# Requizon vs Laravel Spy

> Laravel Spy logs every call in full, headers and bodies included. Requizon records less about each call and a great deal more about each API.

Source: https://requizon.boring-observability.dev/vs/laravel-spy
Section: Comparisons — Requizon
Updated: 2026-09-16

---

**Bottom line:** If you need a record of exactly what was sent and received, call by call, Laravel Spy keeps it and costs nothing. It is a log: every header and body in a JSON column, a small dashboard of totals and top failing URLs, and queries you write for anything else. Requizon is built the other way round. It stores no headers and only the bodies of failures, and spends that budget on failure types, per-path statistics, response-time charts and a year of history. Pick by the question: "what did we send them" is Spy, "how has this API been behaving" is Requizon.

[Laravel Spy](https://github.com/farayaz/laravel-spy) is a free, MIT-licensed package that logs your application's outgoing HTTP requests to a database table. It needs a composer require and a migration, no configuration to start, and keeps everything: headers and bodies in both directions. It is the tool to reach for when you need to know exactly what was exchanged with an API. Requizon stores much less about each call on purpose, and this page explains what it does with the difference.

## A full log of every call

Laravel Spy registers global middleware on Laravel's HTTP client and binds a Guzzle client with the same middleware into the container. Before each request is sent it inserts a row into `http_logs` holding the URL, method, request headers and request body. When the response arrives it updates that row with the status, response headers, response body and duration. A call that throws is updated with status `0` and the exception message in place of the body.

Bodies are decoded where possible (JSON, XML and form data), binary content is base64-encoded unless you exclude its content type, and each value is cut at 10,000 characters. You can exclude URLs by substring. Nothing is aggregated: one call, one row, kept until `spy:clean` deletes it, 30 days by default once you schedule the command.

## At a glance

| For outgoing requests | Laravel Spy | Requizon |
| --- | --- | --- |
| Price | Free, MIT | A [one-time purchase](https://requizon.boring-observability.dev#pricing) per app |
| Request and response headers | Stored | Never stored |
| Request body | Stored, fields masked by name | [Parameters stored, credential-shaped names redacted](https://requizon.boring-observability.dev/docs/redaction) |
| Response body | Every call | Failed calls only |
| Default masking | `password` and `token` | Names containing `pass`, `secret`, `token`, `apikey`, `api_key` or `auth` |
| Writes per call | An insert before sending, an update after | One insert after the transfer |
| Failures | Status code, or `0` with the exception message | [Connection, HTTP and application errors](https://requizon.boring-observability.dev/docs/failure-detection), with the cause |
| Grouping | None; the dashboard groups 5xx counts by full URL | API, host and [normalised path](https://requizon.boring-observability.dev/docs/paths) |
| Dashboard | Optional: status totals, a request-count chart, top 10 failing URLs | Response time and outcomes per API, host and path, and the calls behind them |
| History | 30 days of rows, if you schedule `spy:clean` | [14 days of calls and 365 days of hourly statistics](https://requizon.boring-observability.dev/docs/retention), pruned automatically |
| Database | MySQL, PostgreSQL or SQLite | MySQL 8.0.20+ or a compatible MariaDB |
| Laravel versions | 10 to 13 | 12 and 13 |

## Check what the log is keeping

Storing every header and body is Laravel Spy's purpose, so it is worth being deliberate about it. The default masking list is `password` and `token`, compared with field and header names. An `Authorization` header carrying a bearer token does not match either, and neither does `X-Api-Key`, so both are written to `request_headers` as sent. Response bodies are stored for every call, including the ones that return personal data. `SPY_OBFUSCATES` takes global and per-domain rules, and adding your auth headers to it is the first thing to do after installing.

Requizon starts from the opposite default. Headers are never recorded, request parameters whose names look like credentials are stored as `***`, bodies it cannot parse are recorded by shape only, and a response body is kept only when the call failed.

## When Laravel Spy is the right tool

- **You need an audit trail.** A partner disputes what you sent them, or a webhook payload has to be reproducible. Spy keeps the request and response, up to its truncation limit, and Requizon does not.
- **You are debugging an integration in staging** and want the successful responses too.
- **It is free**, installs without a license, and runs on Laravel 10 and 11.
- **You use PostgreSQL or SQLite.** Requizon needs MySQL.
- **You would rather write the SQL.** Everything is in one table with JSON columns, which some teams prefer to any dashboard.

## What Requizon does with the space

By not keeping headers and successful bodies, Requizon can afford to record every transfer and keep a year of statistics about them. A scheduled command rolls calls into hourly buckets by API, host and path, and the dashboard reads those, so a fortnight's chart costs the same on a busy application as on a quiet one. Each level charts average response time with its slowest members, and responses stacked by status code or failure type.

Failures are classified rather than just coded. A transfer that never got a response is a `connection_error` with the cause, such as a timeout or a DNS failure. A `200` whose body your callback recognises as an error is an `application_error`. Spy's dashboard counts 5xx responses; Requizon shows those alongside the calls that failed without one.

## Using both

Both register global middleware on Laravel's HTTP client and pass requests through unchanged, so they run together. A sensible split is Laravel Spy for the integrations you have to be able to replay, with `SPY_EXCLUDE_URLS` keeping the rest out of its table, and Requizon for the health of every API.


## Common questions

### What does Laravel Spy log?

For each call through Laravel's HTTP client, and through Guzzle clients resolved from the container or built with its handler stack, Laravel Spy stores the URL, method, request headers, request body, status, response headers, response body and duration in an http_logs table. A call that throws is stored with status 0 and the exception message as its response body. Long values are truncated at 10,000 characters by default.

### Does Laravel Spy redact credentials?

It masks fields by name, and the default list is password and token, matched against body fields, query parameters and header names. An Authorization or X-Api-Key header is not on that list, so it is stored as sent until you add it with SPY_OBFUSCATES, which also accepts per-domain rules. Requizon never stores headers, and its default redaction list covers names containing pass, secret, token, apikey, api_key or auth.

### Does Laravel Spy have a dashboard?

An optional one, off by default. For the last 24 hours, 7 days or 30 days it shows totals of 2xx, 4xx and 5xx responses, a chart of request counts over time and the ten URLs with the most 5xx responses. Individual log rows are read from the database directly. Requizon's dashboard charts response time and outcomes per API, host and path, and lists individual calls with their failure bodies.

### How much does Laravel Spy write to the database?

Two writes per call: a row is inserted before the request is sent and updated with the response afterwards, both inside the request. Each row carries full headers and bodies, so the table grows with traffic and payload size, and its dashboard queries the raw rows. Requizon inserts one row per transfer without headers or successful bodies, and its charts read hourly rollups.

### Can I use Laravel Spy and Requizon together?

Yes. Both register global middleware on Laravel's HTTP client and pass the request through unchanged. A reasonable split is Spy for the full log of an integration you have to audit, with SPY_EXCLUDE_URLS keeping noisy or sensitive URLs out of it, and Requizon for the health of every API.