A local HTTP API plus an event stream lets other programs subscribe to a live without scraping a window. That is the difference between a toy overlay and a maintainable ops stack.
Expose current room state (viewers, uptime, last event time) as a cheap GET. Expose history as a filtered query, not an unbounded dump.
Server-sent events are enough for most overlays. WebSockets are warranted when you need bidirectional control. Start with SSE unless you have a reason.
Bind to localhost by default. If you expose beyond the machine, require a token and TLS at the reverse proxy. “It is only on the LAN” is not an access policy.
Prefix routes with /v1/. Live ops tools get forked by tired people at 1 a.m. Breaking JSON fields without a version is how overlays die mid-show.
One page with example curl calls is more valuable than a generated OpenAPI that nobody opens. Keep the examples accurate when fields change.