> ## Documentation Index > Fetch the complete documentation index at: https://docs.hyperprop.com/llms.txt > Use this file to discover all available pages before exploring further. # Real-time event stream (WebSocket) > Live push of the **same events and payloads** your webhooks receive, over a plain WebSocket. Use it for dashboards, monitoring, or low-latency reactions without hosting a public HTTPS endpoint. **Connect** (same API key as the REST API — no separate credentials): ```javascript const WebSocket = require('ws'); const ws = new WebSocket( 'wss://api.hyperprop.com/platform/v1/organization/events/stream', { headers: { 'X-API-Key': 'hp_live_...' } } ); ws.on('message', (raw) => { const frame = JSON.parse(raw); if (frame.type === 'event') { // frame.event is byte-for-byte the same JSON body a webhook POST carries: // { id, type, createdAt, organizationId, data, previousAttributes, ... } console.log(frame.event.type, frame.event.data.accountNumber); } }); ``` The API key must be sent in the `X-API-Key` header. A key in the URL (`?api_key=` or `?apikey=`) is not accepted: the handshake is refused with `400`. **Frames you receive:** | Frame | Meaning | |-------|---------| | `{ "type": "connected", "organizationId", "serverTime" }` | Sent once after a successful connect | | `{ "type": "event", "event": { ... } }` | A live event — `event` matches the webhook payload schema exactly | | `{ "type": "event.replay", ... }` | Slim catch-up event when you connect with `?since=` (id, eventType, accountId, reason, createdAt) | | `{ "type": "replay.complete", "count", "truncated" }` | Catch-up finished; `truncated: true` means more than 1000 events matched — reconnect with a later `since` | | `{ "type": "pong" }` | Reply to your `{ "type": "ping" }` | **Catch-up after a disconnect:** reconnect with `?since=` (e.g. `?since=2026-07-21T10:00:00Z`) to receive slim replays of events you missed, oldest first, then live events resume. Replay frames carry identifiers only — fetch full account state via `GET /platform/v1/organization/trading-accounts/{id}` if needed. **Delivery guarantees:** on API-key connections, `fill.created` is delivered **at least once while you are connected**, independently of your webhook configuration or webhook endpoint health. A fill can occasionally arrive up to about a minute late, and duplicates are possible — dedupe on `data.orderId`. Fill replay via `?since=` is complete regardless of webhook subscription state. Other event types on the stream are live best-effort with `?since=` catch-up; webhooks remain the durable channel with retries, HMAC signing, and redelivery for anything money-critical. **Keep-alive:** the server pings every 30 seconds; standard WebSocket libraries answer automatically. Idle connections that miss pongs are dropped. You may also send `{"type":"ping"}` and receive `{"type":"pong"}`. **Limits:** maximum 10 concurrent stream connections and 30 new connections per minute per organization. A suspended organization cannot connect. **Authentication:** - **API key** — your organization API key in the `X-API-Key: hp_live_...` header. The header is the only accepted place for the key; a key in the URL is refused with `400`. - **Member session** — a signed-in member of your organization can connect with their session token as `?token=` (browsers cannot set WebSocket headers). A member receives only the events their role may see. **Access:** read-only and full-access API keys. Open to every member of your organization. ## OpenAPI ````yaml https://api.hyperprop.com/platform/openapi.json get /v1/organization/events/stream openapi: 3.0.0 info: title: Hyperprop Platform API version: 1.0.0 description: >- REST API for the Hyperprop Trading Platform — provision evaluation and funded trading accounts, manage traders and plans, react to account lifecycle events via signed webhooks, and reconcile billing. Built for prop firms integrating from their own backend. Authentication, quick start, error handling, idempotency, pagination, custom metadata, webhooks, and the MCP connector are documented at https://docs.hyperprop.com. x-logo: url: https://app.hyperprop.com/logo-icon.svg altText: Hyperprop href: https://hyperprop.com servers: - url: https://api.hyperprop.com/platform description: Production security: [] tags: - name: Trading accounts description: Create, update, and inspect trading accounts. - name: Traders description: Look up and update the traders in your organization. - name: Trading plans description: Define the plans you sell. - name: Trading rules description: Define how accounts are evaluated. - name: Instruments description: >- The contracts your organization's accounts can trade, with their specifications. - name: Lockouts description: Pause and resume trading on an account. - name: Payouts description: Check payout eligibility and record payouts. - name: Purchases description: Purchases recorded for your organization. - name: Time Machine description: Restore accounts to an earlier trading day or instant. - name: Mass credit description: >- Credit back losses across many accounts after an incident, as background jobs you can follow, pause, export and reverse. - name: Webhooks description: Register webhook endpoints and inspect deliveries. - name: Events description: Your organization's event history, to replay or audit what happened. - name: Real-time streams description: >- Live events and trading data over a WebSocket, for dashboards and CRMs that update as things happen. - name: Reconciliation description: Balances, end-of-day snapshots, and fills for reconciliation. - name: Analytics description: Organization performance, revenue and top traders. - name: Risk description: Firm profit and loss and plan economics. - name: Billing and invoices description: >- Your Hyperprop invoices, credits and billing details, with usage so far this month, billing cycles, forecasts and CSV exports. - name: Team and roles description: Manage dashboard access for your staff. - name: API keys description: >- Manage your organization's API keys: rotation, read-only keys and IP allowlists. - name: Logs and health description: >- API request logs, the audit log, integration health, and idempotency key recovery. - name: Organization profile description: Your organization's profile and logo. - name: Support description: Open and follow up on support tickets. - name: Partner access description: >- Read a trader's journal as an approved partner app, with the trader's own key. paths: /v1/organization/events/stream: get: tags: - Real-time streams summary: Real-time event stream (WebSocket) description: >- Live push of the **same events and payloads** your webhooks receive, over a plain WebSocket. Use it for dashboards, monitoring, or low-latency reactions without hosting a public HTTPS endpoint. **Connect** (same API key as the REST API — no separate credentials): ```javascript const WebSocket = require('ws'); const ws = new WebSocket( 'wss://api.hyperprop.com/platform/v1/organization/events/stream', { headers: { 'X-API-Key': 'hp_live_...' } } ); ws.on('message', (raw) => { const frame = JSON.parse(raw); if (frame.type === 'event') { // frame.event is byte-for-byte the same JSON body a webhook POST carries: // { id, type, createdAt, organizationId, data, previousAttributes, ... } console.log(frame.event.type, frame.event.data.accountNumber); } }); ``` The API key must be sent in the `X-API-Key` header. A key in the URL (`?api_key=` or `?apikey=`) is not accepted: the handshake is refused with `400`. **Frames you receive:** | Frame | Meaning | |-------|---------| | `{ "type": "connected", "organizationId", "serverTime" }` | Sent once after a successful connect | | `{ "type": "event", "event": { ... } }` | A live event — `event` matches the webhook payload schema exactly | | `{ "type": "event.replay", ... }` | Slim catch-up event when you connect with `?since=` (id, eventType, accountId, reason, createdAt) | | `{ "type": "replay.complete", "count", "truncated" }` | Catch-up finished; `truncated: true` means more than 1000 events matched — reconnect with a later `since` | | `{ "type": "pong" }` | Reply to your `{ "type": "ping" }` | **Catch-up after a disconnect:** reconnect with `?since=` (e.g. `?since=2026-07-21T10:00:00Z`) to receive slim replays of events you missed, oldest first, then live events resume. Replay frames carry identifiers only — fetch full account state via `GET /platform/v1/organization/trading-accounts/{id}` if needed. **Delivery guarantees:** on API-key connections, `fill.created` is delivered **at least once while you are connected**, independently of your webhook configuration or webhook endpoint health. A fill can occasionally arrive up to about a minute late, and duplicates are possible — dedupe on `data.orderId`. Fill replay via `?since=` is complete regardless of webhook subscription state. Other event types on the stream are live best-effort with `?since=` catch-up; webhooks remain the durable channel with retries, HMAC signing, and redelivery for anything money-critical. **Keep-alive:** the server pings every 30 seconds; standard WebSocket libraries answer automatically. Idle connections that miss pongs are dropped. You may also send `{"type":"ping"}` and receive `{"type":"pong"}`. **Limits:** maximum 10 concurrent stream connections and 30 new connections per minute per organization. A suspended organization cannot connect. **Authentication:** - **API key** — your organization API key in the `X-API-Key: hp_live_...` header. The header is the only accepted place for the key; a key in the URL is refused with `400`. - **Member session** — a signed-in member of your organization can connect with their session token as `?token=` (browsers cannot set WebSocket headers). A member receives only the events their role may see. **Access:** read-only and full-access API keys. Open to every member of your organization. operationId: getV1OrganizationEventsStream responses: '101': description: >- Switching Protocols — the WebSocket handshake succeeded. The first frame is `{ "type": "connected", "organizationId", "serverTime" }`, then `event` frames follow (see notes for the full frame table). '400': description: >- The API key was sent in the URL (`?api_key=` or `?apikey=`). Send it in the `X-API-Key` header. '401': description: Authentication required content: application/json: schema: $ref: '#/components/schemas/Model11' '403': description: The API key may not make this request content: application/json: schema: type: object properties: success: type: boolean description: Always false on errors example: false statusCode: type: integer example: 403 error: type: string example: Forbidden message: type: string example: >- Your role does not have view access to "Traders & accounts" code: type: string description: >- `INSUFFICIENT_PERMISSIONS` = the role or key lacks the permission this endpoint needs; `READ_ONLY_KEY` = a read-only API key sent a request that changes data; `IP_NOT_ALLOWED` = the request came from an address outside the key's IP allowlist; `ORG_INACTIVE` = the organization is not active example: INSUFFICIENT_PERMISSIONS enum: - INSUFFICIENT_PERMISSIONS - READ_ONLY_KEY - IP_NOT_ALLOWED - ORG_INACTIVE '426': description: >- Returned to plain HTTP GETs — connect with a WebSocket client instead content: application/json: schema: $ref: '#/components/schemas/Model454' '429': description: >- Too many concurrent stream connections for this organization (max 10) content: application/json: schema: $ref: '#/components/schemas/Model455' security: - X-API-Key: [] components: schemas: Model11: type: object properties: success: type: boolean description: Always false on errors example: false statusCode: type: number example: 401 error: type: string example: Unauthorized message: type: string example: Authentication required code: type: string description: Machine-readable error code — switch on this, not on message text example: UNAUTHORIZED Model454: type: object properties: success: type: boolean example: false error: $ref: '#/components/schemas/error' Model455: type: object properties: success: type: boolean description: Always false on errors example: false statusCode: type: number example: 429 error: type: string example: Too Many Requests message: type: string example: Maximum 10 concurrent stream connections per organization code: type: string description: Machine-readable error code — switch on this, not on message text example: TOO_MANY_CONNECTIONS error: type: object properties: code: type: string example: UPGRADE_REQUIRED message: type: string example: This endpoint is a WebSocket. Connect with a WebSocket client. securitySchemes: X-API-Key: type: apiKey name: X-API-Key in: header description: >- Organization API key (`hp_live_...`), sent in the `X-API-Key` header. Create, rotate and restrict keys in the dashboard or with the API keys endpoints; an organization can have two active keys, so you can rotate without downtime. A **full-access** key can call every endpoint in this reference. A **read-only** key can call `GET` endpoints (and create a trading stream token); any other request returns `403 READ_ONLY_KEY`. A key with an IP allowlist returns `403 IP_NOT_ALLOWED` from any other address. Each endpoint lists which keys can call it under **Access**. ```` ## Related topics - [Real-time WebSocket for trading events](https://docs.hyperprop.com/trade-api/websocket/real-time-websocket-for-trading-events.md) - [Real-time trading stream](https://docs.hyperprop.com/guides/realtime-trading-stream.md) - [Get open positions with real-time P&L](https://docs.hyperprop.com/trade-api/positions/get-open-positions-with-real-time-p&l.md) - [Build your own CRM on Hyperprop](https://docs.hyperprop.com/guides/build-a-crm.md) - [Webhooks](https://docs.hyperprop.com/guides/webhooks.md) This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.