How to Export Google Workspace Audit Logs

In the Google Admin console, Reporting → Audit and investigation holds the logs (Login, Admin, Drive, OAuth and more), and each can be exported from there. For JSON, use the Admin SDK Reports API, method activities.list. For a one-off, you don’t even need code: the API reference page has a “Try this method” panel that runs the call as you. Most Workspace audit data is kept for six months.

Workspace audit logs show who signed in from where, which third-party apps got access to mail and files, and which documents were suddenly shared with the outside world. Prime Core has {N} detection rules for Google Workspace data, mapped to {M} MITRE ATT&CK techniques. Among them: abuse of cloud accounts (T1078.004), malicious OAuth grants (T1528) and mail forwarding to outside addresses (T1114.003).

Get Started for Free

Before you start

Permissions. A super admin, or an admin role with the Reports privilege.

Pick the right log. In the API, each log is an applicationName: login, admin, drive, token (OAuth grants), user_accounts, saml, groups and others. Gmail message logs aren’t part of this API. For those, use Email Log Search in the Admin console, or the BigQuery export if your edition has it.

Retention and lag. Most audit logs go back about six months. New events can take from minutes to hours to show up, depending on the log.

A short Python script

For repeatable exports, a service account with domain-wide delegation impersonates an admin. It needs google-api-python-client and google-auth:

import json

from google.oauth2 import service_account

from googleapiclient.discovery import build


creds = service_account.Credentials.from_service_account_file(

    "sa.json",

    scopes=["https://www.googleapis.com/auth/admin.reports.audit.readonly"],

    subject="admin@example.com",

)

svc = build("admin", "reports_v1", credentials=creds)


with open("workspace_login_1019.jsonl", "w") as out:

    req = svc.activities().list(

        userKey="all", applicationName="login",

        startTime="2026-10-19T00:00:00Z", endTime="2026-10-20T00:00:00Z",

        maxResults=1000,

    )

    while req is not None:

        resp = req.execute()

        for item in resp.get("items", []):

            out.write(json.dumps(item) + "\n")

        req = svc.activities().list_next(req, resp)

Domain-wide delegation is powerful. Grant it only this read-only scope, keep the key file out of shared drives, and remove the delegation when you’re done. Run the script once per applicationName you need.

What to look for

Upload, sanitize and review in LogTotal

1. Upload. Open logtotal.com and drop in the .jsonl file.
2. Sanitize. 
3. Review. 

When it goes wrong