> ## Documentation Index
> Fetch the complete documentation index at: https://docs.igrisecurity.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Real-time events (SSE)

> Server-Sent Events stream of tool calls, LLM calls and anomalies for your organization.

Real-time event stream over Server-Sent Events. Needs `observe:read`.

| Method | Path | Required permission | Description |
| - | - | - | - |
| `GET` | `/api/v1/events` | `observe:read` | Open SSE stream |

```http theme={null}
GET /api/v1/events
Authorization: Bearer ig_...
Accept: text/event-stream
```

The stream is scoped to your organization. Each message has an `event:` name and a JSON `data:` line.

| Event | When | `data` payload |
| - | - | - |
| `connected` | Right after the stream opens | `{ "orgId": "..." }` |
| `heartbeat` | Every 30 seconds | `{ "ts": 1767225600000 }` (ms since epoch) |
| `tool_call` | The gateway processed an MCP tool call | `{ toolName, serverId, action }` |
| `anomaly` | An MCP anomaly signal fired | `{ type, toolName, serverId, severity }` |
| `llm_call` | The LLM gateway processed a request | `{ model, provider, action, costCents, connectionSlug }` |
| `llm_anomaly` | An LLM anomaly signal fired | `{ type, model, connectionSlug, severity, message }` |

In `tool_call`, `serverId` is the connection slug and `action` is the policy action. Session suspension does not emit an SSE event. It sends a `session_suspended` webhook.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.