Events API

GET /events/stream

Events Stream

Muxed SSE: delivers notification + session-watch events on one connection. Auth: the token is FULLY validated once, up front, through the same ``validate_access_token`` the request path uses - old version, refresh token, missing nonce, stale nonce, inactive membership and inactive user are all rejected with 401 before any subscription is opened. That validation runs in a short-lived DB session that is closed before streaming begins, so the stream never holds a DB connection for its lifetime; the live stream keeps polling the nonce cache-first for revocation and drain.

Responses

Example

curl -X GET http://localhost:8000/events/stream \
  -H "Authorization: Bearer $TOKEN"