Skip to content
aerandil.com
GitHub

Traverse from Access credential

POST
/v1/object-types/hospitality.access_credential/objects/{id}/traverse
curl --request POST \
  --url https://api.aerandil.com/v1/object-types/hospitality.access_credential/objects/2489E9AD-2EE2-8E00-8EC9-32D5F69181C0/traverse \
  --header 'Authorization: Bearer <token>' \
  --header 'Content-Type: application/json' \
  --data '{ "as_of": "2026-04-15T12:00:00Z", "branch": "2489E9AD-2EE2-8E00-8EC9-32D5F69181C0", "cursor": "example", "direction": "out", "limit": 1, "link_type": "hospitality.link.access_credential_for_stay", "role": "example" }'

RPC-shaped traversal. Pick the edge by (link_type, direction) or by role — the registry resolves a role name (e.g. managed_by, direct_reports) to the underlying link side. link_type wins when both are present.

A per-stay physical or virtual credential — the room key card, wristband, or mobile key — bound to a stay so the opaque vendor token a reader picks up at tap time resolves to the stay’s open folio. The token is a locator, never an authenticator (card UIDs are clonable): resolution requires status = active, an unexpired expires_at, and an in-house stay, and every posting is bounded by the credential’s per_charge_cap / daily_cap. Check-out revokes every credential on the stay — a dropped card in the express-checkout box must fail closed.

Authorizations

Section titled “Authorizations”

Parameters

Section titled “Parameters”

Path Parameters

Section titled “Path Parameters”
id
required
string format: uuid

Object id (UUID v7, server-generated at create time).

Request Bodyrequired

Section titled “Request Bodyrequired”
Media typeapplication/json

Body for POST .../traverse. At least one of link_type or role MUST be supplied — the server returns 422 missing_traversal_target when both are absent. link_type wins when both are set.

object
as_of

RFC3339 temporal window: return neighbours whose edge was in effect at this instant ([effective_from, effective_to)) instead of now.

string format: date-time
branch

Traverse through an open branch’s overlay view instead of the canonical (main) plane. Does not compose with as_of (422).

string format: uuid
cursor
string
direction

Edge direction. Optional when the binding is asymmetric.

Allowed values: out in
limit
integer
>= 1 <= 500
link_type

API name of the link type to traverse. Narrowed to link types that bind the source. Wins over role.

Allowed values: hospitality.link.access_credential_for_stay hospitality.link.charge_via_credential
role

Link-side role name (e.g. managed_by, direct_reports). Mutually substitutable with link_type — the registry resolves the role to its underlying link and direction.

string

Responses

Section titled “Responses”

200

Section titled “200”

Neighbours along the resolved link.

Media typeapplication/json
object
data
required
Array<object>
object
created_at
required
string format: date-time
id
required
string format: uuid
object_type
required
string
properties
required
object
scope
required
One of: discriminator: level
object
level
required
string
Allowed value: tenant
Allowed values: tenant
tenant_id
required
string format: uuid
updated_at
required
string format: date-time
version
required
integer
>= 1
direction
required
Allowed values: out in
has_more
required
boolean
link_type
required
string
next_cursor
string
Example
{
  "data": [
    {
      "scope": {
        "level": "tenant"
      }
    }
  ],
  "direction": "out"
}

404

Section titled “404”

No object with that id, or link type unknown.

422

Section titled “422”

Validation error — must supply link_type or role.