Definition

The "List Activities" action allows administrators to retrieve a comprehensive list of activity events related to a specific customer's Google Workspace account and associated applications, such as Google Drive. By querying activity logs, administrators can track user actions, app usage, and other key events that have occurred within a designated time frame. This action helps monitor user behavior, audit usage, and ensure compliance with internal policies. It supports applying filters based on various criteria like user ID, application, event name, and time range.

Key Capabilities:

• Retrieve detailed activity logs for a customer’s Google Workspace account.
• Filter results by user, application, event name, date range, and other attributes.
• Track key data points like event ID, activity type, and user details (email, IP address, etc.).
• Useful for auditing, security monitoring, and compliance reporting.

Example Use Cases

1. Audit User Activity
   Track and analyze user actions within Google Workspace applications, such as Google Drive or Gmail, to ensure compliance with company policies and identify any suspicious behavior.

   Use Case: An administrator can query activity logs for a specific user to verify what files were accessed and whether any unauthorized actions were taken.

2. Monitor Application Usage
   Monitor the usage patterns of specific applications like Google Drive or Google Calendar, by retrieving activity logs for events tied to these services.

   Use Case: An admin can track which users are frequently accessing a particular application to understand its adoption rate across the organization.

3. Security Monitoring
   Detect unusual activity or potential security threats based on user actions, such as unauthorized access attempts or changes to sensitive files.

   Use Case: A security team could use this action to identify suspicious login times or unauthorized actions, such as file deletions or access from unusual IP addresses.

4. User Behavior Analytics
   Analyze user behavior over time to spot trends or inefficiencies, such as when and how users are interacting with specific tools or resources.

   Use Case: A manager can run periodic reports to monitor how often team members use collaboration tools like Google Drive and identify potential areas for training or improvement.

5. Event-Specific Investigations
   Investigate specific events or actions taken by users within a defined time period, based on event names or filters.

   Use Case: An admin could investigate all file-sharing activities in Google Drive over the past month to ensure they comply with organizational privacy guidelines.

Inputs

1. Connection
   This refers to the connection to the Google Directory API. It establishes authentication and allows the request to be executed. Select the relevant connection to ensure that the action can access your Google Directory account and fetch the requested activity data.

2. Id or Email of the User
   The unique identifier or email address of the user whose activities you want to retrieve. You can use either the user ID or their primary email address. Input the user's email or ID to filter the activities for that specific user.

3. Application Name
   The name of the application for which you want to retrieve activity logs. For example, you might choose "Google Drive," "Gmail," or any other application supported by Google Workspace. Specify the name of the application to narrow down the activities to just those related to that service.

4. Event Name
   The name of the specific event or action you are looking for within the application. Examples include "file shared," "file created," or "document deleted." Use this to filter the activities to include only the specified type of event within the chosen application.

5. Start Time
   The start date and time from which to begin retrieving activities. This is used to filter results based on when the activities occurred. Input the start time to specify the beginning of the time window you want to investigate.

6. End Time
   The end date and time up to which you want to retrieve activities. Set the end time to define the cutoff for the range of activities to retrieve.

7. Filters
   Additional filters to narrow down the activity logs based on specific criteria. For example, you could filter by user role, activity type, or IP address. Provide specific filters to refine the search results, ensuring you retrieve the exact data needed for your use case.

8. Customer ID
   The unique identifier for the customer account in Google Workspace. This is needed if you are managing multiple organizations or customers. Enter your customer ID to filter activities specific to that customer account.

9. OrgUnit ID
   The identifier for the organizational unit (OrgUnit) within Google Workspace. Organizational units are used to group users within an organization for easier management. Specify the OrgUnit ID if you want to retrieve activities for a specific organizational unit rather than an individual user.

10. Group ID Filter
    A filter to retrieve activities related to a specific group. This is useful if you are interested in seeing activities for users within a certain group, such as a team or department. Input the Group ID if you need to filter activities by a specific user group.

11. Max Results
    The maximum number of results you want to retrieve. The value must be between 1 and 10,000. This controls how many activity events the action will return. Set the maximum number of results to ensure that the action doesn’t return an overwhelming number of events. If you're only interested in a summary, keep this value low.

12. Next Page Token
    If there are more results than the maximum set in "Max Results," a next page token will be returned. Use this token to retrieve the next batch of results. If you’ve received a token from a previous call, input it here to continue retrieving additional activity events beyond the first page.

Outputs

1. Next Page Token:
   A token used to retrieve the next set of results if there are more than the maximum results returned in one request.

2. Number of Activities:
   Total count of activities retrieved based on the search query parameters.

3. Number of Events:
   Total count of individual events listed in the response that match the query.

4. Events:

   • Id: A unique identifier for the event, including the activity's timestamp, unique qualifier (event ID), application name (e.g., Google Drive), and customer ID.
   • Actor: Information about the user who triggered the activity, including caller type (e.g., admin, end-user), email, and profile ID.
   • IP Address: The IP address from which the event was performed.
   • Owner Domain: The domain of the user who owns the activity or resource.
   • Name: A descriptive name of the event (e.g., "File Shared" or "Document Created").
   • Type: The type of the event, such as a file action (e.g., created, deleted, shared).
   • Parameters: Additional key-value pairs providing further details about the event, such as specific file names or folder names involved in the activity.

Example of Using

Scenario:
A Google Workspace administrator wants to review the recent activity within the organization’s Google Drive for a specific user, "[email protected]," during the past week. They are particularly interested in events related to file sharing, such as files being shared externally or internally.

Step-by-Step:

1. Input Fields:

   • Connection: The admin selects the connection that has the appropriate permissions to access the Google Workspace account.
   • Id or Email of the User: The admin enters "[email protected]" as the user whose activities they want to track.
   • Application Name: The admin selects "Drive" to focus the search on Google Drive activities.
   • Event Name: The admin selects "share" to filter only file-sharing events.
   • Start Time and End Time: The admin specifies the date range to cover the last week, from "2025-03-25" to "2025-03-31."
   • Filters: Optional filters can be applied to refine the search further. For instance, they may filter for events involving a specific folder or document.
   • Max Results: The admin chooses to retrieve a maximum of 100 events to prevent overwhelming results.
   • Next Page Token: If more than 100 events are found, the next page token will be used for retrieving the subsequent batch.

2. Outputs:

   • The action returns a list of file-sharing activities during the specified period, such as who shared files, when they were shared, and with whom (external or internal users).
   • The events also show the file details, the name of the user who performed the action, and the IP address used.

Outcome:
The admin can now analyze the list of file-sharing activities within the selected date range. They might spot unusual file sharing (e.g., sharing sensitive documents with external users) and can take appropriate action if needed, such as adjusting sharing permissions or contacting the user for clarification.