Laravel Spy

https://github.com/farayaz/laravel-spy
Admin
Laravel Spy is a lightweight Laravel package designed to track and log outgoing HTTP requests made...
Tokens:6,231
Snippets:36
Trust Score:6.5
License:MIT
Update:1 year ago
Show doc for...
Tokens:
Raw
### Docker Compose for Laravel Spy Tests

Source: https://github.com/farayaz/laravel-spy/blob/main/README_TESTING.md

Launch the test environment using Docker Compose. This command builds the Docker image (if not already built) and starts the services defined in `docker-compose.yml` to run the tests.

```bash
docker-compose up --build
```

--------------------------------

### Manual Docker Commands for Laravel Spy Tests

Source: https://github.com/farayaz/laravel-spy/blob/main/README_TESTING.md

Manually build the Docker image, install dependencies, and run PHPUnit tests. This provides granular control over the testing process within the Docker environment.

```bash
# Build the image
docker build -t laravel-spy-test .

# Install dependencies
docker run --rm -v "$(pwd)":/var/www laravel-spy-test composer install

# Run tests
docker run --rm -v "$(pwd)":/var/www laravel-spy-test vendor/bin/phpunit
```

--------------------------------

### Install Laravel Spy via Composer

Source: https://github.com/farayaz/laravel-spy/blob/main/README.md

This command installs the Laravel Spy package using Composer, the dependency manager for PHP. After running this, Laravel's auto-discovery should enable the package.

```bash
composer require farayaz/laravel-spy
```

--------------------------------

### GitHub Actions Workflow for Laravel Spy Tests

Source: https://github.com/farayaz/laravel-spy/blob/main/README_TESTING.md

An example GitHub Actions workflow to automate the testing of the Laravel Spy package on every push or pull request. It checks out the code and executes the `./run-tests.sh` script.

```yaml
name: Tests

on: [push, pull_request]

jobs:
  test:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v2
      - name: Run tests
        run: ./run-tests.sh
```

--------------------------------

### Run Laravel Spy Tests with Docker

Source: https://github.com/farayaz/laravel-spy/blob/main/README_TESTING.md

Execute the Laravel Spy test suite using the provided shell script. This is the recommended method for running tests as it automates the Docker environment setup and test execution.

```bash
./run-tests.sh
```

--------------------------------

### Scheduling HTTP Log Cleanup with Laravel Tasks

Source: https://context7.com/farayaz/laravel-spy/llms.txt

Illustrates how to automate the `spy:clean` command using Laravel's task scheduler within the `app/Console/Kernel.php` file. Examples include daily, weekly, and hourly cleanup tasks with different filtering criteria.

```php
// app/Console/Kernel.php

namespace App\Console;

use Illuminate\Console\Scheduling\Schedule;
use Illuminate\Foundation\Console\Kernel as ConsoleKernel;

class Kernel extends ConsoleKernel
{
    protected function schedule(Schedule $schedule)
    {
        // Clean logs daily at 2 AM (uses config: spy.clean_days)
        $schedule->command('spy:clean')->dailyAt('02:00');

        // Clean logs older than 7 days, every week
        $schedule->command('spy:clean --days=7')->weekly();

        // Clean specific URL patterns daily
        $schedule->command('spy:clean --days=1 --url=webhook')->daily();

        // Aggressive cleanup: remove test data hourly
        $schedule->command('spy:clean --days=0 --url=test')->hourly();

        // Multiple cleanup strategies
        $schedule->command('spy:clean --days=90')->monthly();  // Long-term
        $schedule->command('spy:clean --days=7')->weekly();    // Medium-term
        $schedule->command('spy:clean --days=1 --url=debug')->daily();  // Debug logs
    }
}

```

--------------------------------

### Artisan Command for Cleaning HTTP Logs

Source: https://context7.com/farayaz/laravel-spy/llms.txt

Provides examples of using the `php artisan spy:clean` command to remove old HTTP logs. It details options for specifying the number of days, URL patterns, and forcing the cleanup. This command is essential for managing log storage.

```bash
# Clean logs based on config (default: 30 days)
php artisan spy:clean

# Clean logs older than 7 days
php artisan spy:clean --days=7

# Clean logs for specific URL pattern
php artisan spy:clean --url=api/users

# Combine filters: delete old logs matching URL
php artisan spy:clean --days=1 --url=webhook

# Force cleanup in production (requires confirmation otherwise)
php artisan spy:clean --force

# Examples of what gets cleaned:
# php artisan spy:clean --days=30 --url=stripe.com
# Deletes all logs containing "stripe.com" in URL older than 30 days

# php artisan spy:clean --days=0 --url=test
# Deletes all logs containing "test" regardless of age

```

--------------------------------

### Log an HTTP Request using Laravel HTTP Client

Source: https://github.com/farayaz/laravel-spy/blob/main/README.md

This PHP code snippet demonstrates how to make an outgoing HTTP GET request using Laravel's Http facade. When Laravel Spy is installed, this request and its details will be automatically logged to the database.

```php
Http::get('https://github.com/farayaz/laravel-spy/');
```

--------------------------------

### Basic HTTP Request Tracking with Laravel Spy

Source: https://context7.com/farayaz/laravel-spy/llms.txt

Demonstrates how Laravel Spy automatically logs outgoing HTTP requests made using Laravel's HTTP client. This includes GET, POST, and complex requests with headers, as well as handling failed requests.

```php
use Illuminate\Support\Facades\Http;

// After installing Laravel Spy, this request is automatically logged
$response = Http::get('https://api.example.com/users');

// POST requests with data are also logged
$response = Http::post('https://api.example.com/users', [
    'name' => 'John Doe',
    'email' => 'john@example.com',
    'password' => 'secret123',  // Will be obfuscated in logs
]);

// Complex requests with headers
$response = Http::withHeaders([
    'Authorization' => 'Bearer token123',  // Will be obfuscated
    'Accept' => 'application/json',
])->post('https://api.example.com/data', [
    'api_key' => 'sk_test_123',  // Will be obfuscated
    'payload' => ['foo' => 'bar'],
]);

// Failed requests are also logged with status 0
try {
    $response = Http::timeout(5)->get('https://slow-api.example.com/endpoint');
} catch (Exception $e) {
    // Exception is logged with error message in response_body
}
```

--------------------------------

### Configure Laravel Spy - Exclude Request Content Types

Source: https://github.com/farayaz/laravel-spy/blob/main/README.md

This environment variable allows you to prevent logging of request bodies for specific content types. For example, excluding 'image/' will prevent image payloads from being logged, saving space and avoiding issues with binary data.

```bash
SPY_REQUEST_BODY_EXCLUDE_CONTENT_TYPES=image/
```

--------------------------------

### Publish Laravel Spy Configuration and Run Migrations

Source: https://context7.com/farayaz/laravel-spy/llms.txt

Publishes the configuration file for Laravel Spy and runs the necessary database migrations to create the http_logs table. This step configures the package and prepares the database for logging.

```bash
php artisan vendor:publish --provider="Farayaz\LaravelSpy\LaravelSpyServiceProvider"
php artisan migrate
```

--------------------------------

### Laravel Spy Test Dependencies (JSON)

Source: https://github.com/farayaz/laravel-spy/blob/main/README_TESTING.md

List of development dependencies required for testing the Laravel Spy package. This JSON object specifies packages like PHPUnit, Laravel Pint, Orchestra Testbench, Mockery, and Faker.

```json
{
  "require-dev": {
    "phpunit/phpunit": "^9.0|^10.0",
    "laravel/pint": "^1.0",
    "orchestra/testbench": "^8.0|^9.0",
    "mockery/mockery": "^1.4.4",
    "fakerphp/faker": "^1.9.1"
  }
}
```

--------------------------------

### Run Database Migrations for Laravel Spy

Source: https://github.com/farayaz/laravel-spy/blob/main/README.md

This command executes the database migrations for Laravel Spy, creating the necessary table (e.g., 'http_logs') to store the logged HTTP request data. Ensure your database is configured correctly.

```bash
php artisan migrate
```

--------------------------------

### Environment Configuration for Laravel Spy

Source: https://context7.com/farayaz/laravel-spy/llms.txt

Configures Laravel Spy behavior through environment variables in the .env file. This allows for easy enabling/disabling, database settings, URL exclusions, data obfuscation, and dashboard settings.

```bash
# .env file configuration

# Enable/disable tracking
SPY_ENABLED=true

# Database configuration
SPY_TABLE_NAME=http_logs
SPY_DB_CONNECTION=mysql

# Exclude specific URLs from logging (comma-separated)
SPY_EXCLUDE_URLS=api/health,ping,status,metrics

# Obfuscate sensitive fields (comma-separated)
SPY_OBFUSCATES=password,token,api_key,secret,authorization,bearer

# Custom obfuscation mask (default: 🫣)
SPY_OBFUSCATION_MASK=***REDACTED***

# Auto-cleanup configuration (days)
SPY_CLEAN_DAYS=30

# Exclude binary content types from request bodies
SPY_REQUEST_BODY_EXCLUDE_CONTENT_TYPES=image/,video/,audio/,application/pdf

# Exclude binary content types from response bodies
SPY_RESPONSE_BODY_EXCLUDE_CONTENT_TYPES=image/,video/,application/pdf,application/zip

# Dashboard configuration
SPY_DASHBOARD_ENABLED=true
SPY_DASHBOARD_PREFIX=spy
SPY_DASHBOARD_MIDDLEWARE=web,auth
```

--------------------------------

### Configuring and Accessing the HTTP Logs Dashboard

Source: https://context7.com/farayaz/laravel-spy/llms.txt

Explains how to enable and configure the web dashboard for viewing HTTP traffic analytics. It covers settings in `.env` and `config/spy.php` for dashboard prefix, middleware, and enabling/disabling the feature. The types of analytics available are also listed.

```php
// routes/web.php - Dashboard is automatically registered at /spy
// Access at: http://your-app.test/spy

// Configure dashboard in .env
// SPY_DASHBOARD_ENABLED=true
// SPY_DASHBOARD_PREFIX=spy
// SPY_DASHBOARD_MIDDLEWARE=web,auth

// Or in config/spy.php:
return [
    'dashboard' => [
        'enabled' => true,
        'prefix' => 'spy',  // URL: /spy
        'middleware' => ['web', 'auth'],  // Require authentication
    ],
];

// Custom middleware for advanced access control
// config/spy.php
return [
    'dashboard' => [
        'enabled' => true,
        'prefix' => 'admin/http-logs',  // URL: /admin/http-logs
        'middleware' => ['web', 'auth', 'admin.only'],
    ],
];

// Disable dashboard in production
// .env.production
// SPY_DASHBOARD_ENABLED=false

// The dashboard shows:
// - Total requests in period (24h, 7d, 30d)
// - Success rate (2xx, 4xx, 5xx)
// - Top failing URLs with 500+ errors
// - Time-series chart of request volume
// - Request statistics grouped by time bucket

```

--------------------------------

### Run Specific Laravel Spy Tests in Docker

Source: https://github.com/farayaz/laravel-spy/blob/main/README_TESTING.md

Execute specific sets of tests within the Docker environment, such as unit tests, feature tests, or individual test files. This allows for focused testing and faster feedback loops.

```bash
# Run only unit tests
docker run --rm -v "$(pwd)":/var/www laravel-spy-test vendor/bin/phpunit tests/Unit

# Run only feature tests
docker run --rm -v "$(pwd)":/var/www laravel-spy-test vendor/bin/phpunit tests/Feature

# Run a specific test file
docker run --rm -v "$(pwd)":/var/www laravel-spy-test vendor/bin/phpunit tests/Unit/LaravelSpyTest.php

# Run with coverage (requires xdebug)
docker run --rm -v "$(pwd)":/var/www laravel-spy-test vendor/bin/phpunit --coverage-html coverage
```

--------------------------------

### Querying HTTP Logs with Eloquent Model

Source: https://context7.com/farayaz/laravel-spy/llms.txt

Demonstrates how to interact with the HttpLog Eloquent model to retrieve, filter, and access logged HTTP request data. It covers common use cases like fetching all logs, recent logs, failed requests, and specific URL patterns. Accessing individual log attributes is also shown.

```php
use Farayaz\LaravelSpy\Models\HttpLog;
use Illuminate\Support\Carbon;

// Get all logs
$logs = HttpLog::all();

// Get recent logs (last 24 hours)
$recentLogs = HttpLog::where('created_at', '>=', Carbon::now()->subDay())
    ->orderBy('created_at', 'desc')
    ->get();

// Find failed requests (5xx errors)
$failures = HttpLog::where('status', '>=', 500)
    ->orWhere('status', 0)  // Connection failures
    ->get();

foreach ($failures as $log) {
    echo "Failed request to {$log->url}\n";
    echo "Method: {$log->method}\n";
    echo "Status: {$log->status}\n";
    echo "Error: " . json_encode($log->response_body) . "\n\n";
}

// Find requests to specific URL
$apiLogs = HttpLog::where('url', 'like', '%api.stripe.com%')
    ->where('created_at', '>=', Carbon::now()->subWeek())
    ->get();

// Get successful requests only
$successfulRequests = HttpLog::whereBetween('status', [200, 299])->get();

// Access log data
$log = HttpLog::first();
echo $log->url;
              // "https://api.example.com/users"
echo $log->method;
           // "POST"
echo $log->status;
           // 200
var_dump($log->request_headers);   // Array of headers
var_dump($log->request_body);      // Array/string of request data
var_dump($log->response_headers);  // Array of headers
var_dump($log->response_body);     // Array/string of response data
echo $log->created_at;       // Carbon instance

// Count requests by status code
$stats = [
    '2xx' => HttpLog::whereBetween('status', [200, 299])->count(),
    '4xx' => HttpLog::whereBetween('status', [400, 499])->count(),
    '5xx' => HttpLog::where('status', '>=', 500)->count(),
    'failed' => HttpLog::where('status', 0)->count(),
];

```

--------------------------------

### Publish Laravel Spy Service Provider

Source: https://github.com/farayaz/laravel-spy/blob/main/README.md

This command publishes the Laravel Spy service provider, which is necessary for the package to integrate with your Laravel application. This step is usually followed by database migrations.

```bash
php artisan vendor:publish --provider="Farayaz\LaravelSpy\LaravelSpyServiceProvider"
```

--------------------------------

### Programmatic Configuration for Laravel Spy

Source: https://context7.com/farayaz/laravel-spy/llms.txt

Configures Laravel Spy programmatically via the config/spy.php file. This provides an alternative to environment variables for setting up features like enabled status, table names, exclusions, obfuscations, and dashboard settings.

```php
// config/spy.php

return [
    // Enable/disable spy functionality
    'enabled' => env('SPY_ENABLED', true),

    // Database table name
    'table_name' => env('SPY_TABLE_NAME', 'http_logs'),

    // Database connection (null = default)
    'db_connection' => env('SPY_DB_CONNECTION', null),

    // URLs to exclude from logging
    'exclude_urls' => [
        'api/health',
        'webhook/internal',
        'metrics',
    ],

    // Fields to obfuscate
    'obfuscates' => [
        'password',
        'token',
        'api_key',
        'secret',
        'authorization',
        'client_secret',
    ],

    // Obfuscation mask
    'obfuscation_mask' => '🫣',

    // Retention period in days
    'clean_days' => 30,

    // Content types to exclude from request body logging
    'request_body_exclude_content_types' => [
        'image/',
        'video/',
        'application/pdf',
    ],

    // Content types to exclude from response body logging
    'response_body_exclude_content_types' => [
        'video/',
        'application/pdf',
    ],

    // Dashboard settings
    'dashboard' => [
        'enabled' => true,
        'prefix' => 'spy',
        'middleware' => ['web', 'auth'],
    ],
];
```

--------------------------------

### Analyze HTTP Logs with Laravel Spy

Source: https://context7.com/farayaz/laravel-spy/llms.txt

This PHP code snippet demonstrates various ways to analyze HTTP logs captured by Laravel Spy. It shows how to find recent failures, calculate average response times per endpoint, identify top APIs, detect rate limiting, find slow requests, and export logs to a CSV file. It utilizes the `HttpLog` Eloquent model and various Laravel/PHP functionalities for data manipulation and analysis.

```php
use Farayaz\LaravelSpy\Models\HttpLog;
use Illuminate\Support\Carbon;
use Illuminate\Support\Facades\DB;

// Find all failed requests in last hour
$recentFailures = HttpLog::where('created_at', '>=' , Carbon::now()->subHour())
    ->where(function ($query) {
        $query->where('status', '>=' , 500)
              ->orWhere('status', 0);
    })
    ->orderBy('created_at', 'desc')
    ->get();

if ($recentFailures->count() > 10) {
    // Alert: too many failures
    \Log::critical('High failure rate detected', [
        'count' => $recentFailures->count(),
        'urls' => $recentFailures->pluck('url')->unique(),
    ]);
}

// Calculate average response times by endpoint
$endpoints = HttpLog::select('url', DB::raw('AVG(TIMESTAMPDIFF(SECOND, created_at, updated_at)) as avg_seconds'))
    ->where('created_at', '>=' , Carbon::now()->subDay())
    ->whereBetween('status', [200, 299])
    ->groupBy('url')
    ->orderByDesc('avg_seconds')
    ->get();

// Find most frequently called APIs
$topApis = HttpLog::select('url', DB::raw('COUNT(*) as call_count'))
    ->where('created_at', '>=' , Carbon::now()->subWeek())
    ->groupBy('url')
    ->orderByDesc('call_count')
    ->limit(10)
    ->get();

// Detect rate limit errors (429 status)
$rateLimited = HttpLog::where('status', 429)
    ->where('created_at', '>=' , Carbon::now()->subDay())
    ->get()
    ->groupBy('url');

foreach ($rateLimited as $url => $logs) {
    echo "Rate limited on {$url}: {$logs->count()} times\n";
}

// Find slow external APIs (comparing request/response timing)
$slowRequests = HttpLog::whereBetween('status', [200, 299])
    ->where('created_at', '>=' , Carbon::now()->subHour())
    ->get()
    ->filter(function ($log) {
        return $log->created_at->diffInSeconds($log->updated_at) > 5;
    });

// Export logs to CSV for analysis
$logs = HttpLog::where('created_at', '>=' , Carbon::now()->subWeek())->get();
$csv = fopen('/tmp/http_logs.csv', 'w');
fputcsv($csv, ['Timestamp', 'URL', 'Method', 'Status', 'Response Time']);
foreach ($logs as $log) {
    fputcsv($csv, [
        $log->created_at,
        $log->url,
        $log->method,
        $log->status,
        $log->created_at->diffInSeconds($log->updated_at),
    ]);
}
fclose($csv);

```

--------------------------------

### Configure Laravel Spy - Dashboard Middleware

Source: https://github.com/farayaz/laravel-spy/blob/main/README.md

This environment variable defines the middleware stack to be applied to the Laravel Spy dashboard route. Common values include 'web' and 'auth' for authentication and session handling.

```bash
SPY_DASHBOARD_MIDDLEWARE=web,auth
```

--------------------------------

### Configure Laravel Spy - Enable Dashboard

Source: https://github.com/farayaz/laravel-spy/blob/main/README.md

This environment variable enables the built-in web dashboard for Laravel Spy, accessible at the `/spy` route. It requires authentication and middleware configuration.

```bash
SPY_DASHBOARD_ENABLED=true
```

--------------------------------

### Configure Laravel Spy - Obfuscation Mask

Source: https://github.com/farayaz/laravel-spy/blob/main/README.md

This environment variable sets the replacement string used when obfuscating sensitive data fields configured via SPY_OBFUSCATES. It provides a consistent way to mask sensitive information.

```bash
SPY_OBFUSCATION_MASK=***HIDDEN***
```

--------------------------------

### Configure Laravel Spy - Log Retention Days

Source: https://github.com/farayaz/laravel-spy/blob/main/README.md

This environment variable specifies the number of days logs should be retained before being automatically cleaned up. Setting this value helps manage database size over time.

```bash
SPY_CLEAN_DAYS=7
```

--------------------------------

### Clean Old HTTP Logs using Artisan Command

Source: https://github.com/farayaz/laravel-spy/blob/main/README.md

This Artisan command cleans up old HTTP logs based on the configuration set in `SPY_CLEAN_DAYS`. It's a manual way to manage log storage.

```bash
php artisan spy:clean
```

--------------------------------

### Clean HTTP Logs Matching URL Pattern

Source: https://github.com/farayaz/laravel-spy/blob/main/README.md

This Artisan command cleans logs that match a specific URL pattern, in addition to a day limit. The `--url` option filters logs before deletion, allowing targeted log management.

```bash
php artisan spy:clean --days=1 --url=api/users
```

--------------------------------

### Clean HTTP Logs Older Than Specific Days

Source: https://github.com/farayaz/laravel-spy/blob/main/README.md

This Artisan command allows you to specify a number of days via the `--days` option to clean logs older than that specified duration. This overrides the default `SPY_CLEAN_DAYS` for a single execution.

```bash
php artisan spy:clean --days=30
```

--------------------------------

### Configure Laravel Spy - Data Obfuscation Fields

Source: https://github.com/farayaz/laravel-spy/blob/main/README.md

This environment variable defines a comma-separated list of field names (e.g., 'password', 'token') that Laravel Spy should automatically obfuscate in request and response bodies. This helps protect sensitive data in logs.

```bash
SPY_OBFUSCATES=password,token,api_key,secret
```

--------------------------------

### Configure Laravel Spy - Exclude Response Content Types

Source: https://github.com/farayaz/laravel-spy/blob/main/README.md

This environment variable prevents logging of response bodies for specified content types. Useful for large binary files like videos or PDFs, ensuring logs remain manageable.

```bash
SPY_RESPONSE_BODY_EXCLUDE_CONTENT_TYPES=video/,application/pdf
```

--------------------------------

### Configure Content-Type Filtering for Logging (Bash & PHP)

Source: https://context7.com/farayaz/laravel-spy/llms.txt

This snippet illustrates how to configure Laravel Spy to exclude specific content types from request and response bodies being logged. This is useful for preventing large binary data like images or videos from cluttering logs. Configuration is done via `.env` variables.

```bash
# .env configuration

# Exclude images from request body logging
SPY_REQUEST_BODY_EXCLUDE_CONTENT_TYPES=image/,video/

# Exclude PDFs and videos from response body logging
SPY_RESPONSE_BODY_EXCLUDE_CONTENT_TYPES=video/,application/pdf,application/zip

```

```php
use Illuminate\support\facades\http;

// Image upload - request body excluded from logging
$response = Http::attach(
    'avatar', file_get_contents('/path/to/image.jpg'), 'avatar.jpg'
)->post('https://api.example.com/upload');
// Request body logged as: ["content excluded by configuration"]

// PDF download - response body excluded from logging
$response = Http::get('https://api.example.com/invoice.pdf');
// Response body logged as: ["content excluded by configuration"]

// JSON data - logged normally
$response = Http::post('https://api.example.com/users', [
    'name' => 'John Doe',
]);
// Request body logged as: {"name": "John Doe"}

// XML data - parsed and logged
$response = Http::withHeaders(['Content-Type' => 'application/xml'])
    ->send('POST', 'https://api.example.com/soap', [
        'body' => '<user><name>John</name></user>'
    ]);
// Request body logged as parsed XML array

// Multipart form data - base64 encoded
$response = Http::asMultipart()->post('https://api.example.com/form', [
    ['name' => 'field', 'contents' => 'value'],
]);
// Request body logged as base64 encoded string

```

--------------------------------

### Configure Laravel Spy - Enable/Disable

Source: https://github.com/farayaz/laravel-spy/blob/main/README.md

This environment variable controls whether Laravel Spy is active and logging outgoing HTTP requests. Set to 'true' to enable logging, and 'false' to disable it. This is a basic configuration option.

```bash
SPY_ENABLED=true
```

--------------------------------

### Schedule Automatic Log Cleanup in Laravel

Source: https://github.com/farayaz/laravel-spy/blob/main/README.md

This PHP code snippet shows how to schedule the 'spy:clean' Artisan command to run daily within your Laravel application's scheduler. This ensures automatic log management without manual intervention.

```php
// app/Console/Kernel.php
protected function schedule(Schedule $schedule)
{
  $schedule->command('spy:clean')->daily();
}
```

--------------------------------

### Configure Laravel Spy - Exclude URLs

Source: https://github.com/farayaz/laravel-spy/blob/main/README.md

This environment variable allows you to specify a comma-separated list of URL patterns that should not be logged by Laravel Spy. This is useful for excluding health checks or other non-critical endpoints.

```bash
SPY_EXCLUDE_URLS=api/health,ping,status
```

--------------------------------

### Obfuscate Sensitive Data in HTTP Requests (PHP)

Source: https://context7.com/farayaz/laravel-spy/llms.txt

This snippet demonstrates how to configure and utilize Laravel Spy's data obfuscation feature. Sensitive data in request bodies, headers, and URL query parameters are automatically masked. Configuration is done via `.env` variables. It handles various data structures including nested arrays and case-insensitive keys.

```php
use Illuminate\support\facades\http;

// Configure obfuscation in .env
// SPY_OBFUSCATES=password,token,api_key,secret
// SPY_OBFUSCATION_MASK=***HIDDEN***

// Request with sensitive data
$response = Http::post('https://api.example.com/auth', [
    'username' => 'john@example.com',      // Logged as-is
    'password' => 'secret123',             // Logged as: ***HIDDEN***
    'api_key' => 'sk_live_abc123',         // Logged as: ***HIDDEN***
    'metadata' => [
        'user_id' => 42,                   // Logged as-is
        'token' => 'refresh_token_xyz',    // Logged as: ***HIDDEN***
    ],
]);

// Headers are also obfuscated
$response = Http::withHeaders([
    'Authorization' => 'Bearer secret_token',  // Logged as: Bearer ***HIDDEN***
    'X-API-Key' => 'key_123',                  // Logged as: ***HIDDEN***
    'Content-Type' => 'application/json',       // Logged as-is
])->get('https://api.example.com/data');

// URL query parameters are obfuscated
$response = Http::get('https://api.example.com/users?token=abc123&page=1');
// URL logged as: https://api.example.com/users?token=***HIDDEN***&page=1

// Nested obfuscation works recursively
$response = Http::post('https://api.example.com/nested', [
    'user' => [
        'email' => 'user@example.com',
        'password' => 'pass123',           // Obfuscated
        'profile' => [
            'bio' => 'Developer',
            'secret' => 'value',           // Obfuscated
        ],
    ],
]);

// Case-insensitive obfuscation
$response = Http::post('https://api.example.com/data', [
    'Password' => 'test',    // Obfuscated
    'PASSWORD' => 'test2',   // Obfuscated
    'password' => 'test3',   // Obfuscated
]);

```

--------------------------------

### Exclude Specific URLs from Logging (Bash & PHP)

Source: https://context7.com/farayaz/laravel-spy/llms.txt

This snippet demonstrates how to configure Laravel Spy to exclude certain URLs from being logged. This is useful for preventing routine requests like health checks or monitoring pings from cluttering logs. Exclusion can be configured via `.env` or programmatically.

```bash
# .env configuration

# Exclude health checks, webhooks, and monitoring endpoints
SPY_EXCLUDE_URLS=api/health,webhook/internal,metrics,ping,/status

```

```php
use Illuminate\support\facades\http;

// These requests are NOT logged (excluded by config)
Http::get('https://api.example.com/api/health');
Http::post('https://api.example.com/webhook/internal/process');
Http::get('https://monitor.example.com/metrics');

// These requests ARE logged (not excluded)
Http::get('https://api.example.com/api/users');
Http::post('https://api.example.com/api/orders');

// Programmatic exclusion in config/spy.php
return [
    'exclude_urls' => [
        'health',
        'heartbeat',
        'webhook/internal',
        'debug',
        'test',
    ],
];

// Partial URL matching works
// Config: SPY_EXCLUDE_URLS=stripe.com/health
Http::get('https://api.stripe.com/health/check');  // Not logged
Http::get('https://api.stripe.com/v1/charges');    // Logged

```
Tokens:
Raw