Time-ordered stream of risk change events for a pool, oldest first: one record per effective-level change detected by a scan (kind=SCAN, escalations and de-escalations included), per enrollment seed (kind=ENROLL), and per baseline move (kind=REBASELINE). Records for removed addresses are excluded. Records become visible a couple of minutes after they are detected; treat change_id as an idempotency key.

Draining the feed: Every non-empty page carries a next_page_token positioned after its last record, so a poller stores that token and resumes from it; an empty page (and its empty token) means you are caught up. Keep the last non-empty token across polls.

since: Optional coarse starting point for ad-hoc queries - records strictly newer than the given time. Records detected in the same write share one timestamp, so a since taken from a record you were served can skip that record's same-timestamp siblings unless you had already drained the feed; page_token is the exact resume position and is used instead of since whenever a non-empty page_token is supplied (an empty page_token counts as absent, so since still filters). A page_token that does not decode to a valid cursor is rejected with 400 rather than silently restarting the feed, and a malformed since is rejected even when a page_token makes it stop filtering.

Pagination: Keyset pagination in detection order. Default 50 items per page, max 1000 (a page_size above the max is clamped to it; a negative page_size is rejected with 400).