Realtime
Subscribe to a table's changes over Server-Sent Events, with policy re-checked per event.
Subscribe to a table and receive its changes as they happen, over SSE.
GET /{appUid}/autocrud/{table}/subscribe
Authorization: Bearer <token>The subscription is gated by the same {table}:read_list policy as reading the table — if
you cannot list it, you cannot subscribe to it.
Connecting
SSE here is a normal authenticated request, so read it with an HTTP client that can set an
Authorization header — in the browser that means fetch, not EventSource, which cannot
send one.
# -N disables buffering, so events print as they arrive
curl -N "$AUTHORIC_URL/$APP_UID/autocrud/tickets/subscribe" \
-H "Authorization: Bearer $TOKEN"Policy is re-checked on every event
This is the part worth understanding.
An event is not broadcast because you were allowed to subscribe a minute ago. Each change is re-read as the subscribing principal, with policy and column redaction applied at that moment, and only then delivered.
Why this matters
The common design authorizes the subscription once and streams from then on. Revoke someone's access mid-stream and they keep receiving data. Here, revoking access stops the next event — the write that changes authorization invalidates the cached decision.
A consequence: two subscribers to the same table can legitimately receive different events, and the same event with different columns redacted. That is correct, not a bug.
Reconnecting without gaps
Changes are recorded in an append-only outbox, so a dropped connection does not lose events.
Send the last event id you processed as Last-Event-ID when reconnecting and the stream
resumes from there.
Current limits
Know these before production
Realtime is shipped and in use, but some hardening is not built yet: there are no per-connection caps, no server-side subscription filters (you receive the table's events and filter client-side), no slow-consumer eviction, and outbox pruning is manual. Plan capacity accordingly.
WebSocket transport, broadcast, and presence are planned but not built. This endpoint is SSE only.