# Sync and memory changes

Use `https://api.decoys.me` for HTTP requests. The [MCP quickstart](/docs/memory-quickstart.md) provides seven memory tools. Inspect `tools/list` for exact inputs; enable optional graph tools with `DECOY_MEMORY_GRAPH=true`.

Use the agent Bearer token with `GET /api/agent/sync/head` and `GET /api/agent/sync?cursor=...`. The feed no longer requires `decoy.read`: each bucket follows its own access, so memory-only connections sync memories without account or mail scope.

Memory changes appear as IDs in `context_row.created`, `context_row.updated` and `context_row.destroyed`. Read the current content through `GET /api/agent/context/memories` and decrypt locally. The feed never carries memory text. Old `context_space` events remain relevant only to the migration path.

A memory appears only while the connection can open it. A deleted memory is reported only to former holders. Gaining a usable wrap can surface an existing memory as created for this connection. Do not interpret a newly visible ID as proof the user just wrote it. Narrowing/revocation also require dropping inaccessible local cache entries; a content-only change feed is not the entire authorization state.

Capture the head before fetching the current authorized memory list, then replay from that head and apply changes idempotently. Persist response `state` after applying each page; follow `hasMore`. `cursor=0` is the retained log, not a complete historical export. `400 invalidCursor` needs a valid cursor; `410 cursorTooOld` requires a full resync. Reconcile current visibility after grant changes or uncertain results.

Webhooks `memory.created`, `memory.updated` and `memory.deleted` use the same recipient rule and `account_id: null`. A new owner-shared wrap emits `memory.created` to the newly eligible connection. Verify webhook signatures and refetch authorized content; event IDs are not access grants.

The MCP bridge polls for changes while clients subscribe to `memory://knowledge-graph`. Notifications tell the client to read again, not that every client has received plaintext. Do not promise background monitoring if the integrating runtime cannot stay active.