Understand rate-limit records

This guide explains that checkout/API windows are tenant-scoped and expired rows are cleaned by cron. The guide then takes you through the correct route, the checks to complete before making changes, the workflow in order, and the evidence to review afterwards.

What you’ll accomplish

Know checkout/API windows are tenant-scoped and expired rows are cleaned by cron. This section explains report filters, exclusions, audit chaining and the module’s principal security controls.

Follow these steps

1. Go to Enterprise POS → Reports / Audit and open the workflow that matches “Understand rate-limit records”. Confirm the page or record context before making a change.
2. Go to Reports and choose a date range.
3. Run the summary and review sales, collected amounts, channel breakdown and top products.
4. Go to Audit and review recent tenant events.
5. Use correlation IDs to connect order, payment, stock, return and integration events.
6. Escalate anomalies without rewriting records.

Fields and options to review

• Guide focus: Know checkout/API windows are tenant-scoped and expired rows are cleaned by cron.
• From/to dates
• Location timezone
• Sales and collected totals
• Sales by channel
• Top 20 products
• Audit event type, object, actor, reason, summary, correlation and chain hash

Rules the system enforces

• Reports default to the current calendar month.
• Reversed from/to inputs are swapped.
• Cancelled, void, refunded and returned orders are excluded.
• Top products are limited to 20.
• Audit UI displays the most recent 200 events.
• Each audit event HMAC includes the previous event hash and tenant context.

How to confirm it worked

• The specific outcome described by this guide is visible and remains tenant-scoped.
• Report totals match eligible committed orders.
• Audit events form an ordered tenant chain.
• Correlated operations can be reviewed without database edits.

Safety checks and troubleshooting

• Treat reports as operational summaries, not a substitute for formal accounting.
• Do not alter audit rows.
• Protect settings keys, public tokens, API secrets and webhook secrets.

Continue with related guidance