Let Yii2 Behaviors Own Your Audit Fields: TimestampBehavior and BlameableBehavior in Practice
Stop setting created_at and created_by in controllers. Yii2's TimestampBehavior and BlameableBehavior move audit fields into the model—here's the configuration, a worked example, and the query-builder bypass you need to know about.