Real-time events (SSE)

Real-time event stream over Server-Sent Events. Needs observe:read.

Method	Path	Required permission	Description
`GET`	`/api/v1/events`	`observe:read`	Open SSE stream

GET /api/v1/events
Authorization: Bearer ig_...
Accept: text/event-stream

The stream is scoped to your organization. Each message has an event: name and a JSON data: line.

Event	When	`data` payload
`connected`	Right after the stream opens	`{ "orgId": "..." }`
`heartbeat`	Every 30 seconds	`{ "ts": 1767225600000 }` (ms since epoch)
`tool_call`	The gateway processed an MCP tool call	`{ toolName, serverId, action }`
`anomaly`	An MCP anomaly signal fired	`{ type, toolName, serverId, severity }`
`llm_call`	The LLM gateway processed a request	`{ model, provider, action, costCents, connectionSlug }`
`llm_anomaly`	An LLM anomaly signal fired	`{ type, model, connectionSlug, severity, message }`

In tool_call, serverId is the connection slug and action is the policy action. Session suspension does not emit an SSE event. It sends a session_suspended webhook.

Get Started

Connect

Govern

Monitor

Reference

API Reference