Grouped by the API, not the URL
You name the integration when you opt it in, and the dashboard rolls up under that name — then down to host, path and the individual calls.
◢ Boring Observability · Laravel package
The other half of your traffic.
You have a dashboard for the requests coming in. Requizon is the one for the requests going out — every third-party API your application depends on, with duration, status, failure classification and the response body of anything that broke. In your own database.
Http::tracked('stripe')->post($url, $payload);
That is the whole integration. Everything else about the request stays the same.
● Waitlist — open now · ● Early access — September 2026
| API | Host | Total | Success | Avg | Failures | |
|---|---|---|---|---|---|---|
| stripe | api.stripe.com | 18,379 | 100% | 639 ms | 0 | Paths Requests |
| postmark | api.postmarkapp.com | 4,102 | 99.9% | 214 ms | 3 | Paths Requests |
| sedna | api.sedna.example | 812 | 91.4% | 1,240 ms | 70 | Paths Requests |
| nausys | ws.nausys.com | 3 | 100% | 362 ms | 0 | Paths Requests |
One call opts a client in. No middleware to wire, no code to restructure.
Its own routes, views and assets — shaped exactly like Horizon.
Detail rows and their hourly rollup, in your own MySQL database.
No agent, no third-party account, nothing leaving your servers.
Recording never breaks the call it observes. Anything that goes wrong inside the recorder is reported through your application's exception handler and then swallowed — instrumentation cannot take down the integration it is watching.
[ what it records ]
Every outbound integration is a dependency you do not control and cannot see. Requizon makes it legible — which API, which path, how slow, how often it fails, and what it said when it did.
You name the integration when you opt it in, and the dashboard rolls up under that name — then down to host, path and the individual calls.
A connection that never landed, an HTTP 4xx/5xx, and a 200 carrying an error are three different problems. Requizon labels each one instead of counting them all as "errors".
Plenty of APIs answer 200 with the failure in the body. Pass a one-line callback and those calls are recorded as application errors, with the message the API actually gave you.
Every failed call stores the response body next to it. You debug the payload the API really sent, at the timestamp it sent it — not a summary of it.
Parameters whose name looks like a secret are written as ***. A body Requizon cannot parse into named parameters is stored by shape only, because it cannot find the credentials inside it.
Calls are aggregated every five minutes into hourly buckets keyed by API, host and path, and the dashboard reads its window — 24 hours, 72, a week, a fortnight — straight off those. It costs the same at three thousand calls a day and at three million.
Detail rows are pruned after 14 days and aggregates after a year, on a schedule Requizon registers for you. The tables stay a fixed size instead of growing forever.
Access runs through a viewRequizon gate you define. Until you do, the dashboard answers only in the local environment — a forgotten install cannot expose your outbound traffic.
Requizon is a Laravel package writing to two tables in your own MySQL. No agent, no third-party account, and not one byte of your traffic leaves your infrastructure.
[ opt in, one client at a time ]
Http:: for
Http::tracked().
Requizon registers one macro. Name the API you are calling and that client's requests are recorded — the timeout, headers, retries and everything else about the call are untouched, because it is the same Laravel HTTP client underneath.
// Before — a call you cannot see.
Http::timeout(30)
->post($url, $payload);
// After — recorded under the API name "sedna".
Http::tracked('sedna')
->timeout(30)
->post($url, $payload);// The API answers 200 and puts the error in the payload.
Http::tracked('sedna', fn ($body) => $body['errorMessage'] ?? null)
->get($url);
// Recorded as:
// failure_type application_error
// failure_message "Charter not available for these dates"
// status_code 200[ the failures a status code hides ]
A depressing number of APIs answer 200 OK
with the real answer buried in the body. Pass a second argument and those calls are classified as
application_error, with the message
the API actually gave you — so a 100% success rate means what it says.
[ your data, on your terms ]
An outbound-traffic recorder sits exactly where your credentials are. Requizon is built on the assumption that you would rather it stored too little than too much.
Recorded
Redacted
"api_key": "***",
"_unparsed": "application/xml, 1482 bytes"
Redaction works by parameter name, so a body Requizon cannot parse into named parameters — XML, SOAP, text/plain — is one whose credentials it cannot find. It stores the shape and nothing else, unless you tell it otherwise.
Worth knowing
The response body of a failed call is stored as-is, with no redaction — that is the point of
it. An API that echoes your credentials back, or a 401 from a token endpoint, will put them in
http_requests for as long as your
detail retention allows. Keep that window short and treat the table as sensitive. We would rather
tell you this on the landing page than in an incident review.
Join the waitlist and pay $19/yr instead of $29.99 — for as long as your subscription stays active.
[ installed in three steps ]
Requizon is deliberately shaped like Horizon: its own routes, its own views and assets, and access controlled by a gate you define.
Point Composer at the private registry with your license key.
composer config --global \ --auth http-basic.requizon.composer.sh \ you@example.com YOUR-LICENSE-KEY
Pull in the package and create the two tables it reads and writes.
composer require boring-o11y/requizon php artisan migrate
Publish the provider, then narrow the gate to whoever should see the dashboard.
php artisan vendor:publish \ --tag=requizon-provider
class RequizonServiceProvider extends RequizonApplicationServiceProvider
{
protected function gate(): void
{
Gate::define('viewRequizon', fn ($user) => $user->hasRole('administrator'));
}
}
Until that gate exists, the dashboard answers only in the
local environment — a forgotten install does not
expose your outbound traffic in production.
[ pricing ]
Sign up before Requizon opens and keep the waitlist rate for as long as your subscription stays active — not for a first year, not until we change our minds.
Waitlist price
$29.99 / year once it opens — waitlist sign-ups keep $19.
No charge today — early access opens September 2026.
[ answers ]
Requizon is a Laravel package that gives you a dashboard for your application's outbound HTTP traffic. It records every call you opt into tracking — duration, status, failure classification, redacted request parameters, and the response body of anything that failed — rolls it up into hourly buckets, and serves a self-contained UI at /requizon. It is made by Boring Observability, who also make Laravel Skyline.
Requizon registers an Http::tracked() macro. Use it in place of Http:: on the clients you want recorded and pass a name for the API — for example Http::tracked('stripe')->post($url, $payload). Everything else about the request stays exactly the same. Recording rides on Guzzle's on_stats hook, which fires once per transfer, after the response is in hand, and also fires when the connection fails outright and there is no response at all.
No. Recording happens after the transfer completes, and every failure inside the recorder is reported through your application's exception handler and then swallowed — an instrumentation problem can never break the call it is observing. The write is a single insert; the aggregation that makes the dashboard fast runs out of band on the scheduler.
No. Requizon is a package running inside your application, writing to two tables in your own database, and serving its own dashboard from your own domain. There is no agent, no SaaS account and no egress. That is also what makes it usable on traffic you are contractually not allowed to ship to a third party.
Three things, recorded distinctly. A connection_error is a transfer that never produced a response at all — DNS, TLS, timeout. An http_error is any response with a status of 400 or above. An application_error is a successful HTTP response that your own callback classified as a failure, which is how you catch APIs that answer 200 OK with the error in the body.
It tries hard not to. Request parameters whose name contains pass, secret, token, apikey, api_key or auth, and those named exactly p, l or pwd, are stored as ***; both lists are configurable. A request body Requizon cannot parse into named parameters — XML, SOAP, text/plain — is recorded by shape only, because redaction works by parameter name. The one thing to know: the response body of a failed call is stored as-is, so a 401 from a token endpoint that echoes your credentials will land in the table. Keep detail retention short and treat the table as sensitive.
Telescope records everything in development and is not meant to be left on in production. An APM watches the requests coming in and needs an agent and data egress to do it. Requizon is narrow on purpose: the outbound calls you explicitly opted in, aggregated so it stays cheap at production volume, kept in your own database. Pair it with your APM — they tell you the request was slow, Requizon tells you which vendor made it slow.
PHP 8.2 or newer, Laravel 12 or 13, and MySQL 8.0.20+ (or a compatible MariaDB) — the hourly rollup uses INSERT ... ON DUPLICATE KEY UPDATE with row aliases, and the aggregate command fails with a clear message on any other driver.
By default, individual request rows for 14 days and hourly aggregates for a year. Both are pruned daily by a command Requizon schedules for you, and both retention windows are configurable. Re-aggregating a window is idempotent, so overlapping runs are safe.
Requizon is $29.99 per year, per application, sold as an annual subscription. Everyone on the waitlist gets it for $19 per year and keeps that price for as long as their subscription stays active. Nothing is charged today — the waitlist opens into early access in September 2026.
Whoever your viewRequizon gate says can. You publish a service provider, define the gate against your own roles or user check, and Requizon consults it on every dashboard request. Until that gate exists the dashboard is reachable only in the local environment.
[ waitlist ]
Requizon isn't public yet. Leave your email and we'll send your invitation and license key the moment it opens — at $19 a year rather than $29.99.
Waitlist
Open now
Locks in $19/yr, for as long as you stay subscribed.
Early access
September 2026
Invites roll out to the list first.
Have questions before you commit? Contact us →
Before you sign up
Requizon is $29.99 per year, per application, sold as an annual subscription. Everyone on the waitlist gets it for $19 per year and keeps that price for as long as their subscription stays active. Nothing is charged today — the waitlist opens into early access in September 2026.
No. Requizon is a package running inside your application, writing to two tables in your own database, and serving its own dashboard from your own domain. There is no agent, no SaaS account and no egress. That is also what makes it usable on traffic you are contractually not allowed to ship to a third party.
PHP 8.2 or newer, Laravel 12 or 13, and MySQL 8.0.20+ (or a compatible MariaDB) — the hourly rollup uses INSERT ... ON DUPLICATE KEY UPDATE with row aliases, and the aggregate command fails with a clear message on any other driver.
More in the full FAQ.