Live push over Server-Sent Events (no inbound port)
Hold this GET open to receive audit.changed events as they happen: a no-inbound-port way to receive pushes. No setup: it’s a plain authenticated endpoint (your API key is all it needs). Each SSE frame is event: audit.changed with the SAME payload as a webhook and id: <event id>. Resume after a disconnect with the Last-Event-ID header (automatic in EventSource) or ?since=<id>; a fresh connect streams new events only (?since=0 replays all). Scoped to your active subscriptions. A : keepalive comment is sent about every 25s.
Authorizations
Your secret API key. Create one from your dashboard.
Query Parameters
Resume from this event id (alternative to the Last-Event-ID header). Omit for new events only; 0 replays all.
x >= 0Response
An event stream (text/event-stream). Each audit.changed frame's data is an AuditChangeEvent.
The payload POSTed to your webhook on every verdict change (and, each with an added integer id, what /events returns). type is always "audit.changed".
audit.changed Unique per change; dedupe on it (delivery is at-least-once).
Compact summary for cheap routing/alerting.
The complete new verdict, identical to a /audit-contract audit object, projected to your response profile. null if the change left no audit.
Which findings moved.
