Preview Record federated contribution (dry-run)

POST

/v1/actions/hospitality.action.record_federated_contribution/preview

curl --request POST \
  --url https://api.aerandil.com/v1/actions/hospitality.action.record_federated_contribution/preview \
  --header 'Authorization: Bearer <token>' \
  --header 'Content-Type: application/json' \
  --data '{ "branch": "2489E9AD-2EE2-8E00-8EC9-32D5F69181C0", "params": { "attestation_reference": "example", "clipping_applied": true, "contribution_kind": "encrypted_aggregate", "contribution_slot": "example", "delta_spent": "example", "epsilon_spent": "example", "input_snapshot_hash": "example", "input_window_end": "2026-04-15T12:00:00Z", "input_window_start": "2026-04-15T12:00:00Z", "local_code_digest": "example", "local_record_count_bucket": "lt_10", "local_runner_version": "example", "local_subject_count_bucket": "lt_10", "participation_id": "example", "payload_hash": "example", "payload_reference": "example", "payload_size_bytes": 1, "rejection_reason": "example", "result_status": "accepted", "secure_aggregation_mask_ref": "example", "validation_warnings": [ "example" ] }, "return_modified": false, "target": { "id": "2489E9AD-2EE2-8E00-8EC9-32D5F69181C0", "object_type": "hospitality.federated_run" } }'

• Production API

Scenario preview of apply_hospitality_action_record_federated_contribution — runs the action exactly as apply would (validation, handler dispatch, modified-object projection, commit-time cross-link validation) then rolls the transaction back. Returns the modified_objects / modified_links / warnings the apply would have produced without persisting anything or firing any outward effect. Requires the same actions:hospitality.action.record_federated_contribution:apply scope as apply. No Idempotency-Key.

Authorizations

• aerandil_oauth

Request Body^required

Media typeapplication/json

object

branch

Apply against an open branch’s overlay view instead of the canonical (main) plane. The action’s writes land in the branch’s copy-on-first-write overlay, its events in the branch’s own stream, and the invocation is journaled for merge-by-replay. Branch writes are action-only, so this is the write-side entry point to a branch (POST /v1/branches forks one).

string format: uuid

params

required

object

attestation_reference

TEE / runner attestation if used

string

clipping_applied

required

Required true for model updates

boolean

contribution_kind

required

Contribution kind

string

Allowed values: encrypted_aggregate noisy_aggregate model_update metrics_only attestation_only

contribution_slot

Slot discriminator when definition declares multiple slots

string

delta_spent

Local DP spend

string format: decimal

epsilon_spent

Local DP spend

string format: decimal

input_snapshot_hash

required

Hash over local eligible input snapshot metadata

string

input_window_end

required

Must match run

string format: date-time

input_window_start

required

Must match run

string format: date-time

local_code_digest

required

Must match approved definition unless override recorded

string

local_record_count_bucket

required

Bucketed record count

string

Allowed values: lt_10 10_49 50_99 100_499 500_999 1000_plus

local_runner_version

required

Runner or agent version

string

local_subject_count_bucket

Required for person-affecting definitions

string

Allowed values: lt_10 10_49 50_99 100_499 500_999 1000_plus

participation_id

required

Participation id

string

payload_hash

Required when payload_reference is set

string

payload_reference

Encrypted payload / clean-room output / secure aggregation share ref

string

payload_size_bytes

Safety bound

integer

rejection_reason

Bounded; required for rejected / suppressed

string

result_status

required

accepted | rejected | suppressed

string

Allowed values: accepted rejected suppressed

secure_aggregation_mask_ref

Optional protocol metadata

string

validation_warnings

Local runner warnings

Array<string>

return_modified

When true, the response carries modified_objects and modified_links projections — the engine reads the event log inside the same transaction so the projection observes the handler’s own writes.

boolean

target

required

object

id

required

string format: uuid

object_type

required

Allowed value: hospitality.federated_run

Responses

200

Preview computed and rolled back. modified_objects and modified_links carry the effect set the apply would produce; preview is always true.

Media typeapplication/json

ApplyActionResponse

Envelope returned by the Aerandil action engine. correlation_id ties every event emitted by this invocation; modified_objects and modified_links project the events the handler emitted (per the action’s declared effects); warnings carries any non-blocking soft-validator observations.

object

correlation_id

required

Per-invocation correlation id; matches events.correlation_id for every event this action appended.

string format: uuid

modified_links

required

Links established or removed by this invocation. Empty when the caller did not request return_modified.

Array<object>

object

from_id

required

string format: uuid

from_type

required

string

kind

required

Allowed values: linked

link_type

required

Allowed values: hospitality.link.federated_contribution_for_run hospitality.link.federated_contribution_from_participation

to_id

required

string format: uuid

to_type

required

string

modified_objects

required

Objects created, modified, or soft-deleted by this invocation. Empty when the caller did not request return_modified.

Array<object>

object

id

required

string format: uuid

kind

required

Allowed values: created modified

object_type

required

Allowed values: hospitality.federated_contribution hospitality.federated_run

warnings

Non-blocking soft-validator observations emitted during this invocation (e.g. comp-authority over-limit, recipe pour-cost over sell-price). Absent when no warnings were emitted.

Array<object>

object

message

required

Human-readable summary, suitable for logging or operator-UI surfacing.

string

object_type

required

Object type the warning was raised against.

string

property

Property the warning anchors to, when a single field is the locus. Absent for multi-field rules.

string

rule

required

Stable kebab-case rule identifier (e.g. comp-authority-over-limit).

string

Example

{
  "modified_links": [
    {
      "kind": "linked",
      "link_type": "hospitality.link.federated_contribution_for_run"
    }
  ],
  "modified_objects": [
    {
      "kind": "created",
      "object_type": "hospitality.federated_contribution"
    }
  ]
}

Headers

Cache-Control

string

Allowed value: no-store

Always no-store — uncommitted live data.

409

Conflict — concurrent modification or unique constraint violation the apply would hit.

422

Validation error — the apply would be rejected.