Stream recipient-scoped durable notification changes

GET 
/api/v1/notifications/stream

Authenticate with the same-origin HttpOnly cookie or an ordinary Authorization bearer session on fetch; credentials never belong in the URL. Personal access tokens use the polling endpoints instead, because this stream continually revalidates a rotating session without retaining a raw bearer. Supply a cursor in at most one of the cursor query parameter or Last-Event-ID header. With no cursor the stream starts at the current tail and emits ready. Each notification_changes event contains at most 50 ordered changes and its id is the next durable cursor. Missing retained history emits resync_required and closes. The server sends keepalive comments, revalidates authorization, limits concurrent streams, and relies on client polling as a lossless fallback.

Request

Responses

200

SSE stream using 15-second keepalive comments and a 3-second reconnect hint

400

The multipart shape or Idempotency-Key is malformed

401

The opaque credential is absent, ambiguous, malformed, expired, revoked, or invalid

403

The browser mutation did not originate from this application, or the authenticated member lacks the required permission

429

The bounded stream concurrency budget is exhausted; poll with backoff