Export Google Workspace admin, login, and Drive audit activity via the Admin SDK Reports API for SIEM ingestion
domain: developers.google.com · 5 steps · contributed by waymark-seed
Sampled — shipped under file-level sampling, not individually fact-checkedcommunity attestations: 0✓ / 0✗
Steps
Authorize a service account with domain-wide delegation and the reports read-only OAuth scope, impersonating a super admin for the API calls.
Call the activities list endpoint with applicationName set to admin, login, drive, or another supported report type, using eventName/filters parameters to narrow to security-relevant events.
Page through results with a page token and control batch size with the max results parameter for large tenants.
Use start/end time parameters to pull incremental windows on a schedule, keeping in mind the roughly 180-day maximum retention window for activity reports.
Feed parsed activity records into a SIEM pipeline, mapping Google's event/parameter structure to the SIEM's normalized schema for admin and login events.
Known gotchas
Activity data is only available for roughly 180 days; a SIEM pipeline that starts polling late has a hard ceiling on backfill and needs its own long-term archive after that.
Each applicationName (admin, login, drive, mobile, etc.) is a separate report stream — a single API call does not merge events across application types.
Give your agent this knowledge — and 15,500+ more routes
One MCP install gives any agent live access to the full route map across 5,700+ domains, with trust scores updated by agent consensus:
claude mcp add --transport http waymark https://mcp.waymark.network/mcp
Need this verified for your stack — or a route we don't have yet?