Event streams
Klik Račun provides two intentionally separate streams. SSE belongs to the Public API and reports asynchronous operation changes. TLS/TCP is a separately provisioned channel for reliable document synchronization. They do not share an address, credentials, or message format.
SSE - operation changes
The connection requires events:read. Send the bearer token only in the Authorization header; URL tokens are not supported. The stream is bound to the same API client and OIB as every other protected resource.
curl --no-buffer 'https://iiproxy.sekkun.co/public/v1/events' \
--header "Authorization: Bearer $ACCESS_TOKEN" \
--header "Last-Event-ID: $LAST_EVENT_ID"
Omit Last-Event-ID on the first connection. The server establishes a cursor at the current position and first sends stream.ready. It then sends only newer changes:
retry: 3000
event: stream.ready
data: {"type":"stream.ready","transport":"SSE","cursor":null}
id: eyJ1cGRhdGVkQXQiOiIuLi4ifQ
event: operation.updated
data: {"type":"operation.updated","at":"2026-09-27T10:00:00.000Z","operation":{"operationId":"...","kind":"ISSUE","status":"ISSUED"}}
Treat id as opaque. Persist it only after the complete event has been processed successfully. Send it as Last-Event-ID after a disconnect; Klik Račun then replays later changes in stored order. Do not parse or construct cursor values.
| Event | Meaning |
|---|---|
stream.ready | Authentication succeeded and the starting position is set |
operation.updated | An operation owned by this client changed |
stream.closed | The token or permission was revoked while connected; do not reconnect automatically |
stream.error | Temporary stream failure; reconnect with the last processed id |
The server sends comment lines to keep the connection alive. Ignore lines beginning with a colon. Authorization is revalidated while connected, so client deactivation or secret rotation closes the stream.
The standard browser EventSource API cannot set an Authorization header. This stream is for server-side clients that can send the bearer header. Never move the token into the URL query string.
GET /public/v1/operations/{operationId} remains the safe polling fallback for one operation.
TLS/TCP - document synchronization
The TCP channel is not a REST route under https://iiproxy.sekkun.co/public/v1. It is enabled through separate provisioning. Klik Račun then issues the host, port, instance ID, and credential; a client certificate may also be required.
The channel uses TLS 1.3 and newline-delimited JSON frames. The first frame must arrive within ten seconds:
{"v":1,"type":"authenticate","instanceId":"erp-prod-1","credential":"issued-secret","resumeAfter":1842}
The server restricts delivery to OIBs assigned to that instance and revalidates authorization while connected. resumeAfter cannot skip beyond the last durably acknowledged position.
{"v":1,"type":"ready","sessionId":"...","resumeAfter":1842,"heartbeatSeconds":30}
{"v":1,"type":"event","sequence":1843,"event":{"id":"...","type":"DOCUMENT_RECORDED","at":"...","document":{}}}
{"v":1,"type":"acknowledge","sequence":1843}
{"v":1,"type":"acknowledged","sequence":1843}
Acknowledge only fully and durably processed messages. After reconnecting, the server replays events following the last acknowledged sequence. ping receives pong.
Document payloads are not pushed automatically with every notification. An authorized client requests one with fetch-payload; the response uses Base64 payload chunks with a SHA-256 digest and ends with payload-complete. Payload access is again restricted by the allowed OIB list.
| Property | SSE | TLS/TCP |
|---|---|---|
| Purpose | Public API operation changes | Document synchronization and controlled payload retrieval |
| Access | OAuth bearer token and events:read | Issued instance credential, with mTLS when required |
| Resume | Last-Event-ID | resumeAfter plus durable acknowledge |
| Address | /public/v1/events | Separately issued TLS host and port |