Skip to content
aerandil.com
GitHub

Validate Store payment card (dry-run)

POST
/v1/actions/hospitality.action.store_payment_card/validate
curl --request POST \
  --url https://api.aerandil.com/v1/actions/hospitality.action.store_payment_card/validate \
  --header 'Authorization: Bearer <token>' \
  --header 'Content-Type: application/json' \
  --data '{ "branch": "2489E9AD-2EE2-8E00-8EC9-32D5F69181C0", "params": { "activation_date": "2026-04-15", "brand": "visa", "capture_kind": "terminal", "card_format": "physical", "cardholder_name": "example", "expiry_month": 1, "expiry_year": 1, "funded_amount": { "amount": "example", "currency": "example" }, "funding": "credit", "issuing_country": "example", "last4": "example", "network_fingerprint": "example", "off_session_consent": true, "person_ref": "2489E9AD-2EE2-8E00-8EC9-32D5F69181C0", "provider": "example", "provider_card_ref": "example", "reservation_ref": "2489E9AD-2EE2-8E00-8EC9-32D5F69181C0", "retain_until": "2026-04-15", "source": "guest_device_page", "wallet": "apple_pay" }, "return_modified": false }'

Dry-run of apply_hospitality_action_store_payment_card’s parameter checks. No side effects, no idempotency reservation, no handler dispatch — just the schema pass plus action-level shape (target presence, target type, unknown-parameter rejection). return_modified is meaningless here and ignored.

Authorizations

Section titled “Authorizations”

Request Bodyrequired

Section titled “Request Bodyrequired”
Media typeapplication/json
object
branch

Apply against an open branch’s overlay view instead of the canonical (main) plane. The action’s writes land in the branch’s copy-on-first-write overlay, its events in the branch’s own stream, and the invocation is journaled for merge-by-replay. Branch writes are action-only, so this is the write-side entry point to a branch (POST /v1/branches forks one).

string format: uuid
params
required
object
activation_date
A `virtual` card's activation date — the first day the channel lets the house charge it (the house's calendar)
string format: date
brand
required
Card scheme as the PSP reports it
string
Allowed values: visa mastercard amex discover diners jcb unionpay cartes_bancaires eftpos_au interac maestro unknown
capture_kind
required
How the card reached the PSP — decides card-present interchange, chargeback liability, and whether the cardholder's presence satisfied SCA
string
Allowed values: terminal keyed_by_staff guest_device imported
card_format
`physical` (a person's card, the default) or `virtual` (an OTA single-booking card)
string
Allowed values: physical virtual
cardholder_name
The payer's name as the pay page took it, for a page card with no cardholder person
string
expiry_month
required
Expiry month, 1-12
integer
expiry_year
required
Expiry year, four digits
integer
funded_amount
What the channel loaded a `virtual` card with — the most the house may charge it
object
amount
required
string format: decimal
currency
required
string format: iso-4217
funding
What the card draws on, as the scheme reports it
string
Allowed values: credit debit prepaid unknown
issuing_country
Issuing country (ISO 3166-1 alpha-2)
string
last4
required
Last four glyphs of the card number
string
network_fingerprint
PSP-issued stable identifier for the underlying card number
string
off_session_consent
required
True when the cardholder authenticated with the stated intent that the property may charge this card later
boolean
person_ref
The cardholder. Required for a `physical` card; a `virtual` card has none.
string format: uuid
provider
required
PSP holding the card (`stripe`, `adyen`)
string
provider_card_ref
required
The PSP's token for this card (Stripe PaymentMethod id, Adyen recurringDetailReference). Never a PAN.
string
reservation_ref
The booking this card guarantees. Required for a `virtual` card; optional for a guest's own card.
string format: uuid
retain_until
required
Storage-limitation clock (set per jurisdiction and purpose)
string format: date
source
Where the off-session consent was given, when narrower than the cardholder's: `guest_device_page` (a booking's pay page — its terms cover the bookings the card is bound to). A `physical` page card may then omit `person_ref` when it names `reservation_ref`: its payer is not the booking's guest
string
Allowed values: guest_device_page
wallet
Wallet the card was presented through, when it was
string
Allowed values: apple_pay google_pay samsung_pay link click_to_pay other
return_modified

When true, the response carries modified_objects and modified_links projections — the engine reads the event log inside the same transaction so the projection observes the handler’s own writes.

boolean

Responses

Section titled “Responses”

200

Section titled “200”

Validation outcome. result is valid or invalid; per-parameter diagnostics are always populated for every declared parameter so a UI can render the action’s full surface.

Media typeapplication/json
object
action
required
string
errors

Action-level errors not tied to a single parameter (missing target, target type mismatch, unknown parameter names). Absent when empty.

Array<string>
parameters
required

Per-parameter diagnostics keyed by api_name.

object
key
additional properties
object
errors
Array<string>
result
required
Allowed values: valid invalid
value
required

The serialised value the server interpreted, or null if the parameter was not supplied.

result
required
Allowed values: valid invalid
Example
{
  "parameters": {
    "additionalProperty": {
      "result": "valid"
    }
  },
  "result": "valid"
}