---
title: "Server-Sent Events stream for server→client notifications."
method: GET
path: "/api/v1/mcp"
tags: ["mcp"]
---

# Server-Sent Events stream for server→client notifications.

`GET /api/v1/mcp`

## Request

- Base URL: `https://erp.eyeot.fr/api/v1`
- URL: `https://erp.eyeot.fr/api/v1/api/v1/mcp`
- Auth: none declared

Server-Sent Events stream for server→client notifications.

    Emits a periodic keepalive comment line + heartbeat until the max lifetime
    is reached, then the client should reconnect. Future versions will
    broadcast ``notifications/tools/list_changed`` on schema mutation.

    Hardening (MUST Vague 6, lane mcp-dcr) :
    - The token is REALLY validated (active API key or OAuth token) before the
      stream opens — a bogus ``Authorization`` no longer parks a worker.
    - Rate-limited (60/min/IP) — same anti-flood plafond family as POST.
    - ``Origin`` validated (anti DNS-rebinding, MCP Streamable HTTP spec).
    - Bounded lifetime + heartbeat interval, both configurable.

## Response `200`

Succès — payload `{data, meta}` (cf. API-GUIDE §3.1)

## Other responses

- `404`: Ressource introuvable (ou cross-tenant — équivalent à hidden).
- `429`: Trop de requêtes. Honorer le header `Retry-After` (secondes).

---

[API](https://skmtc.dev/eyeot/apis/eyeot-erp-api.md) · [All operations](https://skmtc.dev/eyeot/apis/eyeot-erp-api/llms.txt) · [OpenAPI document](https://skmtc.dev/eyeot/apis/eyeot-erp-api/revisions/42ab95222a89?raw)