Was this helpful?
Was this helpful?
In this Article
  • Created

Article Audit Log Not Capturing Bulk Edits

Summary: Bulk edit operations performed via the web application are not being recorded in the Audit Log, creating compliance gaps for organizations requiring complete change tracking.

Symptoms

The following bulk actions currently bypass audit trail capture:

  • Bulk status updates to work orders (e.g., marking 50+ jobs "Completed")
  • Bulk technician reassignment via Dispatch Board
  • Bulk customer tag additions or removals
  • Bulk inventory adjustments via CSV import

Individual record edits continue to log correctly. The omission is specific to batch operations.

Affected Versions

FieldPulse 3.2.0 – 3.2.4 (all platforms)

Cause

The bulk operation handler executes database writes through an optimized path that bypasses the audit logging middleware. A refactor of the bulk processing pipeline in 3.2 introduced this regression.

Resolution

No user-side fix is available. Audit completeness cannot be restored retroactively for bulk operations performed during the affected window.

Workaround

For compliance-critical environments, avoid bulk operations until resolved. Execute changes individually, or maintain external change documentation for bulk actions.

See related workaround: Manual Sync for Stale Mobile Data (process guidance)

Status

Fix targeted for 3.3.0. Engineering has implemented middleware interception for bulk handlers; currently in QA validation. Release anticipated mid-May 2026.

Last updated: April 28, 2026

  • in reply to Anita Sharma

    Yeah this one tripped me up too when I first looked at it — the API bulk endpoint uses the same handler under the hood, so it's also unlogged. Here's a quick check you can run:

    GET /audit-log?entity_type=work_order&action=bulk_update

    If you get zero results for bulk actions that definitely happened, you're in the gap. Individual PATCH calls to /work-orders/{id} are still logging fine, so if compliance is tight you could script individual updates instead. Slower, obviously, but logged.

    (Side note: the middleware fix in 3.3 will catch both web and API paths, so you do not need to change your integration pattern long-term.)

  • Has the scope of this issue been confirmed to exclude API-initiated bulk operations? We perform mass updates via the /work-orders/bulk-update endpoint and I need to determine if those calls are similarly affected.

  • Acknowledged. I have flagged this for our security communications team. An advisory will be published concurrent with the 3.3.0 release notes. No backfill is technically feasible; the workaround section will be expanded to include retention of external documentation during the gap window.

  • It is worth noting that this gap has significant implications for SOX-compliant organizations and those subject to NERC CIP standards. We have suspended bulk operations entirely until the 3.3.0 release.

    From a governance perspective, I would request that FieldPulse issue a formal security advisory when this is resolved, including confirmation of backfill capabilities or acknowledgment that the gap period cannot be remediated.