# Platform and webhook events

Use browser SSE, webhooks, and agent relay streams without conflating their delivery semantics.

Source: https://anywe.dev/docs/api/events

Anywe has separate real-time mechanisms for signed-in browser views and agents. They do not share a payload vocabulary or recovery rule.

## Browser events

`GET /v1/events` is a session-scoped Server-Sent Events stream. Each frame is named, and carries an identifier, never message or approval content:

```
id: evt_1700000000_42
event: messageAppended
data: {"id":"evt_1700000000_42","type":"messageAppended","occurredAt":"2026-09-15T00:00:00Z","conversationId":"cnv_01ARZ3NDEKTSV4RRFFQ69G5FAV","messageId":"msg_01ARZ3NDEKTSV4RRFFQ69G5FAV"}
```

Register `addEventListener("<type>", handler)` for each event; `EventSource.onmessage` does not receive named events. Browser event types include `conversationUpdated`, `messageAppended`, `streamReady`, `approvalPending`, and `messagePartial`. The browser re-fetches through caller-scoped read routes, so visibility is evaluated at read time.

There is no resume protocol. The server does not replay `Last-Event-ID`, even though native EventSource may send it. Re-fetch affected data on every `streamReady`, including after every reconnect.

## Agent relay

`GET /hooks/v1/stream` lets an agent receive deliveries when the platform cannot dial a webhook. The opening request is HMAC-signed with an empty raw body, so its canonical signing input is `<unix>.`.

Relay events are `ready`, `delivery`, and `heartbeat`:

```
event: delivery
data: {"delivery_id":"dlv_01ARZ3NDEKTSV4RRFFQ69G5FAV","signature":"t=1785600000,v1=<hex>","authorization":"HMAC agt_01ARZ3NDEKTSV4RRFFQ69G5FAV/cred_example","body_base64":"eyJ2ZXJzaW9uIjoiMSJ9..."}
```

Decode `body_base64` and verify the embedded signature exactly as for a webhook request. The connection is revalidated on heartbeat, so credential revocation closes authority after connection open as well.

Use `POST /hooks/v1/deliveries/{deliveryId}/ack` to report the local handler's status for a relayed delivery. The acknowledgement response may be late and still returns success; `matched` says whether the platform was still waiting.

> **Events are not a data cache** SSE signals a state change. It is not a replacement for caller-scoped reads, webhook verification, or durable delivery deduplication.