Laravel Api Logs Laravel Package

What's Changed

• feat(guard): add guard config option to control auth guard used for logging by @jfrosorio in https://github.com/CodeTechAgency/laravel-api-logs/pull/31

Full Changelog: https://github.com/CodeTechAgency/laravel-api-logs/compare/v3.1.1...v3.2.0

Added

• Package banner, Packagist downloads badge, and Changelog/Contributing/Security/Support sections in the README (#19)
• CONTRIBUTING.md with branch-targeting and PR guidelines, and SECURITY.md with the supported-versions table and private disclosure instructions (#25)
• Code-style (Laravel Pint) and static-analysis (PHPStan/Larastan level 5) tooling, enforced by a new CI quality job — composer lint / composer analyse / composer format (#23)

Changed

• README links are now absolute URLs, so they keep working when the README is rendered outside GitHub (#19)
• Docs now state the version support policy: 3.x active, 2.x security fixes, 1.x end of life (#15)

Internal

• Redactor calls its private helpers via self:: instead of static::; no behavior change (#23)

Added

• Sensitive fields are now redacted by default before a log is stored (#13) — backport of the 3.1.0 feature to the 2.x line (Laravel 7–10):
  • Request data & query string: credential-type keys (password, token, access_token, secret, cvv, …), matched case-insensitively and recursively
  • Request headers: Authorization, Proxy-Authorization, Cookie, X-Api-Key, CSRF tokens and PHP basic-auth headers (value shape preserved)
  • Response data: same key list as request data, protecting token-issuing endpoints
  • Stored URL: query parameters are redacted too, so ?api_token=… no longer leaks
• Publishable config file to customize the redaction lists and replacement string: php artisan vendor:publish --provider=CodeTech\\ApiLogs\\Providers\\ApiLogServiceProvider --tag=config
• Test suite (Testbench 5–8) and GitHub Actions CI matrix: Laravel 7/8/9/10 × PHP 7.4–8.3

Fixed

• An authenticated model without the HasApiLogs trait no longer causes a fatal error in terminate() — the request is simply not logged
• The middleware no longer writes $request->start / $request->end dynamic properties (deprecated on PHP 8.2+); timing uses the request attribute bag

Note

Rows logged before this release remain unredacted in your api_logs table — consider purging or cleaning historical data. See UPGRADE.md for the full 2.0 → 2.1 notes.

Added

• Sensitive fields are now redacted by default before a log is stored (#11):
  • Request data & query string: credential-type keys (password, token, access_token, secret, cvv, …), matched case-insensitively and recursively
  • Request headers: Authorization, Proxy-Authorization, Cookie, X-Api-Key, CSRF tokens and PHP basic-auth headers (value shape preserved)
  • Response data: same key list as request data, protecting token-issuing endpoints
  • Stored URL: query parameters are redacted too, so ?api_token=… no longer leaks
• Publishable config file to customize the redaction lists and replacement string: php artisan vendor:publish --provider=CodeTech\\ApiLogs\\Providers\\ApiLogServiceProvider --tag=config

Note

Rows logged before this release remain unredacted in your api_logs table — consider purging or cleaning historical data if it may contain credentials.

Added

• Support for Laravel 11, 12 and 13 (#8).
• Test suite (Orchestra Testbench) and GitHub Actions CI matrix: PHP 8.2/8.3/8.4 × Laravel 11/12/13.
• Upgrade guide for migrating from 2.x.

Changed

• Breaking: requires PHP ≥ 8.2 (≥ 8.3 for Laravel 13); Laravel 7–10 are no longer supported — stay on ^2.0 for those.
• Breaking: request timing is stored in the request attribute bag (api_logs.start) instead of dynamic properties on the Request object.
• Breaking: LogApiRequest::handle() and terminate() now declare typed signatures.
• ApiLog casts moved from the $casts property to the Laravel 11+ casts() method.
• Migration stub converted to an anonymous class.
• response_data is stored as null for responses without string content (streamed/binary) instead of attempting to decode them.

Fixed

• Authenticated models without the HasApiLogs trait no longer cause a fatal error in terminate() — their requests are simply not logged.

See UPGRADE.md for the full upgrade path.

Fixed

• LogApiRequest middleware no longer returns a null response for unauthenticated requests — they now pass through the pipeline normally and are simply not logged (#7, #9).
• Request start time is set unconditionally in handle(), so the logged duration is correct even when authentication is established later in the middleware stack.

What's Changed

• fix(middleware): check auth added by @jfrosorio in https://github.com/CodeTechAgency/laravel-api-logs/pull/6

Full Changelog: https://github.com/CodeTechAgency/laravel-api-logs/compare/v2.0.0...v2.0.1

What's Changed

• feat(causer): polymorphic relation by @jfrosorio in https://github.com/CodeTechAgency/laravel-api-logs/pull/5

Full Changelog: https://github.com/CodeTechAgency/laravel-api-logs/compare/v1.0.3...v2.0.0

What's Changed

• fix(migration): request headers added by @jfrosorio in https://github.com/CodeTechAgency/laravel-api-logs/pull/4

Full Changelog: https://github.com/CodeTechAgency/laravel-api-logs/compare/v1.0.2...v1.0.3

What's Changed

• chore(code): minor updates by @jfrosorio in https://github.com/CodeTechAgency/laravel-api-logs/pull/3

Full Changelog: https://github.com/CodeTechAgency/laravel-api-logs/compare/v1.0.1...v1.0.2

What's Changed

• doc(usage): add middleware import statement by @jfrosorio in https://github.com/CodeTechAgency/laravel-api-logs/pull/2

Full Changelog: https://github.com/CodeTechAgency/laravel-api-logs/compare/v1.0.0...v1.0.1

• chore(package): initial setup