Connection URL
{instance_id} is the computer’s id from Create computer. Its instance id also resolves.
Authentication
Pass the computer’s password as thetoken query parameter. Retrieve it from Get VNC password before connecting.
Always authenticate with the computer password. orgo-web also accepts an API key, sent as Authorization: Bearer $ORGO_API_KEY or as ?token=, but it does not forward the key to the computer. The computer then refuses the stream, and the connection closes with code 1000 right after it opens. An sk_ key in the query string is refused outright, with 4001, for any connection that carries an Origin header.
A connection with no usable credential is closed with code 4001. See Close codes.
Query parameters
string
required
Computer password, from Get VNC password.
Event catalog
Available event types
Watchers run for the life of the computer, independent of any connection. An event describes a change, never current state, so connecting does not replay what you missed.
The catalog, detection, and payloads on this page are a Linux computer’s. A Windows computer emits only
window_focus, clipboard, and file_change. There, window_id is a hexadecimal window handle such as 0x1a2b3c, clipboard carries text and length instead of content and truncated, and file_change carries action (created, deleted, modified, renamed_from, renamed_to, or unknown), path, directory, name, and is_hidden. Windows file_change events are delivered, for the Administrator’s Desktop and Downloads folders.Subscription model
New connections receive no events until they send asubscribe message. This lets you opt in to only the event types you care about, reducing noise and bandwidth.
Subscriptions are:
- Per-connection: each WebSocket connection has its own subscription set
- Additive: subscribe to more types at any time
- Selective: unsubscribe from specific types without disconnecting
Message protocol
Client → server messages
subscribe
subscribe
Start receiving specific event types. Call it as many times as you like to add more.
string
required
Must be
"subscribe".string[]
required
Event type names to add to this connection’s filter. See the event catalog. Names are not validated. See the warning above. Omitting the field adds nothing and still returns
subscribed.unsubscribe
unsubscribe
ping
ping
Ask for a
pong.A frame that parses as JSON but carries an unrecognised
type is discarded silently. You get no reply and no error.Server → client messages
event
event
subscribed
subscribed
Confirmation that your subscription was updated. Sent even when every name you passed was unknown.
unsubscribed
unsubscribed
Confirmation that event types were removed from your subscription.
pong
pong
Response to a
ping.Event data schemas
Each event carries adata object with type-specific fields.
Window events
window_id is the X11 window id as a decimal string, as printed by xdotool. window_name is the X11 window title, as xdotool getwindowname prints it. window_close carries no name. The window is already gone by the time the change is noticed.
Clipboard
string
Clipboard text, trimmed of surrounding whitespace and capped at 1024 bytes.
boolean
true when the real clipboard was longer than 1024 bytes and content holds only its first 1024. Check this before treating content as the whole clipboard.File changes
string
Absolute path of the file that changed.
string
The raw inotify event name in uppercase, for example
CREATE, MODIFY, DELETE, CLOSE_WRITE, MOVED_TO, MOVED_FROM. inotify reports several flags for one change, in which case they arrive comma-joined with no spaces, as in CLOSE_WRITE,CLOSE. Match on substrings rather than on equality./root/Desktop and /root/Downloads, watched recursively. The desktop runs as root, so these are the desktop and downloads folders a user of the computer sees. Detection is via Linux inotify.
Screen
Audio
integer
Number of active PulseAudio streams after the change.
audio_stream_start fires when the count rises, audio_stream_stop when it falls. A second stream starting while one is already playing sends audio_stream_start with count: 2.Process lifecycle
pid is a string, not a number. name is the short command name from ps -eo comm, not a full command line. When that name contains a space, only its first word is sent.
Idle / active
integer
Milliseconds since the last user input, as reported by
xprintidle at the moment the transition was noticed. Present on both events: idle carries the elapsed idle time that crossed the 30-second threshold, and active carries the residual reading at the moment input resumed. There is no idle_seconds field.Examples
Use cases
Agent awareness
Subscribe to
window_focus and idle to give your agent context about what is on screen and when to act.File monitoring
file_change is meant to detect completed downloads and saved documents, but it is not delivered on Linux today. See the warning under File changes.Clipboard sync
Monitor
clipboard to mirror clipboard content between the computer and your application.Process tracking
Use
process_start and process_stop to track application lifecycle: when Chrome launches, when a build finishes.Best practices
Subscribe selectively
Only subscribe to what you need. It reduces message volume and keeps your handler simple.
Heartbeat
Send a
ping every 30 seconds to detect a dead connection early.Handle backpressure
Events are dropped, not queued, for slow consumers. The per-connection buffer is 256 events. Process quickly or offload to a queue.
Reconnection
Reconnect with exponential backoff and re-send your
subscribe message. Subscriptions are per-connection and are not restored.Events require the computer to be running; a stopped computer is closed with code
4003. Unlike the terminal and audio streams, the events stream has no idle timeout, so a long-lived monitoring connection is not disconnected for inactivity.