Audit & Error Logs

Pinion writes two kinds of diagnostic records. They’re distinct — one is an audit trail of pricing/line changes, the other is a technical error sink.

Audit trail — engine-write logging

AuditTrailSettings__c is a hierarchy custom setting with one field, LoggingMode__c. It governs how much of the line-item change history Pinion records:

  • By default, the audit trail captures manual edits.
  • Set LoggingMode__c = All to also log engine writes (the recompute / rule / bundle passes), read via AuditTrailSettingsService.

Line-item audit is a Pinion+ capability — the richer audit surface is gated, but the logging-mode switch is where you turn the depth up.

Error logging

ErrorLog__c is the package’s central error sink, written by ErrorLogUtility from across the services, controllers, and batch jobs. Each record captures the class, method, error message, line number, and the related record id — the trail you (or the engineering team) follow when something throws.

Parity-break audit trail

When the server-side recompute detects that a saved price, quantity, or discount does not match what the pricing kernel computes — a tamper or a parity break — it writes one ErrorLog__c row stamped with a structured Category=…ParityBreak prefix (for example Category=BasePriceParityBreak or Category=UsageTermParityBreak). These rows are the durable evidence that a save was rejected because its numbers were wrong.

Because the raw audit fields stay FLS-invisible (see the callout above), Pinion surfaces this trail through a controlled, read-only viewer instead of opening the object. The viewer reads the rows server-side in system mode and returns only a sanitized summary — the category, the originating class and method, the timestamp, and per-category counts. The raw ErrorMessage__c body is never returned.

Access is gated by the Pinion View Error Log custom permission:

  • Assign the Pinion Error Log Auditor permission set to any trusted admin who should triage tamper/parity rejects. It grants only the custom permission and the read-only viewer — no field access on ErrorLog__c itself.
  • The Pinion Administrator permission set already includes this permission, so full admins have the viewer out of the box.

A caller without the permission is refused before any read. The endpoint is read-only, at /services/apexrest/pinion/errorLogAudit/summary (per-category counts) and /services/apexrest/pinion/errorLogAudit/recent (the most recent sanitized entries).