Watch live dashboard events

GET

/feed

curl --request GET \
  --url http://127.0.0.1:7799/feed \
  --cookie cotal_web_session=<cotal_web_session>

• Your dashboard listener. Broker TLS does not encrypt this HTTP connection.

Open a Server-Sent Events stream. Each frame has event: and data: , followed by a blank line. The initial frames contain roster and presence-view, then membership or membership-read-failed. Later frames carry roster, presence-view, membership, membership-read-failed and message updates. The stream provides no event IDs or replay cursor; reconnect and read history for backfill. An unhandled request failure after headers have been sent closes the stream. Membership read failures are sent as events and leave the stream open. The schemas under x-sse-events describe decoded data payloads.

Event	JSON data
roster	Array of presence records, with optional dashboard progress.
presence-view	state and fresh, plus staleSince for a stale observer.
membership	Optional asOf and an array of members with live and durable channels.
membership-read-failed	An object with a reason string.
message	mode and msg, with subject-derived senderId and chat channel when available.

Decoded payload schemas are also included under x-sse-events in the downloadable specification.

The message event forwards publisher JSON without wire-message validation. Treat msg.from as advisory; senderId is derived from the broker subject. A malformed publisher payload can still appear in the feed.

Authorizations

• DashboardSession
• LaunchToken

Responses

200

An open UTF-8 SSE stream. Authentication and origin checks run before streaming begins.

Media typetext/event-stream

string

Example

event: roster
data: []

event: presence-view
data: {"state":"current","fresh":true}

Headers

Cache-Control

string

Allowed value: no-cache

302

A valid one-use k query token is exchanged for a dashboard session. The response redirects to the same path without its query. A valid existing cookie takes precedence over k.

Headers

Location

string

The requested path without the query string.

Set-Cookie

string

Cotal_web_session=; Path=/; HttpOnly; SameSite=Strict. The default local listener uses HTTP.

401

No valid session, an invalid launch token, or a spent launch token. The readiness credential does not authorize these routes.

Media typeapplication/json

object

error

required

string

Allowed values: unauthenticated launch-token-already-used

Example

{
  "error": "unauthenticated"
}

403

Origin is checked before session authentication. An origin outside this listener’s allowed origins is refused.

Media typeapplication/json

object

error

required

string

Allowed value: cross-origin

Example

{
  "error": "cross-origin"
}

413

These read routes accept no request body. An announced body is refused before it is read; the connection is closed.

Media typeapplication/json

object

error

required

string

Example^generated

{
  "error": "example"
}

500

The request failed. The body names the failure; a failed read does not terminate the dashboard.

Media typeapplication/json

object

error

required

string

Example^generated

{
  "error": "example"
}