Skip to content

Preview Publish federated intelligence program (dry-run)

POST
/v1/actions/hospitality.action.publish_federated_program/preview
curl --request POST \
--url https://api.aerandil.com/v1/actions/hospitality.action.publish_federated_program/preview \
--header 'Authorization: Bearer <token>' \
--header 'Content-Type: application/json' \
--data '{ "branch": "2489E9AD-2EE2-8E00-8EC9-32D5F69181C0", "params": { "allowed_analysis_kinds": [ "federated_analytics" ], "allowed_output_kinds": [ "benchmark_report" ], "api_name": "example", "coordinator_kind": "aerandil", "coordinator_reference": "example", "default_delta": "example", "default_epsilon": "example", "default_max_contributor_share": "example", "default_min_properties": 1, "default_min_subjects": 1, "default_min_tenants": 1, "default_privacy_mechanisms": [ "cohort_threshold" ], "description": "example", "display_name": "example", "downstream_use_policy": "example", "dpa_reference": "example", "dpia_reference": "example", "effective_from": "2026-04-15T12:00:00Z", "effective_to": "2026-04-15T12:00:00Z", "governance_tier": "internal_portfolio", "legal_basis_summary": "example", "minimum_local_runner_version": "example", "owner_ref": "example", "owner_scope": "tenant", "participant_benefit_policy": "example", "privacy_budget_period": "run", "publish_status": "draft", "purpose": "rate_recommendation_calibration", "recommended_local_runner_version": "example", "review_gate_policy": "example" }, "return_modified": false, "target": { "id": "2489E9AD-2EE2-8E00-8EC9-32D5F69181C0", "object_type": "hospitality.property" } }'

Scenario preview of apply_hospitality_action_publish_federated_program — runs the action exactly as apply would (validation, handler dispatch, modified-object projection, commit-time cross-link validation) then rolls the transaction back. Returns the modified_objects / modified_links / warnings the apply would have produced without persisting anything or firing any outward effect. Requires the same actions:hospitality.action.publish_federated_program:apply scope as apply. No Idempotency-Key.

Media typeapplication/json
object
branch

Apply against an open branch’s overlay view instead of the canonical (main) plane. The action’s writes land in the branch’s copy-on-first-write overlay, its events in the branch’s own stream, and the invocation is journaled for merge-by-replay. Branch writes are action-only, so this is the write-side entry point to a branch (POST /v1/branches forks one).

string format: uuid
params
required
object
allowed_analysis_kinds
required
Analytics first; learning requires review
Array<string>
Allowed values: federated_analytics federated_learning private_set_intersection clean_room_query benchmark_export
allowed_output_kinds
required
Allowed output kinds
Array<string>
Allowed values: benchmark_report calibration_curve aggregate_metric model_artifact signal_package governance_card
api_name
required
Stable slug; unique within owner scope
string
coordinator_kind
required
aerandil / tenant / consortium / third_party_clean_room
string
Allowed values: aerandil tenant consortium third_party_clean_room
coordinator_reference
Optional system or contract reference
string
default_delta
Required when default_epsilon set and mechanism needs delta
string format: decimal
default_epsilon
Program-level default for DP definitions
string format: decimal
default_max_contributor_share
required
Decimal in [0,1]
string format: decimal
default_min_properties
required
Hard minimum
integer
default_min_subjects
Required when output can be person-affecting
integer
default_min_tenants
required
Hard minimum (>= 3 for cross_tenant_network)
integer
default_privacy_mechanisms
required
Default privacy mechanisms applied per definition
Array<string>
Allowed values: cohort_threshold contribution_bounding differential_privacy secure_aggregation secure_multiparty_computation homomorphic_encryption private_set_intersection trusted_execution_environment manual_statistical_disclosure_control none_internal_portfolio_only
description
Bounded operator-facing summary
string
display_name
required
Human-readable name
string
downstream_use_policy
Allowed uses for outputs
string
dpa_reference
Required for cross-tenant unless waived
string
dpia_reference
Required for high-risk or person-affecting programs
string
effective_from
Optional
string format: date-time
effective_to
Optional
string format: date-time
governance_tier
required
Governance tier
string
Allowed values: internal_portfolio cross_tenant_network consortium_governed high_risk_review
legal_basis_summary
Bounded summary
string
minimum_local_runner_version
Optional program-wide hard floor for local-runner semver; contributions below this are rejected at action time
string
owner_ref
Consortium / operator governance reference when owner is not single-tenant
string
owner_scope
required
tenant / consortium / aerandil_managed
string
Allowed values: tenant consortium aerandil_managed
participant_benefit_policy
What participants receive in return
string
privacy_budget_period
required
Default budget period
string
Allowed values: run day month quarter year lifetime
publish_status
draft (default) or active
string
Allowed values: draft reviewing active paused deprecated retired
purpose
required
Drives legal / review expectations
string
Allowed values: rate_recommendation_calibration fraud_signal_calibration service_recovery_benchmark agent_quality_benchmark payment_review_benchmark outlet_profitability_benchmark energy_water_waste_benchmark operations_research consortium_standardization reviewed_custom
recommended_local_runner_version
Optional program-wide soft baseline for local-runner semver; contributions below this emit `contribution_runner_version_outdated_warns`
string
review_gate_policy
required
Which definitions / outputs require approval gates (JSON)
return_modified

When true, the response carries modified_objects and modified_links projections — the engine reads the event log inside the same transaction so the projection observes the handler’s own writes.

boolean
target
required
object
id
required
string format: uuid
object_type
required
Allowed value: hospitality.property

Preview computed and rolled back. modified_objects and modified_links carry the effect set the apply would produce; preview is always true.

Media typeapplication/json
ApplyActionResponse

Envelope returned by the Aerandil action engine. correlation_id ties every event emitted by this invocation; modified_objects and modified_links project the events the handler emitted (per the action’s declared effects); warnings carries any non-blocking soft-validator observations.

object
correlation_id
required

Per-invocation correlation id; matches events.correlation_id for every event this action appended.

string format: uuid
modified_links
required

Links established or removed by this invocation. Empty when the caller did not request return_modified.

Array<object>
object
from_id
required
string format: uuid
from_type
required
string
kind
required
Allowed values: linked unlinked properties_updated end_dated
link_type
required
string
to_id
required
string format: uuid
to_type
required
string
modified_objects
required

Objects created, modified, or soft-deleted by this invocation. Empty when the caller did not request return_modified.

Array<object>
object
id
required
string format: uuid
kind
required
Allowed values: created
object_type
required
Allowed values: hospitality.federated_intelligence_program
warnings

Non-blocking soft-validator observations emitted during this invocation (e.g. comp-authority over-limit, recipe pour-cost over sell-price). Absent when no warnings were emitted.

Array<object>
object
message
required

Human-readable summary, suitable for logging or operator-UI surfacing.

string
object_type
required

Object type the warning was raised against.

string
property

Property the warning anchors to, when a single field is the locus. Absent for multi-field rules.

string
rule
required

Stable kebab-case rule identifier (e.g. comp-authority-over-limit).

string
Example
{
"modified_links": [
{
"kind": "linked"
}
],
"modified_objects": [
{
"kind": "created",
"object_type": "hospitality.federated_intelligence_program"
}
]
}
Cache-Control
string
Allowed value: no-store

Always no-store — uncommitted live data.

Conflict — concurrent modification or unique constraint violation the apply would hit.

Validation error — the apply would be rejected.