What-if Record federated privacy incident (rollup delta)

POST

/v1/actions/hospitality.action.record_federated_privacy_incident/whatif

curl --request POST \
  --url https://api.aerandil.com/v1/actions/hospitality.action.record_federated_privacy_incident/whatif \
  --header 'Authorization: Bearer <token>' \
  --header 'Content-Type: application/json' \
  --data '{ "branch": "2489E9AD-2EE2-8E00-8EC9-32D5F69181C0", "params": { "description": "example", "external_incident_reference": "example", "immediate_actions": "example", "incident_kind": "disclosure_control_failure", "pause_program": true, "severity": "informational", "target_object_id": "example", "target_object_type": "example" }, "return_modified": false, "target": { "id": "2489E9AD-2EE2-8E00-8EC9-32D5F69181C0", "object_type": "hospitality.federated_intelligence_program" } }'

• Production API

What-if projection of apply_hospitality_action_record_federated_privacy_incident — previews the action (execute-and-roll-back) and folds its would-be events into rollup deltas, returning the contribution an apply would make to the daily_rooms fact (ADR / RevPAR / TRevPAR / Occupancy inputs) without persisting anything. Requires the same actions:hospitality.action.record_federated_privacy_incident:apply scope as apply. An action that emits no rooms-fact events yields an empty daily_rooms.

Authorizations

• aerandil_oauth

Request Body^required

Media typeapplication/json

object

branch

Apply against an open branch’s overlay view instead of the canonical (main) plane. The action’s writes land in the branch’s copy-on-first-write overlay, its events in the branch’s own stream, and the invocation is journaled for merge-by-replay. Branch writes are action-only, so this is the write-side entry point to a branch (POST /v1/branches forks one).

string format: uuid

params

required

object

description

required

Bounded text

string

external_incident_reference

External incident ref

string

immediate_actions

Bounded text describing immediate response (e.g. paused program X, quarantined output Y)

string

incident_kind

required

Incident kind

string

Allowed values: disclosure_control_failure small_cohort_singling_out max_contributor_share_breach differencing_attack_suspected model_inversion_suspected membership_inference_suspected secure_aggregation_protocol_failure data_quality_poisoning_suspected legal_basis_change output_inference_attack other_reviewed

pause_program

If true, transitions program status to paused

boolean

severity

required

informational | low | medium | high | critical

string

Allowed values: informational low medium high critical

target_object_id

required

Target object id

string

target_object_type

required

Program / run / contribution / output

string

return_modified

When true, the response carries modified_objects and modified_links projections — the engine reads the event log inside the same transaction so the projection observes the handler’s own writes.

boolean

target

required

object

id

required

string format: uuid

object_type

required

Allowed value: hospitality.federated_intelligence_program

Responses

200

Rollup deltas the action would contribute, computed and rolled back.

Media typeapplication/json

object

daily_rooms

required

Per (property, business_date) additive contribution to the rooms rollup.

Array<object>

object

business_date

required

string format: date

currency

ISO 4217, when the fold observed one.

string

property_id

required

string format: uuid

rooms_revenue_net_delta

required

Decimal, net rooms revenue delta.

string

rooms_sold_delta

required

integer format: int64

total_revenue_net_delta

required

Decimal, net total revenue delta.

string

Example^generated

{
  "daily_rooms": [
    {
      "business_date": "2026-04-15",
      "currency": "example",
      "property_id": "2489E9AD-2EE2-8E00-8EC9-32D5F69181C0",
      "rooms_revenue_net_delta": "example",
      "rooms_sold_delta": 1,
      "total_revenue_net_delta": "example"
    }
  ]
}

Headers

Cache-Control

string

Allowed value: no-store

Always no-store — derived, uncommitted data.

422

Validation error — the apply would be rejected.