Search Agent installation

POST

/v1/object-types/hospitality.agent_installation/search

const url = 'https://api.aerandil.com/v1/object-types/hospitality.agent_installation/search';
const options = {
  method: 'POST',
  headers: {Authorization: 'Bearer <token>', 'Content-Type': 'application/json'},
  body: '{"branch":"2489E9AD-2EE2-8E00-8EC9-32D5F69181C0","cursor":"example","filters":[{"property":"id","type":"eq","value":"example"}],"limit":1,"order":"asc","property_id":"2489E9AD-2EE2-8E00-8EC9-32D5F69181C0","scope":{"level":"tenant"},"sort_by":"created_at"}'
};

try {
  const response = await fetch(url, options);
  const data = await response.json();
  console.log(data);
} catch (error) {
  console.error(error);
}

curl --request POST \
  --url https://api.aerandil.com/v1/object-types/hospitality.agent_installation/search \
  --header 'Authorization: Bearer <token>' \
  --header 'Content-Type: application/json' \
  --data '{ "branch": "2489E9AD-2EE2-8E00-8EC9-32D5F69181C0", "cursor": "example", "filters": [ { "property": "id", "type": "eq", "value": "example" } ], "limit": 1, "order": "asc", "property_id": "2489E9AD-2EE2-8E00-8EC9-32D5F69181C0", "scope": { "level": "tenant" }, "sort_by": "created_at" }'

Search for instances. Filters eq, contains, gte and lte AND-compose; or / not are additive follow-ups. Pages with an opaque cursor; the +1 fetch returns has_more without a second round-trip. Ordered by sort_by (default created_at) in order (default ascending), id breaking ties; rows with no value for a property key sort last.

Tenant / property enablement of a registry entry. Permission-bearing — enabled installations are what enable_agent_installation issues per-tenant. enabled_action_scopes and enabled_function_scopes are subsets of the registry entry’s declared maxima. installed_scope_ref is required and type-checked for non-tenant scopes; the broad catch-all scopes (actions:apply, functions:invoke) and any internal:workflow:* scope are rejected at install time.

Authorizations

aerandil_oauth
objects:read
aerandil_oauth
objects:hospitality.agent_installation:read

Request Body^required

application/json

object

branch

Optional open-branch id. Search composes that branch’s copy-on-first-write overlay instead of main, so a preview reads its own hypothetical writes. Omit to read main.

string format: uuid

cursor

Opaque cursor from a prior response’s next_cursor. Pass back verbatim; do not introspect.

string

filters

Conjunctive list of predicates. Empty or omitted matches every row in scope, capped by limit.

Array

One of:

object

property

required

Allowed value: id

type

required

Allowed value: eq

value

required

string

limit

Page size. Server defaults to 50, silently clamps at 500 (AIP-158 §3).

integer

>= 1 <= 500

order

Direction of sort_by: asc (oldest / smallest first) or desc. A cursor is bound to the sort_by and order it was minted under; another pair is refused (422).

string

default: asc

Allowed values: asc desc

property_id

The house a desk stands in: keeps this property’s rows (property- or venue-scoped there) and every row scoped to no property (tenant, brand, portfolio), and drops a sibling house’s — the meaning property_id has on the event tail.

string format: uuid

scope

One of: discriminator: level

object

level

required

string

Allowed value: tenant

Allowed values: tenant

sort_by

What the page is ordered by: the row’s created_at or updated_at, or a property whose type orders — strings, enums and dates as text, ints, decimals and durations as numbers, datetimes as instants. Rows with no value sort last in either direction. A property the caller is not cleared to read is refused (403).

string

default: created_at

Allowed values: created_at updated_at id installation_status installed_scope credential_reference auth_mode installed_by enabled_by enabled_at suspended_at suspension_reason expires_at last_used_at dispatch_endpoint_url runner_identity_ref

Responses

200

Search results, ordered by (sort_by, id) in the requested order (ascending by default).

application/json

object

data

required

Array<object>

object

created_at

required

string format: date-time

required

string format: uuid

object_type

required

Allowed value: hospitality.agent_installation

properties

required

object

allowed_workflow_keys

Optional workflow-key allowlist; empty/null means action/function scopes decide

Array<string>

approval_policy

Gates required before this agent can execute high-risk steps. Required when any enabled action / function / allowed workflow has a risk_tier in the high-risk set (per `agent_installation_high_risk_requires_policy`).

auth_mode

required

How the installation authenticates the agent at call time

string

Allowed values: none oauth_client_credentials oauth_delegated api_key_reference jwt_exchange mcp_oauth

credential_reference

Opaque pointer into an external secret manager. `credential_reference_no_secret_material` rejects obvious secret bodies (bearer tokens, API keys, PEM blocks).

string

dispatch_endpoint_url

Runtime-published URL the proposal 0022 dispatcher POSTs signed task envelopes to (§6.1 rules: https required, http admissible only for loopback receivers). Unset = this installation is not dispatch-taskable.

string

enabled_action_scopes

required

Subset of the registry entry's declared action scopes

Array<string>

enabled_at

Enablement time

string format: date-time

enabled_by

Principal stable id that approved enablement

string

enabled_data_classes

required

Subset of the registry entry's declared data classes

Array<string>

Allowed values: public operational guest_pii staff_pii payment_metadata regulated_health secrets

enabled_function_scopes

required

Subset of the registry entry's declared function scopes

Array<string>

enabled_read_scopes

Subset of the registry entry's declared read scopes. When present it is the installation's whole object-read grant: a token minted for it carries `objects:<type>:read` for exactly these types and never the broad `objects:read`. Absent, reads are not narrowed by the installation.

Array<string>

expires_at

Optional time-bound install

string format: date-time

required

Installation id

string

installation_status

required

Lifecycle status

string

Allowed values: requested enabled suspended revoked disabled expired

installed_by

Principal stable id of the installer

string

installed_scope

required

Tenancy scope this installation grants access at

string

Allowed values: tenant brand portfolio property venue

installed_scope_ref

Agent installation installed scope ref

Typed reference to the scoping object. Required for non-tenant scopes; forbidden for installed_scope = tenant. Type-checked by agent_installation_scope_ref_coherent.

object

object_id

required

string

object_type

required

string

last_used_at

Updated by agent-run attribution

string format: date-time

runner_identity_ref

Stable §8.3 identity URI the runtime presents in its signed acks/results (SPIFFE URI, JWK URL, or urn:aerandil form).

string

runner_public_keys

kid → base64 Ed25519 verification keys (RFC 8032 raw 32-byte) the receiver routes verify this installation's ack / result_submit envelope signatures against. Public key material only — rotation is additive (keep old + new kid during the window).

suspended_at

Suspension time

string format: date-time

suspension_reason

Required when suspended / revoked

string

provenance

Per-property source attribution and pins. An entry under properties means the property’s current value came from that source (on the source’s own clock, source_updated_at); an entry under pins is a human override protecting the property from sourced writes.

object

pins

object

key

additional properties

object

pinned_at

string format: date-time

pinned_by

object

reason

required

string

properties

object

key

additional properties

object

external_id

string

recorded_at

required

string format: date-time

source

required

string

source_updated_at

string format: date-time

stream

string

scope

required

One of: discriminator: level

object

level

required

string

Allowed value: tenant

Allowed values: tenant

tenant_id

required

string format: uuid

updated_at

required

string format: date-time

version

required

integer

>= 1

has_more

required

boolean

next_cursor

Cursor for the next page; omitted when the result set is exhausted.

string

Example

{
  "data": [
    {
      "object_type": "hospitality.agent_installation",
      "properties": {
        "auth_mode": "none",
        "enabled_data_classes": [
          "public"
        ],
        "installation_status": "requested",
        "installed_scope": "tenant"
      },
      "scope": {
        "level": "tenant"
      }
    }
  ]
}

422

Validation error — unknown property or filter type mismatch.

Search Agent installation

Authorizations

Request Bodyrequired

Responses

200

Example

422

Request Body^required