API

Dataembed exposes two REST endpoints per webset. Both are cookie-authenticated — they use the same better-auth session cookie as the app, not API keys. There is no token-based public API today.

Access follows one rule everywhere: a webset owned by a user is accessible only with that user's session cookie; a webset created anonymously has no owner and is open to anyone holding its (unguessable) UUID — link-sharing semantics.

Export a webset

GET /api/sessions/{sessionId}/export?format=csv|json

Downloads the full webset as an attachment (webset-<id-prefix>.csv / .json). format defaults to csv.

Error responses are JSON: { "error": "..." }.

CSV shape

One row per result. Columns, in order: URL, Title, one column per enrichment (extracted value or empty), one column per criterion (verdict: match, partial, no_match, needs_review, or empty), and Overall (the row's combined verdict).

JSON shape

{
  "id": "…",
  "query": "the original request",
  "category": "…",
  "status": "completed",
  "createdAt": "…",
  "criteria": [{ "label": "…", "description": "…" }],
  "enrichments": [{ "label": "…", "description": "…", "format": "text" }],
  "results": [
    {
      "url": "…",
      "title": "…",
      "status": "completed",
      "matchVerdict": "match",
      "enrichments": { "Name": "…", "Founded": null },
      "criteria": {
        "HQ in Europe": { "verdict": "match", "evidence": "verbatim quote from the page" }
      }
    }
  ]
}

results[].enrichments maps enrichment label → extracted value (or null). results[].criteria maps criterion label → { verdict, evidence } (or null when not yet evaluated).

Stream run events

GET /api/sessions/{sessionId}/stream?startIndex={n}

An authenticated NDJSON proxy of the webset's eve session event stream (content-type: application/x-ndjson) — one JSON event per line, covering the agent's lifecycle, tool calls, and narration text as the run progresses.

Treat events as doorbells, not data: the stream carries no webset rows, and the event shape is eve-internal rather than a stable contract. The app's own client refetches the session over tRPC whenever an event arrives.

• startIndex is a reconnect cursor. Events are indexed; on reconnect, pass the index after the last event you consumed to resume without replaying.
• Responses stream for up to 5 minutes per connection; reconnect with startIndex to continue following a long run.
• Client disconnects propagate upstream, so closing the connection stops the proxying immediately (the run itself continues server-side).