GET /search/{id}/stream to follow search execution in real time.
Concrete stream example
Run this against an existingSEARCH_ID:
Event types
connected
Sent immediately after the SSE connection is established.
module.result
Sent when one module emits a result card.
search_id: search UUIDmodule.id: module identifier when availablemodule.name: module display namecard: raw card payloadtimestamp: event time
search.progress
Sent during orchestration and shard execution.
status:queuedorrunningmessage: human-readable progress (for example capacity waits or shard progress)result_cards_count: optional running count
byok.result
Sent when a BYOK provider emits one raw card event.
provider:osint_industriesorsherlockeyecard: provider-emitted card payload
byok.finished
Sent once per provider when provider execution completes.
status values:
successno_resultsfailed
search.finished
Sent when the search reaches a terminal state.
status:
completedfailed
totals.module_resultsexecution_time_mserror
leak.status
Sent for each leak source as it executes.
leaks.finished
Sent when all leak providers have finished or been skipped.
registered_accounts
Sent during registered-account checks.
breached_accounts
Sent when breached-account aggregation is ready.
Sharding model
For module execution, the orchestrator can split selected modules into shards and run them across multiple runners.- Max shard count is currently
3 - Shards are assigned from runner capacity snapshots
- If all runners are saturated, periodic
search.progressevents report waiting status - When capacity returns, execution resumes and progress messages include shard ratios (for example
shard 2/3 progress 9/12)
Resume and reconnection
Streams support resuming from an index:- Query params:
start_index,cursor, orfrom - Header:
Last-Event-ID
id: field. Store the last received id and reconnect from it after disconnects.
Notes
- Keep the connection open until
search.finished - The stream is additive: fetch
GET /search/{id}/resultsfor the normalized final payload - Leak results are retrieved separately through
GET /search/{id}/results/leaks