an audit log.
matter_id
string
The Matter ID an audit pertains to.
organizational_unit_name
string
The organizational unit name.
query
string
The user inputted query for search and exports.
resource_name
string
The resource name of the action, such as hold name or saved query name.
resource_url
string
The document URL of the document view.
target_user
string
The targeted user (such as user put on hold).
Sample request
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/vault?eventName=remove_collaborator_end&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format
Collaborator removal ended
Remove Litigation Hold Begin
Event details
Event name
remove_litigation_hold_begin
Parameters
additional_details
string
Additional details pertaining to an audit log.
matter_id
string
The Matter ID an audit pertains to.
organizational_unit_name
string
The organizational unit name.
query
string
The user inputted query for search and exports.
resource_name
string
The resource name of the action, such as hold name or saved query name.
resource_url
string
The document URL of the document view.
target_user
string
The targeted user (such as user put on hold).
Sample request
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/vault?eventName=remove_litigation_hold_begin&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format
Litigation hold removal began
Remove Litigation Hold End
Event details
Event name
remove_litigation_hold_end
Parameters
additional_details
string
Additional details pertaining to an audit log.
matter_id
string
The Matter ID an audit pertains to.
organizational_unit_name
string
The organizational unit name.
query
string
The user inputted query for search and exports.
resource_name
string
The resource name of the action, such as hold name or saved query name.
resource_url
string
The document URL of the document view.
target_user
string
The targeted user (such as user put on hold).
Sample request
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/vault?eventName=remove_litigation_hold_end&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format
Litigation hold removal ended
Reopen Investigation Begin
Event details
Event name
reopen_investigation_begin
Parameters
additional_details
string
Additional details pertaining to an audit log.
matter_id
string
The Matter ID an audit pertains to.
organizational_unit_name
string
The organizational unit name.
query
string
The user inputted query for search and exports.
resource_name
string
The resource name of the action, such as hold name or saved query name.
resource_url
string
The document URL of the document view.
target_user
string
The targeted user (such as user put on hold).
Sample request
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/vault?eventName=reopen_investigation_begin&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format
Investigation reopening began
Reopen Investigation End
Event details
Event name
reopen_investigation_end
Parameters
additional_details
string
Additional details pertaining to an audit log.
matter_id
string
The Matter ID an audit pertains to.
organizational_unit_name
string
The organizational unit name.
query
string
The user inputted query for search and exports.
resource_name
string
The resource name of the action, such as hold name or saved query name.
resource_url
string
The document URL of the document view.
target_user
string
The targeted user (such as user put on hold).
Sample request
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/vault?eventName=reopen_investigation_end&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format
Investigation reopening ended
Restore Investigation Begin
Event details
Event name
restore_investigation_begin
Parameters
additional_details
string
Additional details pertaining to an audit log.
matter_id
string
The Matter ID an audit pertains to.
organizational_unit_name
string
The organizational unit name.
query
string
The user inputted query for search and exports.
resource_name
string
The resource name of the action, such as hold name or saved query name.
resource_url
string
The document URL of the document view.
target_user
string
The targeted user (such as user put on hold).
Sample request
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/vault?eventName=restore_investigation_begin&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format
Investigation restoration began
Restore Investigation End
Event details
Event name
restore_investigation_end
Parameters
additional_details
string
Additional details pertaining to an audit log.
matter_id
string
The Matter ID an audit pertains to.
organizational_unit_name
string
The organizational unit name.
query
string
The user inputted query for search and exports.
resource_name
string
The resource name of the action, such as hold name or saved query name.
resource_url
string
The document URL of the document view.
target_user
string
The targeted user (such as user put on hold).
Sample request
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/vault?eventName=restore_investigation_end&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format
Investigation restoration ended
Search
Event details
Event name
search
Parameters
additional_details
string
Additional details pertaining to an audit log.
matter_id
string
The Matter ID an audit pertains to.
organizational_unit_name
string
The organizational unit name.
query
string
The user inputted query for search and exports.
resource_name
string
The resource name of the action, such as hold name or saved query name.
resource_url
string
The document URL of the document view.
target_user
string
The targeted user (such as user put on hold).
Sample request
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/vault?eventName=search&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format
User performed a search
Search Count
Event details
Event name
search_count
Parameters
additional_details
string
Additional details pertaining to an audit log.
matter_id
string
The Matter ID an audit pertains to.
organizational_unit_name
string
The organizational unit name.
query
string
The user inputted query for search and exports.
resource_name
string
The resource name of the action, such as hold name or saved query name.
resource_url
string
The document URL of the document view.
target_user
string
The targeted user (such as user put on hold).
Sample request
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/vault?eventName=search_count&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format
User ran a count search
Update Investigation Details Begin
Event details
Event name
update_investigation_details_begin
Parameters
additional_details
string
Additional details pertaining to an audit log.
matter_id
string
The Matter ID an audit pertains to.
organizational_unit_name
string
The organizational unit name.
query
string
The user inputted query for search and exports.
resource_name
string
The resource name of the action, such as hold name or saved query name.
resource_url
string
The document URL of the document view.
target_user
string
The targeted user (such as user put on hold).
Sample request
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/vault?eventName=update_investigation_details_begin&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format
Investigation details update began
Update Investigation Details End
Event details
Event name
update_investigation_details_end
Parameters
additional_details
string
Additional details pertaining to an audit log.
matter_id
string
The Matter ID an audit pertains to.
organizational_unit_name
string
The organizational unit name.
query
string
The user inputted query for search and exports.
resource_name
string
The resource name of the action, such as hold name or saved query name.
resource_url
string
The document URL of the document view.
target_user
string
The targeted user (such as user put on hold).
Sample request
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/vault?eventName=update_investigation_details_end&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format
Investigation details update ended
Update Preservation Rule Add Holds Begin
Event details
Event name
update_preservation_rule_add_holds_begin
Parameters
additional_details
string
Additional details pertaining to an audit log.
matter_id
string
The Matter ID an audit pertains to.
organizational_unit_name
string
The organizational unit name.
query
string
The user inputted query for search and exports.
resource_name
string
The resource name of the action, such as hold name or saved query name.
resource_url
string
The document URL of the document view.
target_user
string
The targeted user (such as user put on hold).
Sample request
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/vault?eventName=update_preservation_rule_add_holds_begin&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format
Preservation rule addition update began
Update Preservation Rule Add Holds End
Event details
Event name
update_preservation_rule_add_holds_end
Parameters
additional_details
string
Additional details pertaining to an audit log.
matter_id
string
The Matter ID an audit pertains to.
organizational_unit_name
string
The organizational unit name.
query
string
The user inputted query for search and exports.
resource_name
string
The resource name of the action, such as hold name or saved query name.
resource_url
string
The document URL of the document view.
target_user
string
The targeted user (such as user put on hold).
Sample request
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/vault?eventName=update_preservation_rule_add_holds_end&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format
Preservation rule addition update ended
Update Preservation Rule Query Begin
Event details
Event name
update_preservation_rule_query_begin
Parameters
additional_details
string
Additional details pertaining to an audit log.
matter_id
string
The Matter ID an audit pertains to.
organizational_unit_name
string
The organizational unit name.
query
string
The user inputted query for search and exports.
resource_name
string
The resource name of the action, such as hold name or saved query name.
resource_url
string
The document URL of the document view.
target_user
string
The targeted user (such as user put on hold).
Sample request
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/vault?eventName=update_preservation_rule_query_begin&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format
Preservation rule query update began
Update Preservation Rule Query End
Event details
Event name
update_preservation_rule_query_end
Parameters
additional_details
string
Additional details pertaining to an audit log.
matter_id
string
The Matter ID an audit pertains to.
organizational_unit_name
string
The organizational unit name.
query
string
The user inputted query for search and exports.
resource_name
string
The resource name of the action, such as hold name or saved query name.
resource_url
string
The document URL of the document view.
target_user
string
The targeted user (such as user put on hold).
Sample request
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/vault?eventName=update_preservation_rule_query_end&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format
Preservation rule query update ended
Update Preservation Rule Remove Holds Begin
Event details
Event name
update_preservation_rule_remove_holds_begin
Parameters
additional_details
string
Additional details pertaining to an audit log.
matter_id
string
The Matter ID an audit pertains to.
organizational_unit_name
string
The organizational unit name.
query
string
The user inputted query for search and exports.
resource_name
string
The resource name of the action, such as hold name or saved query name.
resource_url
string
The document URL of the document view.
target_user
string
The targeted user (such as user put on hold).
Sample request
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/vault?eventName=update_preservation_rule_remove_holds_begin&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format
Preservation rule removal update began
Update Preservation Rule Remove Holds End
Event details
Event name
update_preservation_rule_remove_holds_end
Parameters
additional_details
string
Additional details pertaining to an audit log.
matter_id
string
The Matter ID an audit pertains to.
organizational_unit_name
string
The organizational unit name.
query
string
The user inputted query for search and exports.
resource_name
string
The resource name of the action, such as hold name or saved query name.
resource_url
string
The document URL of the document view.
target_user
string
The targeted user (such as user put on hold).
Sample request
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/vault?eventName=update_preservation_rule_remove_holds_end&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format
Preservation rule removal update ended
Update Retention Rule Begin
Event details
Event name
update_retention_rule_begin
Parameters
additional_details
string
Additional details pertaining to an audit log.
matter_id
string
The Matter ID an audit pertains to.
organizational_unit_name
string
The organizational unit name.
query
string
The user inputted query for search and exports.
resource_name
string
The resource name of the action, such as hold name or saved query name.
resource_url
string
The document URL of the document view.
target_user
string
The targeted user (such as user put on hold).
Sample request
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/vault?eventName=update_retention_rule_begin&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format
Retention rule update began
Update Retention Rule End
Event details
Event name
update_retention_rule_end
Parameters
additional_details
string
Additional details pertaining to an audit log.
matter_id
string
The Matter ID an audit pertains to.
organizational_unit_name
string
The organizational unit name.
query
string
The user inputted query for search and exports.
resource_name
string
The resource name of the action, such as hold name or saved query name.
resource_url
string
The document URL of the document view.
target_user
string
The targeted user (such as user put on hold).
Sample request
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/vault?eventName=update_retention_rule_end&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format
Retention rule update ended
Update Retention Settings
Event details
Event name
update_retention_settings
Parameters
additional_details
string
Additional details pertaining to an audit log.
matter_id
string
The Matter ID an audit pertains to.
organizational_unit_name
string
The organizational unit name.
query
string
The user inputted query for search and exports.
resource_name
string
The resource name of the action, such as hold name or saved query name.
resource_url
string
The document URL of the document view.
target_user
string
The targeted user (such as user put on hold).
Sample request
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/vault?eventName=update_retention_settings&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format
User updated retention settings
Update Saved Query Details Begin
Event details
Event name
update_saved_query_details_begin
Parameters
additional_details
string
Additional details pertaining to an audit log.
matter_id
string
The Matter ID an audit pertains to.
organizational_unit_name
string
The organizational unit name.
query
string
The user inputted query for search and exports.
resource_name
string
The resource name of the action, such as hold name or saved query name.
resource_url
string
The document URL of the document view.
target_user
string
The targeted user (such as user put on hold).
Sample request
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/vault?eventName=update_saved_query_details_begin&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format
Saved query details update began
Update Saved Query Details End
Event details
Event name
update_saved_query_details_end
Parameters
additional_details
string
Additional details pertaining to an audit log.
matter_id
string
The Matter ID an audit pertains to.
organizational_unit_name
string
The organizational unit name.
query
string
The user inputted query for search and exports.
resource_name
string
The resource name of the action, such as hold name or saved query name.
resource_url
string
The document URL of the document view.
target_user
string
The targeted user (such as user put on hold).
Sample request
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/vault?eventName=update_saved_query_details_end&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format
Saved query details update ended
View Cross Matter Litigation Hold Report
Event details
Event name
view_cross_matter_litigation_hold_report
Parameters
additional_details
string
Additional details pertaining to an audit log.
matter_id
string
The Matter ID an audit pertains to.
organizational_unit_name
string
The organizational unit name.
query
string
The user inputted query for search and exports.
resource_name
string
The resource name of the action, such as hold name or saved query name.
resource_url
string
The document URL of the document view.
target_user
string
The targeted user (such as user put on hold).
Sample request
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/vault?eventName=view_cross_matter_litigation_hold_report&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format
User viewed a cross matter litigation hold report
View Custodian Litigation Hold Report
Event details
Event name
view_custodian_litigation_hold_report
Parameters
additional_details
string
Additional details pertaining to an audit log.
matter_id
string
The Matter ID an audit pertains to.
organizational_unit_name
string
The organizational unit name.
query
string
The user inputted query for search and exports.
resource_name
string
The resource name of the action, such as hold name or saved query name.
resource_url
string
The document URL of the document view.
target_user
string
The targeted user (such as user put on hold).
Sample request
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/vault?eventName=view_custodian_litigation_hold_report&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format
User viewed a custodian litigation hold report
View Document
Event details
Event name
view_document
Parameters
additional_details
string
Additional details pertaining to an audit log.
matter_id
string
The Matter ID an audit pertains to.
organizational_unit_name
string
The organizational unit name.
query
string
The user inputted query for search and exports.
resource_name
string
The resource name of the action, such as hold name or saved query name.
resource_url
string
The document URL of the document view.
target_user
string
The targeted user (such as user put on hold).
Sample request
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/vault?eventName=view_document&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format
User viewed a document
View Document Information
Event details
Event name
view_document_information
Parameters
additional_details
string
Additional details pertaining to an audit log.
matter_id
string
The Matter ID an audit pertains to.
organizational_unit_name
string
The organizational unit name.
query
string
The user inputted query for search and exports.
resource_name
string
The resource name of the action, such as hold name or saved query name.
resource_url
string
The document URL of the document view.
target_user
string
The targeted user (such as user put on hold).
Sample request
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/vault?eventName=view_document_information&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format
User viewed a document’s information
View External Document
Event details
Event name
view_external_document
Parameters
additional_details
string
Additional details pertaining to an audit log.
matter_id
string
The Matter ID an audit pertains to.
organizational_unit_name
string
The organizational unit name.
query
string
The user inputted query for search and exports.
resource_name
string
The resource name of the action, such as hold name or saved query name.
resource_url
string
The document URL of the document view.
target_user
string
The targeted user (such as user put on hold).
Sample request
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/vault?eventName=view_external_document&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format
User viewed an external document
View Investigation
Event details
Event name
view_investigation
Parameters
additional_details
string
Additional details pertaining to an audit log.
matter_id
string
The Matter ID an audit pertains to.
organizational_unit_name
string
The organizational unit name.
query
string
The user inputted query for search and exports.
resource_name
string
The resource name of the action, such as hold name or saved query name.
resource_url
string
The document URL of the document view.
target_user
string
The targeted user (such as user put on hold).
Sample request
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/vault?eventName=view_investigation&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format
User viewed a matter
View Matter Audit Log
Event details
Event name
view_matter_audit_log
Parameters
additional_details
string
Additional details pertaining to an audit log.
matter_id
string
The Matter ID an audit pertains to.
organizational_unit_name
string
The organizational unit name.
query
string
The user inputted query for search and exports.
resource_name
string
The resource name of the action, such as hold name or saved query name.
resource_url
string
The document URL of the document view.
target_user
string
The targeted user (such as user put on hold).
Sample request
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/vault?eventName=view_matter_audit_log&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format
User viewed a matter’s log events
View Per Matter Litigation Hold Report
Event details
Event name
view_per_matter_litigation_hold_report
Parameters
additional_details
string
Additional details pertaining to an audit log.
matter_id
string
The Matter ID an audit pertains to.
organizational_unit_name
string
The organizational unit name.
query
string
The user inputted query for search and exports.
resource_name
string
The resource name of the action, such as hold name or saved query name.
resource_url
string
The document URL of the document view.
target_user
string
The targeted user (such as user put on hold).
Sample request
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/vault?eventName=view_per_matter_litigation_hold_report&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format
User viewed a matter litigation hold report
View Retention Policy
Event details
Event name
view_retention_policy
Parameters
additional_details
string
Additional details pertaining to an audit log.
matter_id
string
The Matter ID an audit pertains to.
organizational_unit_name
string
The organizational unit name.
query
string
The user inputted query for search and exports.
resource_name
string
The resource name of the action, such as hold name or saved query name.
resource_url
string
The document URL of the document view.
target_user
string
The targeted user (such as user put on hold).
Sample request
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/vault?eventName=view_retention_policy&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format
User viewed retention policy
View Retention Settings
Event details
Event name
view_retention_settings
Parameters
additional_details
string
Additional details pertaining to an audit log.
matter_id
string
The Matter ID an audit pertains to.
organizational_unit_name
string
The organizational unit name.
query
string
The user inputted query for search and exports.
resource_name
string
The resource name of the action, such as hold name or saved query name.
resource_url
string
The document URL of the document view.
target_user
string
The targeted user (such as user put on hold).
Sample request
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/vault?eventName=view_retention_settings&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format
User viewed retention settings
View System Audit Log
Event details
Event name
view_system_audit_log
Parameters
additional_details
string
Additional details pertaining to an audit log.
matter_id
string
The Matter ID an audit pertains to.
organizational_unit_name
string
The organizational unit name.
query
string
The user inputted query for search and exports.
resource_name
string
The resource name of the action, such as hold name or saved query name.
resource_url
string
The document URL of the document view.
target_user
string
The targeted user (such as user put on hold).
Sample request
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/vault?eventName=view_system_audit_log&maxResults=10&access_token=YOUR_ACCESS_TOKEN