Activity Auditing events

Help Center

AI Assistant

Help Center AI Assistant is now available

Got questions about Lark? Use our AI chat to find the answers.

Click and hold to drag

Got It

Try Now

Activity Auditing events

8 min read

I. Intro

As an administrator, you can look up member activities of using Lark Docs, Messenger, Meetings, Calendar, Mails, Account Activity, Contacts, Workplace, Moments, Approval, and other features.

Note: This article is only for your reference. If you encounter issues that you can't solve after checking the event description, please contact Support.

II. About search activities

The following tables introduce the actions that members perform and the administrators can query for.

Docs

Event	Trigger
set_doc_sec_label	Set a document's security level.
space_add_comment	Added comments to a document.
space_add_reply	Replied to a comment.
space_copy_content	Copied the content in a file. It mainly applies to Lark documents; copying content from other files such as XLSX and PPT may not be recorded accurately.
space_create_copy	Created a copy of a file or folder.
space_create_doc	Created a new document or folder in My Space or Shared Space.
space_create_spacecopy	Created a copy of a wiki space.
space_delete_doc	Deleted a file or folder.
space_delete_doccurrent	Deleted a document, which doesn't affect sub-files or sub-folders.
space_delete_reply	Deleted a comment from a Lark document.
space_demoslides	Clicked Present in Slides.
space_download_file	A file or folder in My Space or Shared Space is downloaded to the local drive.
space_download_history	Downloaded a history version of a file from My Space or Shared Space. Generally, you can only download the history version of files uploaded to My Space or Shared Space.
space_edit_doc	A record is created when a document is edited, and actions repeated within 5 minutes are aggregated.
space_edit_reply	A comment within a document is edited.
space_edit_space_member	Members are added to or deleted from a wiki space.
space_edit_space_member_auth	You can't edit the permissions of individual wiki space members and can only batch change these to Can read or Can edit. Therefore, this event will not record whose permissions were edited.
space_edit_space_owner	Wiki space administrator is added or deleted.
space_export_doc	A Lark document is exported.
space_finish_comment	A comment in a document is resolved.
space_front_export_csv	Download As > Excel or Image is tapped in a sheet on the mobile app.
space_front_export_image	Download As > Image is tapped in a sheet on the mobile app.
space_import_doc	File or folder uploaded to My Space or Shared Space or a document.
space_modfiy_security_setting	Wiki configuration recorded.
space_move	File, folder, or Wiki moved.
space_move_owner	Document owner transfers the document ownership, or the document ownership is transferred by the administrator or as a result of offboarding.
space_open_with_3rdApp	File tapped and shared to a third-party app. This only applies to the mobile app. The third-party app used to open the file cannot be recorded.
space_print_doc	Print in a document clicked.
space_read_doc	A record is created when a document is accessed, and actions repeated within 5 minutes are aggregated and reported.
space_recover_history	A previous version is restored.
space_reopen_comment	A comment in a document is reopened.
space_save_module	Document saved to My Templates.
space_share	A record is created as soon as Share is clicked, but this only records whether or not the means and content of sharing are successfully obtained, not necessarily that the content is shared with others.
space_share_to_3rdApp	File tapped and shared to a third-party app. This only applies to the mobile app. The third-party app used to open the file cannot be recorded.
space_update_collaborator_auth	Collaborator permissions changed. For example, Can edit changed to Can read.
space_update_collaborator_doc	Collaborators added to or removed from a document.
space_update_share_setting_doc	Clicking Share and editing permission settings will both trigger this event. For example, editing who can add collaborators, whether anyone with the link can read, and so on.
space_update_spaceshare_status	Wiki link sharing status changed.
space_view_history	Previous file version viewed in the My Space or Shard Space.
turn_down_doc_sec_label	A member decreases the security level of a secure label.
turn_up_doc_sec_label	A member increases the security level of a secure label.
space_authapprove	Immediately reports and logs when permissions are requested for a document, regardless of the outcome.
space_set_retlabel	Once a data retention strategy has been set in the Lark Admin Console, set the retention label for the applicable documents.
space_edit_retlabel	Once a data retention strategy has been set in the Lark Admin Console, change the retention label for the applicable documents.
space_delete_retlabel	Once a data retention strategy has been set in the Lark Admin Console, remove the retention label for the applicable documents.

Messenger

Event	Trigger
im_add_chatadmin	Group owner or group administrator added one or more group administrators.
im_addtochat	Group owner or group administrator added one or more group members.
im_admin_no_restrict_ctrl	Changed who can be exempted from restrictions in group management.
im_chat_editimage	Clicked the Edit icon of an image in the chat.
im_chat_previewfile	Online preview of local files in a chat, including images and videos but excluding documents.
im_chat_uploadfile	Uploaded local files to a chat, including private chats or group chats.
im_chat_withdraw	Withdrew an image, video, message, or file in a chat. This includes both group administrators withdrawing messages from other people, and individuals withdrawing messages they have sent.
im_copy_image	Copied any content from a chat, including images, videos, messages, or files.
im_create_chat	Created a group chat.
im_delete_chat	Dissolved a group chat.
im_delete_chatadmin	Group owner or group administrator deleted one or more group administrators.
im_deletefromchat	Group owner or group administrator deleted one or more group members.
im_download	Downloaded a file or folder in a private chat or group chat. Downloading a folder will be recorded as downloading multiple files, and the names of downloaded folders cannot be recorded.
im_download_file	Downloaded a file from a private or group chat.
im_download_image	Downloaded an image in a private chat or group chat.
im_download_video	Downloaded a video in a private chat or group chat.
im_forward_chatadmin	Group owner transferred the group ownership to another member.
im_forward_file	Forwarded an image, video, message, or file to another person in a chat (including group chats and apps). When forwarding to multiple people, multiple records will be generated.
im_join_chat	Joined a group chat.
im_load_file_to_local	Created a local cache of a file on the server.
im_ocr	Image to text clicked.
im_open_link	Clicked any URL in a chat. Multiple URLs that are recorded (including document links) or sent are separated by commas.
im_open_with_3rdApp	File in a chat tapped and shared to a third-party app. This only applies to the mobile app. The third-party app that was used to open the file cannot be recorded.
im_quit_chat	Left a chat group. When a member is deleted, they will be removed from all internal groups. At this time, it will be recorded as the member leaving multiple groups.
im_read_doc	Previewed a file from a private or group chat.
im_savetospace	Clicked the Save to My Space icon on a file in a chat.
im_screencap	Record Screen is clicked in a private or group chat.
im_send_link	Sent any URL in a chat. Multiple URLs that are recorded (including document links) or sent are separated by commas.
im_snaphot	Screenshot is clicked in a private or group chat.
im_start_external_chat	Started a chat conversation with someone from a different organization for the first time.
im_chat_avatar_type	Changed group photo.
im_chat_linked_page_create	Linked a page to a group chat.
im_chat_linked_page_delete	Removed link between page and group chat.
im_chat_pin_show_pin_list	Expanded the pin list.
im_chat_pin_show_in_chat	Viewed the pinned content.
im_chat_pin_stick	Prioritized a pinned message.
im_chat_pin_update_permission	Changed pin permissions.
im_chat_pin_update	Changed the title of a pinned link.
im_chat_pin_sidebar_search	Clicked Search in chat in the toolbar.
im_chat_pin_click_open_browser	Clicked Open in Browser for a pinned link.
im_chat_pin_sidebar_file	Clicked Local File in the toolbar.
im_chat_pin_unstick	Unpinned the content at the top.
im_chat_pin_hover_show	Hovered over pinned content on the desktop app.
im_chat_pin_reorder	Draged and rearranged pinned tabs.
im_chat_pin_create	Pinned certain content.
im_chat_pin_click_copy_url	Clicked Copy Message Link for a pinned link.
im_chat_pin_sidebar_add_link	Clicked Add Pin Link in the toolbar.
im_chat_pin_click_back_to_chat	Clicked View in chat for pinned content.
im_export_chat_chatter	Exported the profile data of group members.
im_chat_pin_sidebar_announce	Clicked Add Group Announcement in the toolbar.
im_chat_pin_click_open_url	Clicked the pinned link and opened the link.
im_chat_pin_delete	Removed a pin.

Audio and video calls

Event	Trigger
vc_download_minutes	Downloaded Minutes file to the local drive.
vc_changerange	Clicked Security during a video meeting and edited join permissions.
vc_create_video_meeting	Started an audio or video meeting.
vc_finish_video_meeting	Clicked End Meeting to end an audio or video meeting.
vc_invite_video_meeting	Invited another user to join a video meeting.
vc_join_video_meeting	Joined an audio or video meeting through an event or a shared link.
vc_quit_video_meeting	Left an audio or video meeting.
vc_share_video_meeting	Clicked the Share to chat icon during an audio or video meeting to share the meeting.
vc_sharescreen_video_meeting	Clicked Share during a video meeting to share the screen, apps, documents, and whiteboards, and more.
vc_createclip	Created a Minutes clip.
vc_deleteclip	Deleted a Minutes clip.
vc_deletemeta	Deleted a Minutes file.
vc_deletemetafromtrash	Permanently deleted a Minutes file.
vc_drivebatchtranscribe	Generated a Minutes file by importing from Lark Docs.
vc_exportmeta	Exported a Minutes file.
vc_revertmeta	Restored a Minutes file.
vc_setaudiostatus	Generated Minutes file through a recording file on the mobile app.
vc_share_to_room_video_meeting	Shared screen to a meeting room.
vc_sharebychat	Shared Minutes in a chat.
vc_sharebylink	Edited Minutes permissions through links.
vc_shareclipbychat	Shared a Minutes clip in chat.
vc_sharecollaborator	Added, changed, or deleted collaborators.
vc_uploadbymeeting	Generated a Minutes file by recording a meeting.
vc_uploadmeta	Generated a Minutes file by uploading a local file.
vc_viewclip	Accessed a Minutes clip.
vc_viewmeta	Accessed a Minutes file.
vc_start_transcript	Started meeting transcription.
vc_stop_transcript	Stopped meeting transcription.
vc_request_transcript	Requested meeting transcription.
vc_access_transcript	Approved a meeting transcription request.
vc_refuse_transcript	Declined a meeting transcription request.
vc_access_local_record	Approved a local recording request for a meeting.
vc_refuse_local_record	Declined a local recording request for a meeting.
vc_refuse_record	Declined a meeting recording request.
vc_access_record	Approved a meeting recording request.
vc_stop_record	Ended recording of a meeting.
vc_request_record	Requested meeting recording.
vc_start_local_record	Started local recording of a meeting.
vc_stop_local_record	Ended local recording of a meeting.
vc_request_local_record	Requested local recording of a meeting.
vc_manage_stop_local_record	Stopped participants from recording meeting locally.
vc_start_record	Started meeting recording.
vc_start_screen_control	Enabled remote control.
vc_finish_screen_control	Disabled remote control.

Calendar

Event	Trigger
cal_create_event	Created an event.
cal_add_attachment	Added an event attachment.
cal_remove_attachment	Removed an event attachment.
cal_delete_event	Deleted an event.
cal_add_remove_participants	Added or removed an event guest.
cal_add_remove_meeting_room	Added or removed a meeting room.
cal_mod_event_permission	Changed event guest permissions.
cal_create_meeting_group	Created a meeting group.
cal_transfer_event	Transferred an event.
cal_share_event	Shared an event in a chat.
cal_join_event	Joined an event.
calendar_create_scheduler	Created a scheduled event.
calendar_edit_scheduler	Edited a scheduled event.
calendar_del_scheduler	Deleted a scheduled event.
cal_delete_calendar	Created a calendar.
cal_create_calendar	Deleted a calendar.
cal_change_def_cal_permissions	Changed default calendar permissions.
cal_add_remove_calendar_sharee	Added or deleted a calendar subscriber.
cal_modify_sharee_permissions	Changed the permissions of a calendar subscriber.
cal_add_3party_account	Added a third-party calendar account.
cal_subscribe_calendar	Subscribed to a calendar.
cal_unsubscribe_calendar	Cancelled calendar subscription.
cal_share_calendar_to_session	Shared a calendar in a chat.
cal_remove_3party_account	Removed a third-party calendar account.
cal_edit_event	Modified an event.
cal_switch_calendar	Switched the calendar that the event belongs to.
cal_create_meetingnote	Created meeting notes.
cal_del_meetingnote	Deleted meeting notes.
cal_bind_meetingnote	Linked meeting notes.
cal_convert_group	Converted a meeting group to a common group.
cal_event_rsvp	Replied to event participation status.
cal_edit_calendar	Edited calendar information.
cal_export_calendar	Exported a calendar.

Mail

Event	Trigger
email_copy	Copied email body content.
email_delete	Clicked an email in Trash and then Delete Permanently.
email_downloadfile	Clicked and downloaded attachments or images from an email.
email_downloadmail	Clicked ··· in the upper-right corner of an email > Download.
email_editforward	Enabled auto-forwarding in the email settings.
email_foawardasatt	Clicked Forward as Attachment for an email.
email_localopen	Opened an attachment with a local app.
email_login	Logged in to a public mailbox.
email_loginthird	Logged in on a third-party email app.
email_move	Clicked the Move to icon and moved an email.
email_print	Clicked Print.
email_read	Read an email.
email_reply	Clicked Reply or Forward.
email_send	Clicked Send after editing an email.
email_sharefile	Shared email attachment or image in a private or group chat.
email_sharemail	Clicked Share to Chat to share an email in a private or group chat.
email_urlclick	Clicked a link in the body of an email.
email_batchexport	Batch exported emails.

Account activity

Event	Trigger
account_login	Logged in to a Lark account.
account_passport_changeaccount	Switched the account under the current organization to another organization or a personal account.
account_passport_logout	Logged out of a Lark account.
account_passport_renew_logoncre	Updated login credentials.
account_passport_renew_password	Updated login password.
user_active_exit_team	Normally only triggered when a member leaves an organization.
account_passport_update_otp	Updated OTP (one-time-password) settings.
account_passport_update_2fa	Updated two-step verification settings.
account_passport_updatesparecre	Updated backup verification method settings.
account_passport_revoke_appauth	Revoked app authentication.
account_passport_renew_fidocre	Updated passkey settings.

Contacts

Event	Trigger
contact_add_external_friend	Added an external contact.
contact_obtain_mobile	View one's phone number.
contact_view_department_struct	Generally triggered when Contacts is clicked to show the organization structure. However, due to technical reasons, when organization members switch accounts, a large number of these events will be recorded. These records can be ignored.
contact_view_personal_info	This event is recorded when the profile photo is clicked. Sometimes two events may be recorded because the direct manager's profile page might get preloaded.
contact_personal_avatar_update	Changed profile photo.
view_mail_user	Viewed the information of an email contact.
addmailuser	Added an email contact.
deletemailuser	Deleted an email contact.
modifymailuser	Edited the information of an email contact.
copy_phone_number	Copied one's phone number or extension number.
call_phone_number	Called one's telephone or extension number.
add_phone_number_to_contacts	Added one's phone number or extension number to Contacts.

Workplace

Event	Trigger
workplace_app_download_doc	Downloaded files from Workplace apps.
workplace_app_open_with_3rdApp	Used a third-party app to open a file in a Workplace app.
workplace_open_app	Opened app in Workplace.

Moments

Event	Trigger
moments_copy_comment	Copied a comment in Moments.
moments_copy_image	Copied an image in Moments.
moments_copy_link	Copied a post link in Moments.
moments_copy_post	Copied a post in Moments.
moments_create_comment	Posted a comment in Moments.
moments_create_official	Created an official account.
moments_create_post	Created a post in Moments.
moments_create_reaction	Replied to a post in Moments with an emoji.
moments_delete_comment	Deleted a comment.
moments_delete_post	Deleted a post.
moments_delete_reaction	Canceled an emoji reaction in Moments.
moments_download_image	Downloaded an image in Moments.
moments_edit_official	Edited official account.
moments_enter_post_detail	Clicked and viewed post details in Moments.
moments_forward_post	Forwarded a post in Moments.
moments_login_official	Logged in to official account.
moments_preview_image	Previewed an image in Moments.
moments_preview_video	Previewed a video in Moments.
moments_view_feed_post	Browsed posts in Moments.
moments_viewmoment	Viewed Moments. Note: This event was disabled on October 8, 2023. For logs after this date, see the "Browse moments" event instead.

Approvals

Event	Trigger
officeapprove_operate_clear	Deleted an approval.
officeapprove_add_submanager	Added a sub-administrator in the Lark Admin Console.
officeapprove_process_intervene	Intervened an approval process.
officeapprove_hand_over	Handed over an approval.
officeapprove_operate_save	Clicked Save.
officeapprove_bitable_add_data	Added approval data.
officeapprove_admin_export_data	Exported data from the Lark Admin Console.
officeapprove_create_approval_group	Created a new approval process group.
officeapprove_enable_approval	Enabled an approval process.
officeapprove_update_approval_group	Updated an approval process group.
officeapprove_update_approval	Edited an approval process.
officeapprove_delete_approval	Deleted an approval process.
officeapprove_delete_approval_group	Deleted an approval process group.
officeapprove_disable_approval	Disabled an approval process.
officeapprove_export_data	Exported approval data.
officeapprove_create_approval	Created a new approval process.
officeapprove_export_efficiency_task_detail	Exported task details.
officeapprove_process_diagnosis	Viewed process diagnostics.
officeapprove_export_efficiency_process_detail	Exported process details.
officeapprove_efficiency	Viewed individual efficiency.
officeapprove_share_approval	Shared process submission portal.
officeapprove_operate_submit_again	Resubmitted an approval.
officeapprove_operate_recall	Recalled an approval.
officeapprove_operate_upload_attachment	Uploaded an attachment.
officeapprove_operate_upload_image	Uploaded an image.
officeapprove_operate_share	Shared an approval.
officeapprove_operate_urgent	Sent a reminder.
officeapprove_operate_discuss	Started a discussion.
officeapprove_operate_addsign	Added an approver.
officeapprove_operate_rollback	Returned an approval.
officeapprove_operate_removesign	Removed an approver.
officeapprove_operate_comment	Added a comment.
officeapprove_operate_cc	CCed someone.
officeapprove_operate_reject	Rejected an approval.
officeapprove_operate_forward	Transferred an approval.
officeapprove_operate_approve	Approved an approval.
officeapprove_modify_instance	Edited an approval form.
officeapprove_create_instance	Started an approval form.
officeapprove_detail_instance	Viewed an approval form.

URL

Event	Trigger
links_access_external	Clicked a URL in Lark Docs, Messenger, Mails, and other functions.
im_extract_url	Inserted a third-party URL in Lark functions. The service received a request to extract URL information to create a preview, but the link is not on the allowlist for auditing exemption.