> ## Documentation Index
> Fetch the complete documentation index at: https://haiprotocol.com/llms.txt
> Use this file to discover all available pages before exploring further.

# HTTP transport and event polling

> Authenticated JSON, stable idempotency keys and advisory event cursors.

HAIP 2 uses JSON over HTTPS. The reference server does not implement HAIP 1 WebSocket, SSE, binary-frame or streaming-chat transports. Their old URLs lead to the [v1 archive](/archive/v1/index).

Machine requests carry `Authorization: Bearer` credentials scoped to a tenant and role. JSON mutations use `Content-Type: application/json`. Creation and other idempotent mutations require a stable `Idempotency-Key`: retry the same logical operation with identical input and the same key. Changed input under that key conflicts.

Bodies are uncompressed UTF-8 JSON. Duplicate keys, invalid Unicode, non-finite values and unsafe precision are refused. The reference implementation enforces separate limits for payloads, documents, responses, bundles and retained data; see [captured limits](/server/configuration).

| Endpoint                        | Meaning                                                                  |
| ------------------------------- | ------------------------------------------------------------------------ |
| `GET /.well-known/haip`         | Advertised revision, profiles, capabilities and notification mode.       |
| `GET /.well-known/haip-trust`   | Signing-key metadata for discovery; not an independent trust root.       |
| `GET /v2/requests/{id}`         | Current scoped request status. A link alone does not authorise the read. |
| `GET /v2/events?after={cursor}` | A bounded page of signed producer events and the next cursor.            |

Persist received events before saving the returned cursor. Events and webhooks can be duplicated or reordered; their revision is a prompt to fetch current status, not authority to confirm or execute. Notification retries stop after the delivery window and never renew review or admission deadlines.

Requests outside a principal's scope are not existence probes. Errors use stable codes and ordinary HTTP statuses; see [errors and retries](/protocol/essentials/error-handling). The [OpenAPI contract](/protocol/openapi) defines the complete request and response shapes.