Real-time event stream (WebSocket)
Live push of the same events and payloads your webhooks receive, over a plain WebSocket. Use it for dashboards, monitoring, or low-latency reactions without hosting a public HTTPS endpoint.
Connect (same API key as the REST API — no separate credentials):
const WebSocket = require('ws');
const ws = new WebSocket(
'wss://api.hyperprop.com/platform/v1/organization/events/stream',
{ headers: { 'X-API-Key': 'hp_live_...' } }
);
ws.on('message', (raw) => {
const frame = JSON.parse(raw);
if (frame.type === 'event') {
// frame.event is byte-for-byte the same JSON body a webhook POST carries:
// { id, type, createdAt, organizationId, data, previousAttributes, ... }
console.log(frame.event.type, frame.event.data.accountNumber);
}
});
The API key must be sent in the X-API-Key header. A key in the URL (?api_key= or ?apikey=) is not accepted: the handshake is refused with 400.
Frames you receive:
| Frame | Meaning |
|---|---|
{ "type": "connected", "organizationId", "serverTime" } | Sent once after a successful connect |
{ "type": "event", "event": { ... } } | A live event — event matches the webhook payload schema exactly |
{ "type": "event.replay", ... } | Slim catch-up event when you connect with ?since= (id, eventType, accountId, reason, createdAt) |
{ "type": "replay.complete", "count", "truncated" } | Catch-up finished; truncated: true means more than 1000 events matched — reconnect with a later since |
{ "type": "pong" } | Reply to your { "type": "ping" } |
Catch-up after a disconnect: reconnect with ?since=<ISO timestamp> (e.g. ?since=2026-07-21T10:00:00Z) to receive slim replays of events you missed, oldest first, then live events resume. Replay frames carry identifiers only — fetch full account state via GET /platform/v1/organization/trading-accounts/{id} if needed.
Delivery guarantees: on API-key connections, fill.created is delivered at least once while you are connected, independently of your webhook configuration or webhook endpoint health. A fill can occasionally arrive up to about a minute late, and duplicates are possible — dedupe on data.orderId. Fill replay via ?since= is complete regardless of webhook subscription state. Other event types on the stream are live best-effort with ?since= catch-up; webhooks remain the durable channel with retries, HMAC signing, and redelivery for anything money-critical.
Keep-alive: the server pings every 30 seconds; standard WebSocket libraries answer automatically. Idle connections that miss pongs are dropped. You may also send {"type":"ping"} and receive {"type":"pong"}.
Limits: maximum 10 concurrent stream connections and 30 new connections per minute per organization. A suspended organization cannot connect.
Authentication:
- API key — your organization API key in the
X-API-Key: hp_live_...header. The header is the only accepted place for the key; a key in the URL is refused with400. - Member session — a signed-in member of your organization can connect with their session token as
?token=<token>(browsers cannot set WebSocket headers). A member receives only the events their role may see.
Access: read-only and full-access API keys. Open to every member of your organization.
curl --request GET \
--url https://api.hyperprop.com/platform/v1/organization/events/stream \
--header 'X-API-Key: <api-key>'import requests
url = "https://api.hyperprop.com/platform/v1/organization/events/stream"
headers = {"X-API-Key": "<api-key>"}
response = requests.get(url, headers=headers)
print(response.text)const options = {method: 'GET', headers: {'X-API-Key': '<api-key>'}};
fetch('https://api.hyperprop.com/platform/v1/organization/events/stream', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://api.hyperprop.com/platform/v1/organization/events/stream",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "GET",
CURLOPT_HTTPHEADER => [
"X-API-Key: <api-key>"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"net/http"
"io"
)
func main() {
url := "https://api.hyperprop.com/platform/v1/organization/events/stream"
req, _ := http.NewRequest("GET", url, nil)
req.Header.Add("X-API-Key", "<api-key>")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.get("https://api.hyperprop.com/platform/v1/organization/events/stream")
.header("X-API-Key", "<api-key>")
.asString();require 'uri'
require 'net/http'
url = URI("https://api.hyperprop.com/platform/v1/organization/events/stream")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Get.new(url)
request["X-API-Key"] = '<api-key>'
response = http.request(request)
puts response.read_body{
"success": false,
"statusCode": 401,
"error": "Unauthorized",
"message": "Authentication required",
"code": "UNAUTHORIZED"
}{
"success": false,
"statusCode": 403,
"error": "Forbidden",
"message": "Your role does not have view access to \"Traders & accounts\"",
"code": "INSUFFICIENT_PERMISSIONS"
}{
"success": false,
"error": {
"code": "UPGRADE_REQUIRED",
"message": "This endpoint is a WebSocket. Connect with a WebSocket client."
}
}{
"success": false,
"statusCode": 429,
"error": "Too Many Requests",
"message": "Maximum 10 concurrent stream connections per organization",
"code": "TOO_MANY_CONNECTIONS"
}Authorizations
Organization API key (hp_live_...), sent in the X-API-Key header. Create, rotate and restrict keys in the dashboard or with the API keys endpoints; an organization can have two active keys, so you can rotate without downtime. A full-access key can call every endpoint in this reference. A read-only key can call GET endpoints (and create a trading stream token); any other request returns 403 READ_ONLY_KEY. A key with an IP allowlist returns 403 IP_NOT_ALLOWED from any other address. Each endpoint lists which keys can call it under Access.
Response
Switching Protocols — the WebSocket handshake succeeded. The first frame is { "type": "connected", "organizationId", "serverTime" }, then event frames follow (see notes for the full frame table).
curl --request GET \
--url https://api.hyperprop.com/platform/v1/organization/events/stream \
--header 'X-API-Key: <api-key>'import requests
url = "https://api.hyperprop.com/platform/v1/organization/events/stream"
headers = {"X-API-Key": "<api-key>"}
response = requests.get(url, headers=headers)
print(response.text)const options = {method: 'GET', headers: {'X-API-Key': '<api-key>'}};
fetch('https://api.hyperprop.com/platform/v1/organization/events/stream', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://api.hyperprop.com/platform/v1/organization/events/stream",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "GET",
CURLOPT_HTTPHEADER => [
"X-API-Key: <api-key>"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"net/http"
"io"
)
func main() {
url := "https://api.hyperprop.com/platform/v1/organization/events/stream"
req, _ := http.NewRequest("GET", url, nil)
req.Header.Add("X-API-Key", "<api-key>")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.get("https://api.hyperprop.com/platform/v1/organization/events/stream")
.header("X-API-Key", "<api-key>")
.asString();require 'uri'
require 'net/http'
url = URI("https://api.hyperprop.com/platform/v1/organization/events/stream")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Get.new(url)
request["X-API-Key"] = '<api-key>'
response = http.request(request)
puts response.read_body{
"success": false,
"statusCode": 401,
"error": "Unauthorized",
"message": "Authentication required",
"code": "UNAUTHORIZED"
}{
"success": false,
"statusCode": 403,
"error": "Forbidden",
"message": "Your role does not have view access to \"Traders & accounts\"",
"code": "INSUFFICIENT_PERMISSIONS"
}{
"success": false,
"error": {
"code": "UPGRADE_REQUIRED",
"message": "This endpoint is a WebSocket. Connect with a WebSocket client."
}
}{
"success": false,
"statusCode": 429,
"error": "Too Many Requests",
"message": "Maximum 10 concurrent stream connections per organization",
"code": "TOO_MANY_CONNECTIONS"
}