Even for those kinds of cases I've often found it's simpler to use a standard http API and a websocket notification to tell the client to fetch from the API whe

Even for those kinds of cases I've often found it's simpler to use a standard http API and a websocket notification to tell the client to fetch from the API when something relevant has changed. Then you can leverage all your existing auth and error handling.