I’m looking at our GCP bill and there’s this API that someone activated, which generated a huge consumption, but no one on our team activated it. We’re suspecting that we could have been vulnerated.

I do see on the billing dashboard when was the API activated. Is there a way to trace who (which IP) did it?