Report stream (SSE)

The Server-Sent Events feed behind the report page: the same verdict data as /check, delivered phase by phase as each is produced instead of after the slowest upstream. The only non-JSON success response in this API.

Authentication is optional. An API key or session cookie is accepted and trusted; an anonymous caller is rate-limited by IP (10/hour). Cache replays are open to everyone. A live run — cold cache miss, or a stale entry due for refresh — is started only for an authenticated caller or an anonymous one presenting the pt token the report page minted; without it, a cold miss answers 429 and a stale entry is served as-is with no refresh. Automation user-agents are treated as untrusted. With an API key this is metered like any /check-family request.

Wire format. Each event is one data: line carrying {"type": "<type>", "data": {…}} followed by a blank line; there are no event: or id: fields. A : keep-alive comment is sent after 15 s of silence. The connection is closed at a 55 s deadline whatever has been emitted.

Event types, in emission order: reputation (may be sent twice — a fast verdict, then a corrected one), basic, insights, enrichment (zero or more frames, one per enrichment facet, then a terminal frame {"enrichmentDone": true, "emitted": [<facet keys>]}), dns, and done ({"timings": {…}}, plus "earlyExit": true when the pipeline stopped early). New types are additive; consumers must ignore unknown ones. The per-event data shapes are owned by the consumer's type file (apps/web/lib/report-stream-types.ts, SSE_EVENT_KEYS) and are not modelled as a schema here.