Audit

Audit is for apps that handle other people's data and have to answer for it: to a customer, to an auditor, to a person asking what was done with their data. Your app records each action that matters. Audit keeps the events in a hash chain per project, seals every finished day with a signed checkpoint, and checks every night that nothing was changed, put in or taken out. Reading the log is recorded too.

use Illuminate\Support\Facades\DB;
use MyBeast\Audit\Laravel\Events\Actor;
use MyBeast\Audit\Laravel\Events\Target;
use MyBeast\Audit\Laravel\Facades\Audit;

DB::transaction(function () use ($customer, $operator, $reason) {
    // … show or change the customer …

    Audit::record('customer.viewed',
        Actor::operator($operator->id),
        Target::of('customer', $customer->id),
        ['fields' => ['iban', 'address']],
        subject: $customer->user_id,
        account: $customer->workspace_id,
        reason: $reason,
    );
});

How it works

• Your app records. Audit::record() writes the event to an outbox table in your own database, in the same transaction as the action. If the action rolls back, so does its record.
• The scheduler sends. php artisan audit:ship runs every minute and sends the outbox to Audit in order, in batches. A row leaves the outbox only once Audit has confirmed it, so nothing is lost while Audit can't be reached.
• Audit chains and seals. Each event carries the hash of the one before it. After midnight UTC the day is sealed with a signed checkpoint, and a check every night recomputes the chain and names the first event that doesn't match.
• Your team reads. At services.my-beast.com they search the events, export them as CSV, open a person's access report and see on the Integrity page that the log is whole. Every search, event opened and export is written down, and the project's admins see who read what.

Audit keeps ids, never names or email addresses. Who an id is, your own console says: each id can link to it. An event with an email address in it is refused.

What you need

• A project with Audit, chosen on Audit's page.
• A Laravel 12 or 13 app on PHP 8.2 or later, with its own database for the outbox.
• Laravel's scheduler running on one of its servers (php artisan schedule:work, or cron with schedule:run).
• The project's server secret, in your app's .env as MYBEAST_AUDIT_SECRET.

An app that isn't Laravel can send events to the API with the same secret, but it has to keep its own outbox.

Explore the docs