Receive versioned Live events
Required scopes: live.get.
Bearer-only operator long polling for organization service tokens or owner-only finite personal/delegated OAuth tokens. Omit after for an immediate live.snapshot. Supply the previous cursor for a current live.changed snapshot or a stream.heartbeat with null data if unchanged by the wait deadline (0-25 seconds, default 25). A cursor compares current state; arbitrary valid or old cursors return a current snapshot, never history. Notifications coalesce and may be missed; each recheck reads current authorized state. Reconnect without after to resynchronize. Shared operator watch limit 50 per Live, distinct from audience membership and seat budgets; exhaustion 409. Original service secret hash/expiry, personal credential or OAuth grant, current scopes, ownership and processing policy are rechecked after waits and before every successful delayed response. Secret rotation/revocation/expiry returns 401; removed scopes or processing restrictions 403; missing/moved/deleted resources 404 (an already-revoked watch may return 403). Dependency/revocation-listener failure returns 503. Idle checks use the existing stream authorization cadence (5 seconds by default), capped by the poll deadline. Changes can return before that deadline. Existing HTTP request/peer/principal and stream admission budgets apply; every new poll is charged. No cookies, query-string credentials, audience secrets or Idempotency-Key. No replay log, exactly-once guarantee, SSE/WebSocket upgrade or new CORS policy. Design revisions can change the cursor while sequence is unchanged.
Authentication
Organization-owned service token. Issue the initial token in organization credential settings. Scopes are documented per operation via x-required-scopes; they are not OAuth scopes.
Personal bearer credential issued through existing account settings or browser-approved CLI flow. Must be active, finite, unexpired, unrevoked, within any rotation overlap, and bound to an active personal membership/user/account. Explicit scopes intersect current user permissions; empty existing personal scopes inherit current user authority. Not an OAuth grant or service token. Browser cookies are ignored.
Registered public-client OAuth for personal-account resources only. Exact registered HTTPS or fixed-port literal loopback redirect; S256 required; explicit consent. No organization/presentation authority. identity.read is required for /me and account metadata. Scope intersection with current user authority; no empty-scope inheritance.
Path parameters
Query parameters
Maximum intended idle wait in seconds. Dependency/actor queue delays may add normal request latency; clients should allow timeout margin.
Response headers
Response
Versioned snapshot, changed snapshot or null-data heartbeat. Always private no-store. Event cursors are not HTTP ETags.