curl --request GET \
--url https://{host}/api/v1/events \
--header 'Authorization: Bearer <token>'const options = {method: 'GET', headers: {Authorization: 'Bearer <token>'}};
fetch('https://{host}/api/v1/events', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));import requests
url = "https://{host}/api/v1/events"
headers = {"Authorization": "Bearer <token>"}
response = requests.get(url, headers=headers)
print(response.text){
"error": {
"code": "invalid_request",
"message": "<string>"
}
}WebSocket event stream
Upgrade to a WebSocket. Events are filtered by the same scope as REST, so a panel never receives an organisation it could not query. The server pings every 30 seconds; reconnect on close. Events travel through Redis pub/sub, so a panel connected to one instance still sees calls handled by another.
AUTHENTICATION FROM A BROWSER. new WebSocket(url) cannot set headers, so a browser presents its token as a subprotocol instead: new WebSocket(url, ["firetone.bearer." + token]). The server selects and echoes that protocol back. A token in the query string is deliberately NOT accepted — URLs reach access logs, Referer headers and browser history. Any client that can set headers should keep using Authorization: Bearer.
THE STREAM IS BEST-EFFORT AND MUST NOT BE TREATED AS COMPLETE. A client whose buffer is full has events DROPPED rather than queued, so anything driven only by this stream will drift and never recover. Keep a slow poll of the authoritative endpoint alongside it; the stream is a latency optimisation, not a source of truth.
curl --request GET \
--url https://{host}/api/v1/events \
--header 'Authorization: Bearer <token>'const options = {method: 'GET', headers: {Authorization: 'Bearer <token>'}};
fetch('https://{host}/api/v1/events', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));import requests
url = "https://{host}/api/v1/events"
headers = {"Authorization": "Bearer <token>"}
response = requests.get(url, headers=headers)
print(response.text){
"error": {
"code": "invalid_request",
"message": "<string>"
}
}Authorizations
Every request sends Authorization: Bearer <token>. The token is either a panel session (a JWT from /auth/login, 12 hours) or an API key ft_<id>_<secret>. An API key is accepted only from an address on its IP allowlist (403 ip_not_allowed otherwise; 403 ip_allowlist_required for an old key that has none), is limited to its rate per minute (429 rate_limited with Retry-After; X-RateLimit-Limit/Remaining/Reset on every response), and at most 60 call placements a minute.
Response
Switching protocols