Endpoint
/v1 prefix; adding it returns 404. No authentication is required, since the order UUID is the credential. A browser EventSource sends an Origin header, and the API answers 500 for any origin outside vane.xyz and localhost, so a page on another domain opens the stream through its own backend.
Contract
Event format
Each transition arrives as oneorders:status-update event:
Event stream
orderId is the order’s UUID, the same value as in the URL, not the numeric id. status is the state the order just entered, message is the fixed label order update, and updatedAt is an ISO 8601 UTC timestamp. The id: line repeats updatedAt in Unix milliseconds, and retry: 5000 tells EventSource to wait 5 seconds before reconnecting. The event name contains a colon, so listen with addEventListener("orders:status-update", ...); onmessage never fires. Amounts and transaction hashes never ride along, so re-fetch the order after each event to read them.
Example
Fetch the order, skip subscribing if it’s already terminal, then open the stream.EventSource reconnects on its own after the 5 second retry delay the events carry. Raw HTTP clients need a loop that reopens the stream whenever it closes; a read timeout of 70 seconds or more is safe, since the server always closes first. Reconnect and poll-fallback patterns, including why you re-fetch after every reconnect, are in Track orders.
