Record federated privacy incident

POST

/v1/actions/hospitality.action.record_federated_privacy_incident/apply

curl --request POST \
  --url https://api.aerandil.com/v1/actions/hospitality.action.record_federated_privacy_incident/apply \
  --header 'Authorization: Bearer <token>' \
  --header 'Content-Type: application/json' \
  --data '{ "branch": "2489E9AD-2EE2-8E00-8EC9-32D5F69181C0", "params": { "description": "example", "external_incident_reference": "example", "immediate_actions": "example", "incident_kind": "disclosure_control_failure", "pause_program": true, "severity": "informational", "target_object_id": "example", "target_object_type": "example" }, "return_modified": false, "target": { "id": "2489E9AD-2EE2-8E00-8EC9-32D5F69181C0", "object_type": "hospitality.federated_intelligence_program" } }'

• Production API

Record a privacy, security, or disclosure-control incident related to a program, run, contribution, or output. The handler appends an incident event, optionally quarantines outputs, and optionally pauses the program. Per proposal §8.13, the action creates the durable evidence trail but the remediation gate is opened separately through proposal 0020 approval gates.

Effects: modify hospitality.federated_intelligence_program.

Authorizations

• aerandil_oauth
  actions:apply
• aerandil_oauth
  actions:hospitality.action.record_federated_privacy_incident:apply

Request Body^required

Media typeapplication/json

object

branch

Apply against an open branch’s overlay view instead of the canonical (main) plane. The action’s writes land in the branch’s copy-on-first-write overlay, its events in the branch’s own stream, and the invocation is journaled for merge-by-replay. Branch writes are action-only, so this is the write-side entry point to a branch (POST /v1/branches forks one).

string format: uuid

params

required

object

description

required

Bounded text

string

external_incident_reference

External incident ref

string

immediate_actions

Bounded text describing immediate response (e.g. paused program X, quarantined output Y)

string

incident_kind

required

Incident kind

string

Allowed values: disclosure_control_failure small_cohort_singling_out max_contributor_share_breach differencing_attack_suspected model_inversion_suspected membership_inference_suspected secure_aggregation_protocol_failure data_quality_poisoning_suspected legal_basis_change output_inference_attack other_reviewed

pause_program

If true, transitions program status to paused

boolean

severity

required

informational | low | medium | high | critical

string

Allowed values: informational low medium high critical

target_object_id

required

Target object id

string

target_object_type

required

Program / run / contribution / output

string

return_modified

When true, the response carries modified_objects and modified_links projections — the engine reads the event log inside the same transaction so the projection observes the handler’s own writes.

boolean

target

required

object

id

required

string format: uuid

object_type

required

Allowed value: hospitality.federated_intelligence_program

Responses

200

Action applied. modified_objects and modified_links populated when return_modified: true was supplied.

Media typeapplication/json

ApplyActionResponse

Envelope returned by the Aerandil action engine. correlation_id ties every event emitted by this invocation; modified_objects and modified_links project the events the handler emitted (per the action’s declared effects); warnings carries any non-blocking soft-validator observations.

object

correlation_id

required

Per-invocation correlation id; matches events.correlation_id for every event this action appended.

string format: uuid

modified_links

required

Links established or removed by this invocation. Empty when the caller did not request return_modified.

Array<object>

object

from_id

required

string format: uuid

from_type

required

string

kind

required

Allowed values: linked unlinked properties_updated end_dated

link_type

required

string

to_id

required

string format: uuid

to_type

required

string

modified_objects

required

Objects created, modified, or soft-deleted by this invocation. Empty when the caller did not request return_modified.

Array<object>

object

id

required

string format: uuid

kind

required

Allowed values: modified

object_type

required

Allowed values: hospitality.federated_intelligence_program

warnings

Non-blocking soft-validator observations emitted during this invocation (e.g. comp-authority over-limit, recipe pour-cost over sell-price). Absent when no warnings were emitted.

Array<object>

object

message

required

Human-readable summary, suitable for logging or operator-UI surfacing.

string

object_type

required

Object type the warning was raised against.

string

property

Property the warning anchors to, when a single field is the locus. Absent for multi-field rules.

string

rule

required

Stable kebab-case rule identifier (e.g. comp-authority-over-limit).

string

Example

{
  "modified_links": [
    {
      "kind": "linked"
    }
  ],
  "modified_objects": [
    {
      "kind": "modified",
      "object_type": "hospitality.federated_intelligence_program"
    }
  ]
}

409

Conflict — concurrent modification or unique constraint violation.

422

Validation error — parameter validation or business-rule violation.