Publication, availability and privacy

Draft — source-reviewed on 22 October 2026. Publication state and withdrawal behavior have not been verified against a live environment.

When a property is publicly eligible

The reviewed query requires all three conditions:

The canonical property status is PUBLISHED.
Its publication for the site channel is PUBLISHED.
That site channel is active.

Publishing to another portal or adding a catalog placement does not satisfy site publication. A pending/failed/unpublished site record does not qualify. A listing can also lack a valid public point and be absent from search despite having eligible detail.

Source defaults leave the public API and public media disabled. This draft does not change publication settings or assert that anything is deployed.

Availability means eligibility, not a booking calendar

operations on detail describes supported sale/rental contexts; prices contains available valid operation prices. The DTO does not expose booking-date availability, reservation inventory, a publication status field or a general availability object. Do not advertise a particular date as available from these fields alone.

A detail request for a currently ineligible or unknown property returns 404. A previously visible property can disappear after withdrawal or a status change. A supported operation with unknown price can still appear; render an intentional price-unavailable state rather than making up an amount.

Location visibility

Search requires a valid permitted public point within the configured destination and selected shape. Full visibility can return an exact public point; street-level visibility returns an approximate fixed-grid point; hidden visibility returns no point. Detail may still be available for a hidden-location property and omit both location and address_line.

This distinction must survive the UI: hide the map/address when unavailable, label approximate positions and never recover prohibited exact coordinates from another service. See Location and LocalAreas and Search and map privacy.

Field visibility boundary

Data class	Website treatment
Public website fields	Only documented summary/detail/reference/media/agent allowlists may be consumed.
Internal CRM fields	No owner/private contact, internal account identity, document links, assignment history, operational notes or protected storage data should be requested or guessed.
Private investment profile	Private analysis values and notes are excluded from public DTOs and examples. Do not introduce corresponding response fields or browser calculations based on private data.

Public pricing and public contextual location facts are deliberate allowlisted fields. They do not imply permission to expose related private financial analysis, operational records or exact hidden coordinates.

Withdrawal and cache behavior

Successful data/media responses and errors handled within the public request boundary use Cache-Control: no-store. The outer application exception boundary returns {"detail":"Internal Server Error"} for unexpected 500 responses but may omit this header; do not interpret that limitation as permission to cache them. Property image access re-checks current property eligibility and asset binding before delivery. Public agent images require the current owned, unretired photo of an active user with an enabled public profile, but the standalone endpoint does not require an assignment to a currently published property. Withdrawing the property alone therefore does not revoke an otherwise eligible public agent image. There is no public change feed or tombstone endpoint in the reviewed operation set.

Do not turn the updated_at search filter into a complete synchronization protocol: that timestamp is not even a property response field, and withdrawn listings are no longer returned. Cache invalidation, offline persistence, CDN behavior and any future incremental synchronization need a separately approved design that respects withdrawal.

For current frontend design, keep responses transient, follow HTTP cache controls and refresh current detail before relying on it. A loaded image or previously received JSON cannot be remotely erased from a user's device; do not promise immediate global revocation beyond the server's subsequent eligibility checks.

Required UI states

Distinguish a loading detail, an unavailable listing (404), a temporary failure (503), rate limiting (429), absent price, empty gallery and absent public agent. Do not fill missing personal data using internal profile access or scraped contact information. Show generic website contact options only if separately approved as website configuration.

Related operations

These rules apply to search, detail, property images and agent images. The reference endpoint supplies active public metadata but does not authorize access to a property. See Errors and pagination.