---
title: "Discussion on \"An audit log that says PUT /v2/object 200 won't help an investigation\" | Hashnode"
description: "Discussion on \"An audit log that says PUT /v2/object 200 won't help an investigation\". A request log can tell you that PUT /v2/object returned 200 at 14:03:07. It can't tell you who approved the refund, who changed a supplier's bank account, or whether the person clicking was an admin a"
url: "https://hashnode.com/posts/an-audit-log-that-says-put-v2-object-200-won-t-help-an-investigation/6af16611d290dfc0c283b6cf"
---

[Feed](https://hashnode.com/feed) /

Discussion

# [An audit log that says PUT /v2/object 200 won't help an investigation](https://edilec-engineering.hashnode.dev/an-audit-log-that-says-put-v2-object-200-won-t-help-an-investigation?utm_source=hashnode&utm_medium=feed)

A request log can tell you that PUT /v2/object returned 200 at 14:03:07. It can't tell you who approved the refund, who changed a supplier's bank account, or whether the person clicking was an admin a

1d ago · 4 min read · edilec-engineering.hashnode.dev  
Read the article

-   [#security](https://hashnode.com/tag/security)
-   [#logging](https://hashnode.com/tag/logging)
-   [#backend](https://hashnode.com/tag/backend)

## Written by

[Krishnam Murarka](https://hashnode.com/@krishnamm)

@krishnamm · Bangalore, India

  
[View profile](https://hashnode.com/@krishnamm)

## Responses 1

Markdown supported · ⌘↵ to post

[AI Developer](https://hashnode.com/@lycore)

[1d ago](https://hashnode.com/posts/an-audit-log-that-says-put-v2-object-200-won-t-help-an-investigation/6af16611d290dfc0c283b6cf/comment/6af17fc5890cdc82e2a70730)

Naming events after the business action instead of the route is a good rule, and the impersonation chain in the actor field is the one most schemas miss. A practical wrinkle is the fail-closed choice for high-risk changes: a transactional outbox, where the audit event is written in the same DB transaction as the change, gives you that guarantee without coupling the action to the log pipeline's availability. Do you also treat approvals as separate events linked by a correlation ID, so a later reviewer can see who approved versus who executed?