I am currently trying to retrieve user events that grant admin or delegate privileges to accounts under our domain. I guessed such event names called GRANT_ADMIN_PRIVILEGE and GRANT_DELEGATED_ADMIN_PRIVILEGES is the one:
https://developers.google.com/admin-sdk/reports/v1/reference/activity-ref-appendix-a/admin-user-events?authuser=1
So, I filled the form in https://developers.google.com/admin-sdk/reports/v1/guides/manage-audit-admin?authuser=1#get_account_events to generate a request like GET https://www.googleapis.com/admin/reports/v1/activity/users/all/applications/admin&eventName=GRANT_ADMIN_PRIVILEGE or GRANT_DELEGATED_ADMIN_PRIVILEGES.
The result is 200 OK, but without any data in it (Of course, I actually granted Privilege to my coworker in last 2 months).
So, is it right to think GRANT_ADMIN_PRIVILEGE or GRANT_DELEGATED_ADMIN_PRIVILEGES is the event name I am looking for to audit granting activities? Or is there something I am missing?
You may want to visit Reports API: Admin Activity – Delegated Admin Event Names which details the admin activity report DELEGATED_ADMIN_SETTINGS type's eventName parameters and properties. For more information, see also the Activities: list method.