WebSocket streaming (search & delta)

Quick Search and Deep Research can be run over a WebSocket to receive live, streamed results (investigation steps, progress, and the answer token by token) instead of waiting for one HTTP response. Delta (multi-file comparison) streams the same way.

These endpoints need a signed-in console session, not an API key. They authenticate with the session token the console holds, and an API_KEY header is refused with a 403. This page documents the protocol the console uses; it isn’t currently callable from an API-key integration.
If you’re integrating over the API, run the same searches over HTTP (POST /api/v1/files/{fileId}/searches/quick or /deep, see the quickstart) and use webhooks to be told when a long investigation finishes.

Connecting

Open a WebSocket to one of:

Endpoint	Purpose
`GET /ws/v1/search/quick`	Streamed Quick Search
`GET /ws/v1/search/deep`	Streamed Deep Research
`GET /ws/v1/delta/quick`	Streamed Delta quick comparison
`GET /ws/v1/delta/research`	Streamed Delta deep comparison

Authenticate with a short-lived JWT as the token query parameter (API keys are header-only and not accepted in a URL, see Authentication):

wss://api.logcat.ai/ws/v1/search/deep?token=<jwt>

Sending the request

After the socket opens, send one JSON frame describing what to investigate:

{
  "query": "Why did this device reboot during video playback?",
  "entity_type": "bugreport",
  "entity_id": "a1b2c3d4-..."
}

entity_id is the file (or bundle/delta) id you’re investigating, and entity_type says what kind of thing it is.

You don’t have to work entity_type out yourself: send back the file_type that GET /api/v1/files/{fileId} returned for that file. The platform classifies every upload on ingest, and the value it reports is the value this frame expects.

The full set:

`entity_type`	The file it belongs to
`bugreport`	An Android bugreport
`logcat`	A logcat capture
`dmesg`	A kernel log
`log`	Any other text log: syslog, journalctl, candump, and most vendor text exports
`perfetto`	A Perfetto trace
`pcap`	A network capture (pcap/pcapng, btsnoop)
`ramdump`	A kernel ramdump
`config`	A device or network config file
`bundle`	A multi-file archive, searched across all its files

Any other value is rejected.

Receiving the stream

The server streams back a sequence of JSON messages, each of the shape:

{ "type": "<message-type>", "data": { ... }, "error": null }

type is one of seven values:

Type	Meaning
`step`	An investigation step the agent took (Deep Research).
`stage`	A high-level pipeline stage transition.
`progress`	Incremental progress update.
`query_intent`	The interpreted intent / plan for a query.
`report_chunk`	A chunk of the final answer, streamed as it’s generated.
`complete`	The stream is finished; the full result is available.
`error`	Something failed; `error` carries the detail.

Concatenate report_chunk payloads to assemble the final answer as it streams. Stop on complete (success) or error (failure).

Next steps

API quickstart: the non-streaming HTTP search equivalents.
Webhooks: get told when an investigation finishes, without holding a connection open.