Stream

GET with Upgrade: websocket (wss://api.atasumaps.com/v1/stream?key=…). JSON text frames. End-user, partner or passenger-ticket credentials are sent in the first auth frame, never in the URL. Subscribing returns a snapshot and a cursor first; every message carries the entity version; deletions are tombstones; after a gap longer than the replay window the client re-fetches the snapshot. Full protocol: packages/openapi/WEBSOCKET.md. Served today: the public reports and overlay channels. The key (scope realtime, Origin / package restrictions; server keys only in the header) is checked before the upgrade, so a bad key gets a 401 / 403 problem and no WebSocket. fleet / trip subscriptions and pub answer scope_denied until trip tickets exist. Concurrent connections are limited per key by plan, per client address for web keys and per server (decision D36, WEBSOCKET.md §6.1): a refused upgrade completes (101) and is closed at once with code 4429 and {"code":"connection_limit","scope":…,"limit":…,"retry_after":…} as the close reason, because browsers cannot read the status of a refused handshake. 429 below is the per-key request rate limit (rate_limited, Retry-After), not the connection limit.