Requizon vs Laravel Spy

Laravel Spy is a free, MIT-licensed package that logs your application's outgoing HTTP requests to a database table. It needs a composer require and a migration, no configuration to start, and keeps everything: headers and bodies in both directions. It is the tool to reach for when you need to know exactly what was exchanged with an API. Requizon stores much less about each call on purpose, and this page explains what it does with the difference.

A full log of every call#

Laravel Spy registers global middleware on Laravel's HTTP client and binds a Guzzle client with the same middleware into the container. Before each request is sent it inserts a row into http_logs holding the URL, method, request headers and request body. When the response arrives it updates that row with the status, response headers, response body and duration. A call that throws is updated with status 0 and the exception message in place of the body.

Bodies are decoded where possible (JSON, XML and form data), binary content is base64-encoded unless you exclude its content type, and each value is cut at 10,000 characters. You can exclude URLs by substring. Nothing is aggregated: one call, one row, kept until spy:clean deletes it, 30 days by default once you schedule the command.

At a glance#

Check what the log is keeping#

Storing every header and body is Laravel Spy's purpose, so it is worth being deliberate about it. The default masking list is password and token, compared with field and header names. An Authorization header carrying a bearer token does not match either, and neither does X-Api-Key, so both are written to request_headers as sent. Response bodies are stored for every call, including the ones that return personal data. SPY_OBFUSCATES takes global and per-domain rules, and adding your auth headers to it is the first thing to do after installing.

Requizon starts from the opposite default. Headers are never recorded, request parameters whose names look like credentials are stored as ***, bodies it cannot parse are recorded by shape only, and a response body is kept only when the call failed.

When Laravel Spy is the right tool#

• You need an audit trail. A partner disputes what you sent them, or a webhook payload has to be reproducible. Spy keeps the request and response, up to its truncation limit, and Requizon does not.
• You are debugging an integration in staging and want the successful responses too.
• It is free, installs without a license, and runs on Laravel 10 and 11.
• You use PostgreSQL or SQLite. Requizon needs MySQL.
• You would rather write the SQL. Everything is in one table with JSON columns, which some teams prefer to any dashboard.

What Requizon does with the space#

By not keeping headers and successful bodies, Requizon can afford to record every transfer and keep a year of statistics about them. A scheduled command rolls calls into hourly buckets by API, host and path, and the dashboard reads those, so a fortnight's chart costs the same on a busy application as on a quiet one. Each level charts average response time with its slowest members, and responses stacked by status code or failure type.

Failures are classified rather than just coded. A transfer that never got a response is a connection_error with the cause, such as a timeout or a DNS failure. A 200 whose body your callback recognises as an error is an application_error. Spy's dashboard counts 5xx responses; Requizon shows those alongside the calls that failed without one.

Using both#

Both register global middleware on Laravel's HTTP client and pass requests through unchanged, so they run together. A sensible split is Laravel Spy for the integrations you have to be able to replay, with SPY_EXCLUDE_URLS keeping the rest out of its table, and Requizon for the health of every API.