# Your endpoint must answer the signed endpoint.challenge we POST
# to it DURING this call — see the webhooks guide.
curl -X PUT https://maatstays.wtf/v1/webhooks/endpoint \
  -H "Authorization: Bearer $MAAT_PARTNER_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "url": "https://hooks.example-partner.invalid/maat",
    "events": ["booking.confirmed", "booking.cancelled", "user.erased"]
  }'

// Your endpoint must answer the signed endpoint.challenge we POST
// to it DURING this call — see the webhooks guide.
const res = await fetch('https://maatstays.wtf/v1/webhooks/endpoint', {
    method: 'PUT',
    headers: {
        Authorization: `Bearer ${process.env.MAAT_PARTNER_TOKEN}`,
        'Content-Type': 'application/json',
    },
    body: JSON.stringify({
        url: 'https://hooks.example-partner.invalid/maat',
        events: ['booking.confirmed', 'booking.cancelled', 'user.erased'],
    }),
});

const body = await res.json();
if (!res.ok) throw new Error(`${body.code}: ${body.detail}`);

if (body.signing_secret) {
    // Present only on the FIRST registration, and never shown again.
    // Store it in your secret manager NOW. Never log it.
}
console.log(body.status); // 'active' once the challenge was echoed

import os

import requests

# Your endpoint must answer the signed endpoint.challenge we POST
# to it DURING this call — see the webhooks guide.
res = requests.put(
    "https://maatstays.wtf/v1/webhooks/endpoint",
    headers={"Authorization": f"Bearer {os.environ['MAAT_PARTNER_TOKEN']}"},
    json={
        "url": "https://hooks.example-partner.invalid/maat",
        "events": ["booking.confirmed", "booking.cancelled", "user.erased"],
    },
    timeout=30,
)

body = res.json()
if res.status_code >= 400:
    raise RuntimeError(f"{body['code']}: {body.get('detail')}")

if "signing_secret" in body:
    # Present only on the FIRST registration, and never shown again.
    # Store it in your secret manager NOW. Never log it.
    pass
print(body["status"])  # 'active' once the challenge was echoed

package main

import (
    "bytes"
    "encoding/json"
    "fmt"
    "log"
    "net/http"
    "os"
)

func main() {
    // Your endpoint must answer the signed endpoint.challenge we POST
    // to it DURING this call — see the webhooks guide.
    payload, _ := json.Marshal(map[string]any{
        "url":    "https://hooks.example-partner.invalid/maat",
        "events": []string{"booking.confirmed", "booking.cancelled", "user.erased"},
    })

    req, _ := http.NewRequest(http.MethodPut,
        "https://maatstays.wtf/v1/webhooks/endpoint",
        bytes.NewReader(payload))
    req.Header.Set("Authorization", "Bearer "+os.Getenv("MAAT_PARTNER_TOKEN"))
    req.Header.Set("Content-Type", "application/json")

    res, err := http.DefaultClient.Do(req)
    if err != nil {
        log.Fatal(err)
    }
    defer res.Body.Close()

    var body map[string]any
    if err := json.NewDecoder(res.Body).Decode(&body); err != nil {
        log.Fatal(err)
    }
    if res.StatusCode >= 400 {
        log.Fatalf("%v: %v", body["code"], body["detail"])
    }

    if _, ok := body["signing_secret"]; ok {
        // Present only on the FIRST registration, and never shown again.
        // Store it in your secret manager NOW. Never log it.
    }
    fmt.Println(body["status"]) // "active" once the challenge was echoed
}

{
  "url": "https://hooks.example-partner.invalid/maat",
  "events": [
    "booking.confirmed",
    "booking.cancelled",
    "user.erased"
  ],
  "status": "active",
  "signing_secret": "whsec_EXAMPLE_0000000000000000000000000000"
}

{
  "type": "https://developer.maatstays.wtf/errors/validation-failed",
  "title": "Validation failed",
  "status": 400,
  "instance": "urn:maat:request:3b1f7a90-0d4c-4d4e-9b2a-6c1f0a2e5d33",
  "code": "validation_failed",
  "errors": [
    {
      "field": "body.check_out",
      "code": "custom"
    }
  ]
}

{
  "type": "https://developer.maatstays.wtf/errors/unauthorized",
  "title": "Unauthorized",
  "status": 401,
  "detail": "A valid partner token is required.",
  "instance": "urn:maat:request:3b1f7a90-0d4c-4d4e-9b2a-6c1f0a2e5d33",
  "code": "unauthorized"
}

{
  "type": "https://developer.maatstays.wtf/errors/workspace-scope-mismatch",
  "title": "Workspace scope mismatch",
  "status": 403,
  "detail": "This token is not valid for the requested workspace.",
  "instance": "urn:maat:request:3b1f7a90-0d4c-4d4e-9b2a-6c1f0a2e5d33",
  "code": "workspace_scope_mismatch"
}

{
  "type": "https://developer.maatstays.wtf/errors/rate-limited",
  "title": "Too many requests",
  "status": 429,
  "detail": "Too many requests for this API key.",
  "instance": "urn:maat:request:3b1f7a90-0d4c-4d4e-9b2a-6c1f0a2e5d33",
  "code": "rate_limited"
}

{
  "type": "https://developer.maatstays.wtf/errors/internal-error",
  "title": "Internal error",
  "status": 500,
  "detail": "The request could not be completed.",
  "instance": "urn:maat:request:3b1f7a90-0d4c-4d4e-9b2a-6c1f0a2e5d33",
  "code": "internal_error"
}

{
  "type": "https://developer.maatstays.wtf/errors/not-enabled",
  "title": "Not implemented",
  "status": 501,
  "detail": "The calendar-blocks contract is published but not yet enabled. This request was authenticated and validated; no dates were blocked. Keep holding these dates on your own platform.",
  "instance": "urn:maat:request:3b1f7a90-0d4c-4d4e-9b2a-6c1f0a2e5d33",
  "code": "not_enabled"
}

{
  "type": "https://developer.maatstays.wtf/errors/service-unavailable",
  "title": "Service unavailable",
  "status": 503,
  "detail": "Webhook delivery is temporarily unavailable. Nothing was registered; retry shortly.",
  "instance": "urn:maat:request:3b1f7a90-0d4c-4d4e-9b2a-6c1f0a2e5d33",
  "code": "service_unavailable"
}