Every sensitive action in NovaVMS writes an audit log entry. This page lists every action name you might see, grouped by area.
Auth actions
| Action | Actor | Target | Notes |
|---|
user.login | user | self | Successful login. |
user.login_failed | user | self | Wrong password or disabled account. |
user.lockout | system | user | Emitted when failed-login threshold triggers a lockout. |
user.logout | user | self | Explicit logout or session revoke. |
user.password_changed | user | self | User changed their own password. |
user.password_reset_requested | admin or owner | user | Admin initiated a reset for another user. |
user.password_reset_completed | user | self | User completed a reset link flow. |
User actions
| Action | Actor | Target | Notes |
|---|
user.created | admin or owner | user | Invite or direct create. |
user.updated | admin or owner | user | Profile, role, or site access edit. Role changes write a diff in changes. |
user.disabled | admin or owner | user | User cannot log in after this. Sessions revoked. |
Site actions
| Action | Actor | Target | Notes |
|---|
site.created | admin or owner | site | New site in the org. |
site.updated | admin or owner | site | Name, timezone, retention, or other settings changed. |
site.deleted | admin or owner | site | Soft-deleted. |
site.user_access_granted | admin or owner | user | Viewer granted read access to a site. |
site.user_access_revoked | admin or owner | user | Viewer lost access to a site. |
site.user_access_noop | admin or owner | user | No-op edit, logged for completeness. |
Camera and gateway actions
| Action | Actor | Target | Notes |
|---|
camera.created | operator or above | camera | Camera added via ONVIF discovery or manual config. |
camera.updated | operator or above | camera | Stream config, AI settings, or name change. |
camera.disabled | operator or above | camera | Camera toggled off without deletion. |
camera.deleted | operator or above | camera | Soft-deleted. Events preserved. |
gateway.updated | operator or above | gateway | Gateway renamed or reconfigured. |
gateway.disabled | operator or above | gateway | Gateway toggled off. |
gateway.enabled | operator or above | gateway | Gateway re-enabled. |
gateway.deleted | operator or above | gateway | Gateway unpaired and removed. |
Alert and integration actions
| Action | Actor | Target | Notes |
|---|
alert_rule.created | operator or above | alert_rule | New rule. |
alert_rule.updated | operator or above | alert_rule or alert_recipient | Rule edit or recipient list change. |
alert_rule.deleted | operator or above | alert_rule | Rule removed. |
webhook.created | operator or above | webhook | Webhook definition created. Secret visible only to admins and owners. |
webhook.updated | operator or above | webhook | Definition changed. Secret rotation logged separately. |
webhook.deleted | operator or above | webhook | Webhook removed. |
prompt_pack.created | operator or above | prompt_pack | AI prompt pack defined. |
prompt_pack.updated | operator or above | prompt_pack | Content or assignment changed. |
prompt_pack.deleted | operator or above | prompt_pack | Pack removed. |
Service account actions
| Action | Actor | Target | Notes |
|---|
service_account.created | admin or owner | service_account | New service account and key. Key material shown once. |
service_account.key_rotated | admin or owner | service_account | Old key invalidated immediately. |
service_account.site_access_updated | admin or owner | service_account | Site scope changed. |
service_account.disabled | admin or owner | service_account | All future API calls rejected. |
Owner-only actions
| Action | Actor | Target | Notes |
|---|
org.ownership_transfer_initiated | owner | user | Ownership transfer nominated. Target user has 7 days to accept. |
org.ownership_transferred | system | organization | Target accepted. Atomic promote + demote. |
org.ownership_transfer_rejected | user | organization | Target declined the nomination. |
org.ownership_transfer_expired | system | organization | 7-day window elapsed without acceptance. |
org.deletion_initiated | owner | organization | 7-day grace period starts. |
org.deletion_cancelled | owner | organization | Deletion aborted during grace period. |
org.impersonation_toggled | owner | organization | ”Allow NovaVMS Support Access” flipped. Revokes active sessions on disable. |
These entries appear in both the platform audit log and, where an org is targeted, the target org’s audit log with a “Platform Support” badge.
Only the actions in this table are emitted by code. Any platform.* action not listed here (for example platform.password_changed, platform.user_created, platform.feature_flag_enabled, platform.cross_org_search, platform.data_export_completed, platform.org_deletion_initiated, platform.org_deleted, platform.impersonation_blocked) is either deferred to a later phase or documented in operational pages without a corresponding emitter — treat those as forward-looking until the emitter ships.
| Action | Actor | Target | Notes |
|---|
platform.login | platform_admin | self | Platform console login. Emitted by cloud/internal/platform/auth_handler.go:92. |
platform.logout | platform_admin | self | Explicit logout. Cascade-revokes the caller’s active impersonation tokens. cloud/internal/platform/auth_handler.go:157. |
platform.org_created | platform_admin | organization | New customer org provisioned. Mirrors org.created_by_platform into the new org’s audit log. cloud/internal/platform/org_service.go:148. |
platform.org_disabled | platform_admin | organization | Org suspended without deletion. Revokes user sessions and cascade-revokes active impersonations. cloud/internal/platform/org_service.go:171. |
platform.org_enabled | platform_admin | organization | Org re-enabled. cloud/internal/platform/org_service.go:183. |
platform.org_delete_scheduled | platform_admin | organization | Flips status='pending_deletion'; the hard-delete sweeper has not yet shipped. cloud/internal/platform/org_service.go:221. |
platform.impersonation_started | platform_admin | organization | 30-minute scoped token minted. Reason is required (min 10 chars) and logged. Dual-write: same action also appears in the target org’s audit log via audit/dual_write.go. cloud/internal/platform/impersonation_handler.go:94,108. |
platform.impersonation_action | platform_admin | any | Emitted by middleware/impersonation.go:147-160 per impersonation-bearing API request; the row carries the request method, path, status, and impersonation_id. Not a session-summary — one row per request. |
platform.impersonation_ended | platform_admin or system | organization | Session closed via POST /api/v1/platform/end-impersonation, by cascade-revoke (org disabled / deletion scheduled / allow_platform_impersonation toggled off), or by 30-minute TTL expiry. cloud/internal/platform/impersonation_handler.go:174,187. |
Retention
90 days, per D11. Older entries are purged daily by the accounts retention job. Platform audit entries are kept 365 days.