Skip to content
aerandil.com
GitHub

Search Federated contribution

POST
/v1/object-types/hospitality.federated_contribution/search
curl --request POST \
  --url https://api.aerandil.com/v1/object-types/hospitality.federated_contribution/search \
  --header 'Authorization: Bearer <token>' \
  --header 'Content-Type: application/json' \
  --data '{ "branch": "2489E9AD-2EE2-8E00-8EC9-32D5F69181C0", "cursor": "example", "filters": [ { "property": "id", "type": "eq", "value": "example" } ], "limit": 1, "order": "asc", "property_id": "2489E9AD-2EE2-8E00-8EC9-32D5F69181C0", "scope": { "level": "tenant" }, "sort_by": "created_at" }'

Search for instances. Filters eq, contains, gte and lte AND-compose; or / not are additive follow-ups. Pages with an opaque cursor; the +1 fetch returns has_more without a second round-trip. Ordered by sort_by (default created_at) in order (default ascending), id breaking ties; rows with no value for a property key sort last.

Metadata for one participant’s local contribution to a run. Stores hashes, bucketed counts, payload reference / hash, validation warnings, optional attestation reference. Does not store raw local records, raw guest text, direct identifiers, PAN, PHI, or clinical detail — those are rejected structurally by the contribution validators (proposal 0021 §4.7 / §7).

Authorizations

Section titled “Authorizations”

Request Bodyrequired

Section titled “Request Bodyrequired”
Media typeapplication/json
object
branch

Optional open-branch id. Search composes that branch’s copy-on-first-write overlay instead of main, so a preview reads its own hypothetical writes. Omit to read main.

string format: uuid
cursor

Opaque cursor from a prior response’s next_cursor. Pass back verbatim; do not introspect.

string
filters

Conjunctive list of predicates. Empty or omitted matches every row in scope, capped by limit.

Array
One of:
object
property
required
Allowed value: id
type
required
Allowed value: eq
value
required
string
limit

Page size. Server defaults to 50, silently clamps at 500 (AIP-158 §3).

integer
>= 1 <= 500
order

Direction of sort_by: asc (oldest / smallest first) or desc. A cursor is bound to the sort_by and order it was minted under; another pair is refused (422).

string
default: asc
Allowed values: asc desc
property_id

The house a desk stands in: keeps this property’s rows (property- or venue-scoped there) and every row scoped to no property (tenant, brand, portfolio), and drops a sibling house’s — the meaning property_id has on the event tail.

string format: uuid
scope
One of: discriminator: level
object
level
required
string
Allowed value: tenant
Allowed values: tenant
sort_by

What the page is ordered by: the row’s created_at or updated_at, or a property whose type orders — strings, enums and dates as text, ints, decimals and durations as numbers, datetimes as instants. Rows with no value sort last in either direction. A property the caller is not cleared to read is refused (403).

string
default: created_at
Allowed values: created_at updated_at id run_id participation_id status contribution_kind contribution_slot local_code_digest local_runner_version input_snapshot_hash input_window_start input_window_end contribution_fingerprint local_record_count_bucket local_subject_count_bucket payload_reference payload_hash payload_size_bytes secure_aggregation_mask_ref epsilon_spent delta_spent attestation_reference submitted_at accepted_at rejection_reason minimum_local_runner_version_at_submission recommended_local_runner_version_at_submission

Responses

Section titled “Responses”

200

Section titled “200”

Search results, ordered by (sort_by, id) in the requested order (ascending by default).

Media typeapplication/json
object
data
required
Array<object>
object
created_at
required
string format: date-time
id
required
string format: uuid
object_type
required
Allowed value: hospitality.federated_contribution
properties
required
object
accepted_at
Set by validation
string format: date-time
attestation_reference
TEE / runner attestation if used
string
clipping_applied
required
Required true for model updates (validator enforced)
boolean
contribution_fingerprint
required
SHA-256 over the contribution ledger payload. Same ledger key with a different fingerprint is rejected.
string
contribution_kind
required
Encrypted aggregate / noisy aggregate / model update / metrics only / attestation only
string
Allowed values: encrypted_aggregate noisy_aggregate model_update metrics_only attestation_only
contribution_slot
Slot discriminator when a definition declares multiple slots; null for the default single-slot path
string
delta_spent
Local DP spend
string format: decimal
epsilon_spent
Local DP spend
string format: decimal
id
required
Contribution id
string
input_snapshot_hash
required
Hash over local eligible input snapshot metadata; never raw data
string
input_window_end
required
Must match run
string format: date-time
input_window_start
required
Must match run
string format: date-time
local_code_digest
required
Must match approved definition unless reviewed override
string
local_record_count_bucket
required
Bucketed record count; exact counts stay local unless reviewed
string
Allowed values: lt_10 10_49 50_99 100_499 500_999 1000_plus
local_runner_version
required
Runner or agent version
string
local_subject_count_bucket
Required for person-affecting definitions
string
Allowed values: lt_10 10_49 50_99 100_499 500_999 1000_plus
minimum_local_runner_version_at_submission
Snapshot of the effective hard floor from the contribution's definition at action time
string
participation_id
required
Participation id
string
payload_hash
Required when payload_reference is set
string
payload_reference
Encrypted payload / clean-room output / secure aggregation share reference. Never the payload body itself.
string
payload_size_bytes
Safety bound
integer
recommended_local_runner_version_at_submission
Snapshot of the effective soft baseline from the contribution's definition at action time
string
rejection_reason
Bounded
string
run_id
required
Federated run id
string
secure_aggregation_mask_ref
Optional protocol metadata
string
status
required
Lifecycle status
string
Allowed values: requested local_prepared submitted accepted rejected suppressed withdrawn expired
submitted_at
Set by action
string format: date-time
validation_warnings
required
Local runner warnings (bounded text array)
Array<string>
provenance

Per-property source attribution and pins. An entry under properties means the property’s current value came from that source (on the source’s own clock, source_updated_at); an entry under pins is a human override protecting the property from sourced writes.

object
pins
object
key
additional properties
object
pinned_at
string format: date-time
pinned_by
object
reason
required
string
properties
object
key
additional properties
object
external_id
string
recorded_at
required
string format: date-time
source
required
string
source_updated_at
string format: date-time
stream
string
scope
required
One of: discriminator: level
object
level
required
string
Allowed value: tenant
Allowed values: tenant
tenant_id
required
string format: uuid
updated_at
required
string format: date-time
version
required
integer
>= 1
has_more
required
boolean
next_cursor

Cursor for the next page; omitted when the result set is exhausted.

string
Example
{
  "data": [
    {
      "object_type": "hospitality.federated_contribution",
      "properties": {
        "contribution_kind": "encrypted_aggregate",
        "local_record_count_bucket": "lt_10",
        "local_subject_count_bucket": "lt_10",
        "status": "requested"
      },
      "scope": {
        "level": "tenant"
      }
    }
  ]
}

422

Section titled “422”

Validation error — unknown property or filter type mismatch.