Search Federated participation

POST

/v1/object-types/hospitality.federated_participation/search

const url = 'https://api.aerandil.com/v1/object-types/hospitality.federated_participation/search';
const options = {
  method: 'POST',
  headers: {Authorization: 'Bearer <token>', 'Content-Type': 'application/json'},
  body: '{"branch":"2489E9AD-2EE2-8E00-8EC9-32D5F69181C0","cursor":"example","filters":[{"property":"id","type":"eq","value":"example"}],"limit":1,"order":"asc","property_id":"2489E9AD-2EE2-8E00-8EC9-32D5F69181C0","scope":{"level":"tenant"},"sort_by":"created_at"}'
};

try {
  const response = await fetch(url, options);
  const data = await response.json();
  console.log(data);
} catch (error) {
  console.error(error);
}

curl --request POST \
  --url https://api.aerandil.com/v1/object-types/hospitality.federated_participation/search \
  --header 'Authorization: Bearer <token>' \
  --header 'Content-Type: application/json' \
  --data '{ "branch": "2489E9AD-2EE2-8E00-8EC9-32D5F69181C0", "cursor": "example", "filters": [ { "property": "id", "type": "eq", "value": "example" } ], "limit": 1, "order": "asc", "property_id": "2489E9AD-2EE2-8E00-8EC9-32D5F69181C0", "scope": { "level": "tenant" }, "sort_by": "created_at" }'

Search for instances. Filters eq, contains, gte and lte AND-compose; or / not are additive follow-ups. Pages with an opaque cursor; the +1 fetch returns has_more without a second round-trip. Ordered by sort_by (default created_at) in order (default ascending), id breaking ties; rows with no value for a property key sort last.

Opt-in / opt-out record for a tenant, property, portfolio, or venue participating in a program. Carries legal basis, DPA / consent references, allowed analysis kinds, participation- specific exclusions, local execution mode, agent installation reference (when execution mode is agent_installation), credential reference (opaque), optional participant-level contribution cap, output access tier, and prospective withdrawal status. Withdrawal excludes future runs after withdrawal_effective_at; already published outputs remain unless quarantined by review (proposal 0021 §4.4 / §10.6).

Authorizations

aerandil_oauth
objects:read
aerandil_oauth
objects:hospitality.federated_participation:read

Request Body^required

application/json

object

branch

Optional open-branch id. Search composes that branch’s copy-on-first-write overlay instead of main, so a preview reads its own hypothetical writes. Omit to read main.

string format: uuid

cursor

Opaque cursor from a prior response’s next_cursor. Pass back verbatim; do not introspect.

string

filters

Conjunctive list of predicates. Empty or omitted matches every row in scope, capped by limit.

Array

One of:

object

property

required

Allowed value: id

type

required

Allowed value: eq

value

required

string

limit

Page size. Server defaults to 50, silently clamps at 500 (AIP-158 §3).

integer

>= 1 <= 500

order

Direction of sort_by: asc (oldest / smallest first) or desc. A cursor is bound to the sort_by and order it was minted under; another pair is refused (422).

string

default: asc

Allowed values: asc desc

property_id

The house a desk stands in: keeps this property’s rows (property- or venue-scoped there) and every row scoped to no property (tenant, brand, portfolio), and drops a sibling house’s — the meaning property_id has on the event tail.

string format: uuid

scope

One of: discriminator: level

object

level

required

string

Allowed value: tenant

Allowed values: tenant

sort_by

What the page is ordered by: the row’s created_at or updated_at, or a property whose type orders — strings, enums and dates as text, ints, decimals and durations as numbers, datetimes as instants. Rows with no value sort last in either direction. A property the caller is not cleared to read is refused (403).

string

default: created_at

Allowed values: created_at updated_at id program_api_name participant_scope participant_object_ref status enrolled_by_principal approved_by_principal legal_basis_kind legal_basis_reference dpa_reference consent_policy_reference local_execution_mode agent_installation_id credential_reference privacy_budget_account_id contribution_weight_cap output_access_level withdrawal_requested_at withdrawal_effective_at withdrawal_reason runner_identity_ref runner_signing_key_ref dispatch_endpoint_url

Responses

200

Search results, ordered by (sort_by, id) in the requested order (ascending by default).

application/json

object

data

required

Array<object>

object

created_at

required

string format: date-time

required

string format: uuid

object_type

required

Allowed value: hospitality.federated_participation

properties

required

object

agent_installation_id

Required when execution mode is agent_installation

string

allowed_analysis_kinds

required

Participant may opt into analytics but not model training

Array<string>

Allowed values: federated_analytics federated_learning private_set_intersection clean_room_query benchmark_export

approved_by_principal

Required for active cross-tenant participation

string

consent_policy_reference

Required if consent is the basis

string

contribution_weight_cap

Participant-specific cap stricter than definition (decimal in [0,1])

string format: decimal

credential_reference

Pointer to operator vault or clean-room credential. No secret material — same `credential_reference_no_secret_material` discipline as proposal 0020.

string

dispatch_endpoint_url

Participant-published HTTPS URL the proposal 0022 dispatcher POSTs signed envelopes to (§6.1). Absent for SSE-only / pull-based profiles — the dispatcher terminal-fails push dispatches to a participation without one. HTTPS-only; http is admissible solely for loopback receivers (local development), mirroring the webhook-subscription rule.

string

dpa_reference

Required for cross-tenant programs

string

enrolled_by_principal

Principal stable id of enroller (human or admin agent)

string

excluded_field_classes

required

Additional local privacy exclusions

Array<string>

excluded_object_types

required

Tenant-specific exclusions

Array<string>

required

Participation id

string

legal_basis_kind

required

Contract / legitimate_interest / consent / public_task / not_personal_data / other_reviewed

string

Allowed values: contract legitimate_interest consent public_task not_personal_data other_reviewed

legal_basis_reference

Required except for not_personal_data with reviewer note

string

local_execution_mode

required

How local extraction runs

string

Allowed values: operator_runner agent_installation hosted_connector third_party_clean_room

output_access_level

required

Output-access tier granted to this participant

string

Allowed values: none aggregate_only participant_benchmark model_consumer

participant_object_ref

Property / venue / portfolio id when scope is not tenant. The concrete typed link lives on the link surface for property and venue scopes (proposal §6).

string

participant_scope

required

Tenant / property / portfolio / venue

string

Allowed values: tenant property portfolio venue

privacy_budget_account_id

Optional explicit budget account

string

program_api_name

required

Program joined

string

runner_identity_ref

SPIFFE URI or other identity URI for the runner; matched against the envelope's `participant.runner_identity_ref` at dispatch time (proposal 0022 §8.3).

string

runner_signing_key_ref

Opaque pointer to the runner's Ed25519 verification key in the operator's vault. No key material stored here per `credential_reference_no_secret_material` (proposal 0022 §8.2).

string

status

required

Lifecycle status

string

Allowed values: invited reviewing active paused withdrawn revoked

withdrawal_effective_at

Prospective exclusion point

string format: date-time

withdrawal_reason

Withdrawal reason

string

withdrawal_requested_at

Set when participant withdraws

string format: date-time

provenance

Per-property source attribution and pins. An entry under properties means the property’s current value came from that source (on the source’s own clock, source_updated_at); an entry under pins is a human override protecting the property from sourced writes.

object

pins

object

key

additional properties

object

pinned_at

string format: date-time

pinned_by

object

reason

required

string

properties

object

key

additional properties

object

external_id

string

recorded_at

required

string format: date-time

source

required

string

source_updated_at

string format: date-time

stream

string

scope

required

One of: discriminator: level

object

level

required

string

Allowed value: tenant

Allowed values: tenant

tenant_id

required

string format: uuid

updated_at

required

string format: date-time

version

required

integer

>= 1

has_more

required

boolean

next_cursor

Cursor for the next page; omitted when the result set is exhausted.

string

Example

{
  "data": [
    {
      "object_type": "hospitality.federated_participation",
      "properties": {
        "allowed_analysis_kinds": [
          "federated_analytics"
        ],
        "legal_basis_kind": "contract",
        "local_execution_mode": "operator_runner",
        "output_access_level": "none",
        "participant_scope": "tenant",
        "status": "invited"
      },
      "scope": {
        "level": "tenant"
      }
    }
  ]
}

422

Validation error — unknown property or filter type mismatch.

Search Federated participation

Authorizations

Request Bodyrequired

Responses

200

Example

422

Request Body^required