Skip to main content
Subscribe to real-time desktop events over WebSocket. Window focus changes, clipboard updates, process lifecycle, screen resolution changes, and idle/active state are pushed to your client as they happen. File change events are defined but not delivered on Linux today; see File changes.

Connection URL

{instance_id} is the computer’s id from Create computer. Its instance id also resolves.

Authentication

Pass the computer’s password as the token query parameter. Retrieve it from Get VNC password before connecting. Always authenticate with the computer password. orgo-web also accepts an API key, sent as Authorization: Bearer $ORGO_API_KEY or as ?token=, but it does not forward the key to the computer. The computer then refuses the stream, and the connection closes with code 1000 right after it opens. An sk_ key in the query string is refused outright, with 4001, for any connection that carries an Origin header. A connection with no usable credential is closed with code 4001. See Close codes.

Query parameters

string
required
Computer password, from Get VNC password.

Event catalog

Available event types

Watchers run for the life of the computer, independent of any connection. An event describes a change, never current state, so connecting does not replay what you missed.
The catalog, detection, and payloads on this page are a Linux computer’s. A Windows computer emits only window_focus, clipboard, and file_change. There, window_id is a hexadecimal window handle such as 0x1a2b3c, clipboard carries text and length instead of content and truncated, and file_change carries action (created, deleted, modified, renamed_from, renamed_to, or unknown), path, directory, name, and is_hidden. Windows file_change events are delivered, for the Administrator’s Desktop and Downloads folders.

Subscription model

New connections receive no events until they send a subscribe message. This lets you opt in to only the event types you care about, reducing noise and bandwidth. Subscriptions are:
  • Per-connection: each WebSocket connection has its own subscription set
  • Additive: subscribe to more types at any time
  • Selective: unsubscribe from specific types without disconnecting
Event type names are not validated. Subscribing to a name that does not exist, such as a typo or a type from a newer version, returns subscribed / ok and then silently delivers nothing. Check your names against the catalog.

Message protocol

Client → server messages

Start receiving specific event types. Call it as many times as you like to add more.
string
required
Must be "subscribe".
string[]
required
Event type names to add to this connection’s filter. See the event catalog. Names are not validated. See the warning above. Omitting the field adds nothing and still returns subscribed.
Stop receiving specific event types.
string
required
Must be "unsubscribe".
string[]
required
Event type names to remove from this connection’s filter. Names not currently subscribed are ignored.
Ask for a pong.
A frame that parses as JSON but carries an unrecognised type is discarded silently. You get no reply and no error.

Server → client messages

A desktop event matching one of your subscribed types.
string
Always "event".
object
The event payload.
string
Event type name, for example "window_focus" or "clipboard".
string
ISO 8601 timestamp of when the event was published.
object
Event-specific data. See Event data schemas below.
Confirmation that your subscription was updated. Sent even when every name you passed was unknown.
Confirmation that event types were removed from your subscription.
Response to a ping.
Your last frame was not valid JSON. This is the only error this endpoint sends, and the connection stays open.
string
Always "error".
string
Always "invalid JSON".

Event data schemas

Each event carries a data object with type-specific fields.

Window events

window_id is the X11 window id as a decimal string, as printed by xdotool. window_name is the X11 window title, as xdotool getwindowname prints it. window_close carries no name. The window is already gone by the time the change is noticed.

Clipboard

string
Clipboard text, trimmed of surrounding whitespace and capped at 1024 bytes.
boolean
true when the real clipboard was longer than 1024 bytes and content holds only its first 1024. Check this before treating content as the whole clipboard.

File changes

string
Absolute path of the file that changed.
string
The raw inotify event name in uppercase, for example CREATE, MODIFY, DELETE, CLOSE_WRITE, MOVED_TO, MOVED_FROM. inotify reports several flags for one change, in which case they arrive comma-joined with no spaces, as in CLOSE_WRITE,CLOSE. Match on substrings rather than on equality.
Monitored directories are /root/Desktop and /root/Downloads, watched recursively. The desktop runs as root, so these are the desktop and downloads folders a user of the computer sees. Detection is via Linux inotify.
On Linux, file_change events are not delivered today. The computer buffers the watcher’s output until the watcher exits, and it never exits, so a file_change subscription receives nothing. To detect a finished download, poll the directory with Execute bash instead.

Screen

Audio

integer
Number of active PulseAudio streams after the change. audio_stream_start fires when the count rises, audio_stream_stop when it falls. A second stream starting while one is already playing sends audio_stream_start with count: 2.

Process lifecycle

pid is a string, not a number. name is the short command name from ps -eo comm, not a full command line. When that name contains a space, only its first word is sent.

Idle / active

integer
Milliseconds since the last user input, as reported by xprintidle at the moment the transition was noticed. Present on both events: idle carries the elapsed idle time that crossed the 30-second threshold, and active carries the residual reading at the moment input resumed. There is no idle_seconds field.

Examples

Use cases

Agent awareness

Subscribe to window_focus and idle to give your agent context about what is on screen and when to act.

File monitoring

file_change is meant to detect completed downloads and saved documents, but it is not delivered on Linux today. See the warning under File changes.

Clipboard sync

Monitor clipboard to mirror clipboard content between the computer and your application.

Process tracking

Use process_start and process_stop to track application lifecycle: when Chrome launches, when a build finishes.

Best practices

Subscribe selectively

Only subscribe to what you need. It reduces message volume and keeps your handler simple.

Heartbeat

Send a ping every 30 seconds to detect a dead connection early.

Handle backpressure

Events are dropped, not queued, for slow consumers. The per-connection buffer is 256 events. Process quickly or offload to a queue.

Reconnection

Reconnect with exponential backoff and re-send your subscribe message. Subscriptions are per-connection and are not restored.
Events require the computer to be running; a stopped computer is closed with code 4003. Unlike the terminal and audio streams, the events stream has no idle timeout, so a long-lived monitoring connection is not disconnected for inactivity.

Close codes