Download the PHP package oluokunkabiru/api-call-logger without Composer

API Call Logger

Provider-agnostic Laravel logger for third-party API calls and incoming webhooks. Every call is stored with its request, response, headers, status, latency and outcome, with credentials and PII redacted before they touch the database. It also gives you retries, pruning and a built-in dashboard.

It replaces the hand-rolled ThirdPartyApiLogger service you would otherwise copy into every project.

• Zero-boilerplate Http client logging: Http::withApiLogging('vtpass', 'buy-airtime')->post(...)
• Automatic capture (optional) of every Http:: call, mapped to providers by host
• Inbound webhook logging middleware, provider read from the URL
• Manual logging for SOAP, cURL and SDK calls: ApiCallLogger::log(...) / ApiCallLogger::measure(...)
• Deep redaction: credentials always, PII toggleable, matched case- and separator-insensitively
• Value-pattern masking: card numbers (Luhn-checked), JWTs, Bearer/Basic credentials, emails, phones and IDs in URL paths
• Encryption at rest for payload columns, with APP_KEY or a dedicated key
• Tenant, user, related model, correlation id and meta stored on every record
• Correlation across queued jobs (Laravel Context), adoptable from X-Request-Id or W3C traceparent
• Retry attempt numbers for Http::retry() and idempotency keys stored, reused and optionally generated
• Rule-based retry you configure: blockers, confirmations, limits and a lock against double replays
• Data-subject erasure (api-call-logger:forget), queueing, pruning and an ApiCallLogged event
• Dashboard at /api-call-logs with filters, a 24h overview, request/response viewer and a Retry button
• Never breaks your call: logging failures are swallowed and reported to the app log

Requirements

• PHP 8.2+
• Laravel 12 or 13

Laravel 10 and 11 are end-of-life. Composer now blocks every release of them because of unpatched security advisories, so they are not supported.

Installation

The service provider and ApiCallLogger facade are auto-discovered. Optionally publish the config:

Environment variables

Every option can be set from .env without publishing the config. See .env.example for the full list with defaults. The most common ones:

Every feature that changes what is stored or sent has its own switch, so each application decides. Nothing extra is sent to providers unless you switch it on (correlation header, idempotency key).

Comma-separated values are used for lists (hosts, extra redaction keys, dashboard middleware).

For local development of this package, add a path repository to the app's composer.json:

Usage

1. Outbound calls through Laravel's Http client (recommended)

The request is timed and logged with its headers, body, status and response. Your code gets the normal Response back. Connection failures are logged too, and the exception is still thrown as usual.

Options (third argument):

ApiCallLogger::http('vtpass', 'buy-airtime') does the same thing as Http::withApiLogging(...). For a custom Guzzle client, push ApiCallLogger::middleware('vtpass') onto its handler stack.

2. Automatic capture of every Http client call

Hosts that don't match a provider are logged under their hostname. A call made with withApiLogging() is only logged once, even when capture is enabled.

3. Inbound webhooks

Inbound records have direction = inbound, the caller's IP in meta.ip, and your app's response as response_body. Uploaded files are stored as name, MIME type and size only.

4. Anything else (SOAP, raw cURL, vendor SDKs)

Request-scoped context

Set these once per request (in a middleware, for example). They apply to every call logged afterwards:

All calls logged during one request share a correlation_id. The dashboard lists them together, so you can follow a whole flow (e.g. verify BVN → create wallet → fund).

Retry attempts and idempotency keys

• Each attempt made by Http::withApiLogging(...)->retry(3) is logged with its number: attempt 1, 2, 3.
• An Idempotency-Key (or X-Idempotency-Key) header you send is stored in idempotency_key and re-sent on retry.
• With API_CALL_LOGGER_AUTO_IDEMPOTENCY_KEY=true, POST/PUT/PATCH/DELETE calls that have no key get one. All retry attempts of a call reuse the same key. Only enable it for providers that support idempotency keys.

Redaction

• Keys match at any depth of bodies, query strings and headers.
• Matching ignores case and separators, so Secret-Key, secret_key and secretKey are all caught.
• always keys (credentials) are redacted even when enabled is false.
• Multipart bodies are never read into memory. Only their size is stored.

Value patterns

Key names miss secrets stored under unexpected keys, inside free text, or in the URL itself. Value patterns catch them by what they look like. Each one has its own switch:

Card masking checks the Luhn checksum first, so order references and amounts are left alone.

Encryption at rest

• Payload columns are encrypted before they are written, and the model decrypts them when read.
• Switching encryption on or off never breaks old rows. Encrypted and plain records are both read back.
• With the wrong key, a record shows _encrypted: <cannot decrypt> instead of throwing.
• Queued log jobs are always encrypted on the queue.
• Encrypted columns can't be searched with SQL. Filter on the plain columns instead: provider, path, status, tenant, correlation id.

Erasure requests (GDPR / NDPR)

Retrying calls

Replaying a payment can charge twice, so you decide how strict retry is:

Credentials are never stored, so retry gets authentication headers from your config or a resolver:

Dashboard

Visit /api-call-logs (configurable with dashboard.route_prefix). Access is controlled by two gates. Like Telescope, they only allow the local environment until you define them:

Add auth (or your admin guard) to dashboard.middleware, or turn the dashboard off with API_CALL_LOGGER_DASHBOARD_ENABLED=false if you use Filament (see below).

Using it from Filament

Point a resource at the package model:

Querying

Alerts

Queueing and pruning

php artisan api-call-logger:prune --days=7 --provider=vtpass

Migrating from a project-level ThirdPartyApiLogger

Testing

Tests use in-memory SQLite when pdo_sqlite is installed. Otherwise they use the MySQL database configured in phpunit.xml.dist (api_call_logger_test).

License

MIT