Reader job: choose a delivery contract your system can operate
Saved monitors, webhook endpoints, subscription changes, secret rotation, tests, and replay policy are configured in the signed-in dashboard. An API key is not the human-authenticated setup credential for those organization changes.
Poll an event subscription safely
data batch with nextCursor, replayCursor, requestId, and traceparent. Record the event ID in the same durable transaction that creates downstream work, then advance the checkpoint. Cursor order is recorded event order, not an SEC filing timestamp. Do not manufacture a checkpoint from array position, wall-clock time, or accession number.
Connect through a ticketed WebSocket
stream_id identifies an active WebSocket stream subscription. Mint a short-lived ticket before connecting so a long-lived API key does not appear in a browser-visible WebSocket URL. Use the REST ticket contract when your application needs to control credential handoff; the JavaScript SDK exposes a subscription-backed filing-stream WebSocket helper.
Treat webhook events as a retrieval trigger
Formonitor.match, verify x-secapi-signature against the exact raw body before parsing JSON. Reject stale timestamps, deduplicate delivery and event IDs, enqueue the work, and return a quick 2xx. Keep monitor ID, event ID, request ID, accession number, and filing URL. Then request the filing or named section before summarizing, classifying, or alerting a user.
Boundaries that belong in production code
- Webhooks can retry and event batches can replay; consumers must be idempotent.
- Delivery does not promise broad SEC filing coverage or current source data for a downstream surface. Inspect the identifiers and timestamps returned with the event.
- A latest-filings poll without
formcan return any filing type. Pin a form family for a focused 10-K, 10-Q, or 8-K workflow. - Do not advance a cursor after partial failure. Preserve
requestIdandtraceparentwhen diagnosing delivery or retrieval errors.

