Runs

Stream run events

Returns server-sent events. Each data field contains a RunEvent object; event matches its type, and id identifies the event. Progress and tool events include a summary. Vulnerability events identify the vulnerability; status events identify the run’s state.

The connection replays retained events and then streams new ones. It closes after the run reaches stopped, completed, or failed. To reconnect, send the last received event ID in Last-Event-ID. Only later events are replayed. Reopen the stream after resuming or steering a completed run. An unknown event ID returns 400.

Every JSON payload has id, runId, type, summary, and createdAt. Additional fields depend on type:

Type	Additional fields
progress	None
tool	None
vulnerability	vulnerabilityId
status	status: creating, running, stopped, completed, or failed
error	code

The SDK exposes this stream through the Run object’s async iterator.

GET

runs

{id}

events

Stream run events

curl --request GET \
  --url https://api.antigen.sh/v1/runs/{id}/events \
  --header 'x-api-key: <api-key>'

const options = {method: 'GET', headers: {'x-api-key': '<api-key>'}};

fetch('https://api.antigen.sh/v1/runs/{id}/events', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

<?php

$curl = curl_init();

curl_setopt_array($curl, [
  CURLOPT_URL => "https://api.antigen.sh/v1/runs/{id}/events",
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_ENCODING => "",
  CURLOPT_MAXREDIRS => 10,
  CURLOPT_TIMEOUT => 30,
  CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
  CURLOPT_CUSTOMREQUEST => "GET",
  CURLOPT_HTTPHEADER => [
    "x-api-key: <api-key>"
  ],
]);

$response = curl_exec($curl);
$err = curl_error($curl);

curl_close($curl);

if ($err) {
  echo "cURL Error #:" . $err;
} else {
  echo $response;
}

package main

import (
	"fmt"
	"net/http"
	"io"
)

func main() {

	url := "https://api.antigen.sh/v1/runs/{id}/events"

	req, _ := http.NewRequest("GET", url, nil)

	req.Header.Add("x-api-key", "<api-key>")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(string(body))

}

require 'uri'
require 'net/http'

url = URI("https://api.antigen.sh/v1/runs/{id}/events")

http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true

request = Net::HTTP::Get.new(url)
request["x-api-key"] = '<api-key>'

response = http.request(request)
puts response.read_body

"id: event_123\nevent: progress\ndata: {\"id\":\"event_123\",\"runId\":\"run_123\",\"type\":\"progress\",\"summary\":\"Investigating invoice ownership checks.\",\"createdAt\":\"2026-09-13T10:00:00Z\"}\n\n"

{
  "error": {
    "code": "invalid_request",
    "message": "Check the request fields and values."
  }
}

{
  "error": {
    "code": "unauthorized",
    "message": "Supply a valid API key."
  }
}

{
  "error": {
    "code": "forbidden",
    "message": "The API key does not permit this operation or requested scope."
  }
}

{
  "error": {
    "code": "not_found",
    "message": "The resource does not exist in this organization."
  }
}

{
  "error": {
    "code": "rate_limited",
    "message": "Retry after the interval in Retry-After."
  }
}

Authorizations

x-api-key

string

header

required

API key from your organization. Supply the value directly, without a Bearer prefix.

Headers

Last-Event-ID

string

Resume after this event from the same run.

Path Parameters

string

required

Opaque resource identifier.

Minimum string length: 1

Response

Successful response.

Server-sent events. JSON data conforms to the RunEvent schema.

Stream run events

curl --request GET \
  --url https://api.antigen.sh/v1/runs/{id}/events \
  --header 'x-api-key: <api-key>'

const options = {method: 'GET', headers: {'x-api-key': '<api-key>'}};

fetch('https://api.antigen.sh/v1/runs/{id}/events', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

<?php

$curl = curl_init();

curl_setopt_array($curl, [
  CURLOPT_URL => "https://api.antigen.sh/v1/runs/{id}/events",
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_ENCODING => "",
  CURLOPT_MAXREDIRS => 10,
  CURLOPT_TIMEOUT => 30,
  CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
  CURLOPT_CUSTOMREQUEST => "GET",
  CURLOPT_HTTPHEADER => [
    "x-api-key: <api-key>"
  ],
]);

$response = curl_exec($curl);
$err = curl_error($curl);

curl_close($curl);

if ($err) {
  echo "cURL Error #:" . $err;
} else {
  echo $response;
}

package main

import (
	"fmt"
	"net/http"
	"io"
)

func main() {

	url := "https://api.antigen.sh/v1/runs/{id}/events"

	req, _ := http.NewRequest("GET", url, nil)

	req.Header.Add("x-api-key", "<api-key>")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(string(body))

}

require 'uri'
require 'net/http'

url = URI("https://api.antigen.sh/v1/runs/{id}/events")

http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true

request = Net::HTTP::Get.new(url)
request["x-api-key"] = '<api-key>'

response = http.request(request)
puts response.read_body

"id: event_123\nevent: progress\ndata: {\"id\":\"event_123\",\"runId\":\"run_123\",\"type\":\"progress\",\"summary\":\"Investigating invoice ownership checks.\",\"createdAt\":\"2026-09-13T10:00:00Z\"}\n\n"

{
  "error": {
    "code": "invalid_request",
    "message": "Check the request fields and values."
  }
}

{
  "error": {
    "code": "unauthorized",
    "message": "Supply a valid API key."
  }
}

{
  "error": {
    "code": "forbidden",
    "message": "The API key does not permit this operation or requested scope."
  }
}

{
  "error": {
    "code": "not_found",
    "message": "The resource does not exist in this organization."
  }
}

{
  "error": {
    "code": "rate_limited",
    "message": "Retry after the interval in Retry-After."
  }
}

Getting started

Endpoints

Stream run events

Authorizations

Headers

Path Parameters

Response