Skip to content
My Beast
Cart
Developer docsMenu

Audit · Getting started

Quickstart

From a new project to your first event in the log, in six steps. You need a Laravel 12 or 13 app on PHP 8.2 or later.

1. Add Audit to a project

On Audit's page, choose a plan. At id.my-beast.com you name the project, or pick one you have, and pay.

Then open the project in Audit at services.my-beast.com. Until Audit keeps the project's first event, its Overview is the setup guide: the steps below, each with where the project stands in it.

2. Add the SDK

In your app's folder:

Terminal
composer require mybeast/audit-laravel
php artisan migrate

The migration adds the outbox: a table called audit_outbox in your app's own database, where each event waits until Audit has it. To give it a name by your own rules, set MYBEAST_AUDIT_OUTBOX_TABLE before you run migrate.

3. Add the server secret

Your app's server sends its events with the project's server secret. Two lines in its .env:

.env
MYBEAST_AUDIT_URL=https://services.my-beast.com/audit
MYBEAST_AUDIT_SECRET=sk_…

When id made the secret with the project, Secrets already keeps these two lines, values filled in, in each of the project's environments. Otherwise make one: in the project's Settings in Audit, under Audit keys, choose New key, keep Server secret and choose Make key. It is shown once, so copy it into the .env straight away.

Keep the secret on the server

Anyone with it can write events into the project's log. Never put it in code that runs in a browser or in a repository.

Audit keeps one log for the project, with no environments: every app with this secret writes into it. A copy that shouldn't, such as a developer's checkout, sets MYBEAST_AUDIT_ENABLED=false: its events are still checked, and none is written.

4. Record an event

Where your app does something worth answering for, record it, inside the same database transaction:

PHP
use MyBeast\Audit\Laravel\Events\Actor;
use MyBeast\Audit\Laravel\Events\Target;
use MyBeast\Audit\Laravel\Facades\Audit;

// In the transaction of the action it records:
Audit::record('customer.viewed',
    Actor::operator($operator->id),
    Target::of('customer', $customer->id),
    subject: $customer->user_id,
);

Ids only, never a name or an email address: an email address in an id throws at once, in your transaction. subject is the person the data is about, and their access report lists the event. Record events has every part of an event.

5. Send it

On the app's server:

Terminal
php artisan audit:ship
php artisan audit:ship --status

audit:ship sends what waits in the outbox, oldest first, and says how many events Audit kept, or why not. An event leaves once it is two seconds old, so one recorded a moment ago may wait for the next run. --status says what waits, since when, and what Audit refused.

From now on, keep Laravel's scheduler running (php artisan schedule:work, or cron with schedule:run): the SDK adds audit:ship to it, every minute, on one server.

6. Find it in Audit

The setup guide checks every few seconds and turns into the project's dashboard by itself once the first event is kept. Open Events to see it, and open the event for everything it holds and its place in the chain. The next morning, Integrity shows the day sealed and the chain checked.

Next steps