What-if Publish federated intelligence program (rollup delta)

POST

/v1/actions/hospitality.action.publish_federated_program/whatif

curl --request POST \
  --url https://api.aerandil.com/v1/actions/hospitality.action.publish_federated_program/whatif \
  --header 'Authorization: Bearer <token>' \
  --header 'Content-Type: application/json' \
  --data '{ "branch": "2489E9AD-2EE2-8E00-8EC9-32D5F69181C0", "params": { "allowed_analysis_kinds": [ "federated_analytics" ], "allowed_output_kinds": [ "benchmark_report" ], "api_name": "example", "coordinator_kind": "aerandil", "coordinator_reference": "example", "default_delta": "example", "default_epsilon": "example", "default_max_contributor_share": "example", "default_min_properties": 1, "default_min_subjects": 1, "default_min_tenants": 1, "default_privacy_mechanisms": [ "cohort_threshold" ], "description": "example", "display_name": "example", "downstream_use_policy": "example", "dpa_reference": "example", "dpia_reference": "example", "effective_from": "2026-04-15T12:00:00Z", "effective_to": "2026-04-15T12:00:00Z", "governance_tier": "internal_portfolio", "legal_basis_summary": "example", "minimum_local_runner_version": "example", "owner_ref": "example", "owner_scope": "tenant", "participant_benefit_policy": "example", "privacy_budget_period": "run", "publish_status": "draft", "purpose": "rate_recommendation_calibration", "recommended_local_runner_version": "example", "review_gate_policy": "example" }, "return_modified": false, "target": { "id": "2489E9AD-2EE2-8E00-8EC9-32D5F69181C0", "object_type": "hospitality.property" } }'

• Production API

What-if projection of apply_hospitality_action_publish_federated_program — previews the action (execute-and-roll-back) and folds its would-be events into rollup deltas, returning the contribution an apply would make to the daily_rooms fact (ADR / RevPAR / TRevPAR / Occupancy inputs) without persisting anything. Requires the same actions:hospitality.action.publish_federated_program:apply scope as apply. An action that emits no rooms-fact events yields an empty daily_rooms.

Authorizations

• aerandil_oauth

Request Body^required

Media typeapplication/json

object

branch

Apply against an open branch’s overlay view instead of the canonical (main) plane. The action’s writes land in the branch’s copy-on-first-write overlay, its events in the branch’s own stream, and the invocation is journaled for merge-by-replay. Branch writes are action-only, so this is the write-side entry point to a branch (POST /v1/branches forks one).

string format: uuid

params

required

object

allowed_analysis_kinds

required

Analytics first; learning requires review

Array<string>

Allowed values: federated_analytics federated_learning private_set_intersection clean_room_query benchmark_export

allowed_output_kinds

required

Allowed output kinds

Array<string>

Allowed values: benchmark_report calibration_curve aggregate_metric model_artifact signal_package governance_card

api_name

required

Stable slug; unique within owner scope

string

coordinator_kind

required

aerandil / tenant / consortium / third_party_clean_room

string

Allowed values: aerandil tenant consortium third_party_clean_room

coordinator_reference

Optional system or contract reference

string

default_delta

Required when default_epsilon set and mechanism needs delta

string format: decimal

default_epsilon

Program-level default for DP definitions

string format: decimal

default_max_contributor_share

required

Decimal in [0,1]

string format: decimal

default_min_properties

required

Hard minimum

integer

default_min_subjects

Required when output can be person-affecting

integer

default_min_tenants

required

Hard minimum (>= 3 for cross_tenant_network)

integer

default_privacy_mechanisms

required

Default privacy mechanisms applied per definition

Array<string>

Allowed values: cohort_threshold contribution_bounding differential_privacy secure_aggregation secure_multiparty_computation homomorphic_encryption private_set_intersection trusted_execution_environment manual_statistical_disclosure_control none_internal_portfolio_only

description

Bounded operator-facing summary

string

display_name

required

Human-readable name

string

downstream_use_policy

Allowed uses for outputs

string

dpa_reference

Required for cross-tenant unless waived

string

dpia_reference

Required for high-risk or person-affecting programs

string

effective_from

Optional

string format: date-time

effective_to

Optional

string format: date-time

governance_tier

required

Governance tier

string

Allowed values: internal_portfolio cross_tenant_network consortium_governed high_risk_review

legal_basis_summary

Bounded summary

string

minimum_local_runner_version

Optional program-wide hard floor for local-runner semver; contributions below this are rejected at action time

string

owner_ref

Consortium / operator governance reference when owner is not single-tenant

string

owner_scope

required

tenant / consortium / aerandil_managed

string

Allowed values: tenant consortium aerandil_managed

participant_benefit_policy

What participants receive in return

string

privacy_budget_period

required

Default budget period

string

Allowed values: run day month quarter year lifetime

publish_status

draft (default) or active

string

Allowed values: draft reviewing active paused deprecated retired

purpose

required

Drives legal / review expectations

string

Allowed values: rate_recommendation_calibration fraud_signal_calibration service_recovery_benchmark agent_quality_benchmark payment_review_benchmark outlet_profitability_benchmark energy_water_waste_benchmark operations_research consortium_standardization reviewed_custom

recommended_local_runner_version

Optional program-wide soft baseline for local-runner semver; contributions below this emit `contribution_runner_version_outdated_warns`

string

review_gate_policy

required

Which definitions / outputs require approval gates (JSON)

return_modified

When true, the response carries modified_objects and modified_links projections — the engine reads the event log inside the same transaction so the projection observes the handler’s own writes.

boolean

target

required

object

id

required

string format: uuid

object_type

required

Allowed value: hospitality.property

Responses

200

Rollup deltas the action would contribute, computed and rolled back.

Media typeapplication/json

object

daily_rooms

required

Per (property, business_date) additive contribution to the rooms rollup.

Array<object>

object

business_date

required

string format: date

currency

ISO 4217, when the fold observed one.

string

property_id

required

string format: uuid

rooms_revenue_net_delta

required

Decimal, net rooms revenue delta.

string

rooms_sold_delta

required

integer format: int64

total_revenue_net_delta

required

Decimal, net total revenue delta.

string

Example^generated

{
  "daily_rooms": [
    {
      "business_date": "2026-04-15",
      "currency": "example",
      "property_id": "2489E9AD-2EE2-8E00-8EC9-32D5F69181C0",
      "rooms_revenue_net_delta": "example",
      "rooms_sold_delta": 1,
      "total_revenue_net_delta": "example"
    }
  ]
}

Headers

Cache-Control

string

Allowed value: no-store

Always no-store — derived, uncommitted data.

422

Validation error — the apply would be rejected.