curl --fail-with-body -X POST "https://maatstays.wtf/v1/listings/7c4b1e58-2a90-4f61-b3d2-5e8a1c0f7d24/calendar/blocks/release" \
-H "Authorization: Bearer $MAAT_PARTNER_TOKEN" \
-H "Content-Type: application/json" \
-d '{"dates":["2026-09-14"]}'const res = await fetch('https://maatstays.wtf/v1/listings/7c4b1e58-2a90-4f61-b3d2-5e8a1c0f7d24/calendar/blocks/release', {
method: 'POST',
headers: {
Authorization: `Bearer ${process.env.MAAT_PARTNER_TOKEN}`,
'Content-Type': 'application/json',
},
body: JSON.stringify({ dates: ['2026-09-14'] }),
});
if (res.status !== 204) {
const body = await res.json();
throw new Error(`${body.code}: ${body.detail}`);
}
import os
import requests
res = requests.post(
"https://maatstays.wtf/v1/listings/7c4b1e58-2a90-4f61-b3d2-5e8a1c0f7d24/calendar/blocks/release",
headers={"Authorization": f"Bearer {os.environ['MAAT_PARTNER_TOKEN']}"},
json={"dates": ["2026-09-14"]},
timeout=30,
)
if res.status_code != 204:
body = res.json()
raise RuntimeError(f"{body['code']}: {body.get('detail')}")
package main
import (
"bytes"
"encoding/json"
"log"
"net/http"
"os"
)
func main() {
payload, _ := json.Marshal(map[string]any{"dates": []string{"2026-09-14"}})
req, _ := http.NewRequest(http.MethodPost, "https://maatstays.wtf/v1/listings/7c4b1e58-2a90-4f61-b3d2-5e8a1c0f7d24/calendar/blocks/release", bytes.NewReader(payload))
req.Header.Set("Authorization", "Bearer "+os.Getenv("MAAT_PARTNER_TOKEN"))
req.Header.Set("Content-Type", "application/json")
res, err := http.DefaultClient.Do(req)
if err != nil {
log.Fatal(err)
}
defer res.Body.Close()
if res.StatusCode != http.StatusNoContent {
log.Fatalf("release failed: %d", res.StatusCode)
}
}
Release host blocks by date
Open nights that a host block is holding.
A POST on its own sub-resource, because it carries a body. The nights you
are freeing are a SET, not a range, so they cannot ride in the path or the query;
and a DELETE with a body has no defined meaning in HTTP, so clients, proxies and
runtimes are free to drop it — which on this operation would turn “free this one
night” into a request addressed at the whole collection. This operation was a
DELETE on /calendar/blocks before that was noticed; it is the same operation
and keeps the same operationId.
It frees only what a host block holds. A night carrying a Maat booking, a live
hold, a calendar feed’s block or a block you pushed under your own external_uid
is skipped in silence: freeing one would put a sold night back on sale. Release
your own pushed blocks with DELETE /v1/blocks/{external_uid}.
204 whether or not there was anything to release. Releasing a night that carries
no host block is the desired end state, not an error to retry.
Unlike the block, there is no date floor here: tidying up a closure from last month is a legitimate thing to do.
Live in a sandbox workspace. Returns 501 against a production one, where no
block is released and those nights stay unsellable.
curl --fail-with-body -X POST "https://maatstays.wtf/v1/listings/7c4b1e58-2a90-4f61-b3d2-5e8a1c0f7d24/calendar/blocks/release" \
-H "Authorization: Bearer $MAAT_PARTNER_TOKEN" \
-H "Content-Type: application/json" \
-d '{"dates":["2026-09-14"]}'const res = await fetch('https://maatstays.wtf/v1/listings/7c4b1e58-2a90-4f61-b3d2-5e8a1c0f7d24/calendar/blocks/release', {
method: 'POST',
headers: {
Authorization: `Bearer ${process.env.MAAT_PARTNER_TOKEN}`,
'Content-Type': 'application/json',
},
body: JSON.stringify({ dates: ['2026-09-14'] }),
});
if (res.status !== 204) {
const body = await res.json();
throw new Error(`${body.code}: ${body.detail}`);
}
import os
import requests
res = requests.post(
"https://maatstays.wtf/v1/listings/7c4b1e58-2a90-4f61-b3d2-5e8a1c0f7d24/calendar/blocks/release",
headers={"Authorization": f"Bearer {os.environ['MAAT_PARTNER_TOKEN']}"},
json={"dates": ["2026-09-14"]},
timeout=30,
)
if res.status_code != 204:
body = res.json()
raise RuntimeError(f"{body['code']}: {body.get('detail')}")
package main
import (
"bytes"
"encoding/json"
"log"
"net/http"
"os"
)
func main() {
payload, _ := json.Marshal(map[string]any{"dates": []string{"2026-09-14"}})
req, _ := http.NewRequest(http.MethodPost, "https://maatstays.wtf/v1/listings/7c4b1e58-2a90-4f61-b3d2-5e8a1c0f7d24/calendar/blocks/release", bytes.NewReader(payload))
req.Header.Set("Authorization", "Bearer "+os.Getenv("MAAT_PARTNER_TOKEN"))
req.Header.Set("Content-Type", "application/json")
res, err := http.DefaultClient.Do(req)
if err != nil {
log.Fatal(err)
}
defer res.Body.Close()
if res.StatusCode != http.StatusNoContent {
log.Fatalf("release failed: %d", res.StatusCode)
}
}
Authorizations
A short-lived partner token, obtained by exchanging your API key at
POST /token. Send it as Authorization: Bearer <access_token>.
Tokens live for fifteen minutes by default and never for more than an hour. Mint one per batch of work, not one per request.
The token carries the workspace and the environment its key was issued for. You cannot change either by asking: the exchange ignores everything in the request body for exactly that reason.
It also carries the key's scopes (scope, a list). Every operation names a
scope as x-maat-scope, and a token whose key lacks it is refused with
403 insufficient_scope, naming the scope. Scopes are fixed when a key is
issued and are re-read from the key on every request, so a key narrowed today is
narrowed on its next call — the token's scope is what the key held at exchange
time, for your own reading, never what authorizes a request.
x-maat-scope is the floor, and on the quick-action operations it is not the
whole requirement. PUT and DELETE /listings/{listing_id}/quick-actions/{template_key}
carry rules:write, and additionally require pricing:write when
template_key begins pricing. — the capability depends on the template in
the path, because a cleaning fee changes what a guest pays and a minimum stay
does not. The refusal is the same 403 insufficient_scope, naming
pricing:write. The two READS apply the same requirement without erroring:
GET /listings/{listing_id}/quick-actions still lists the pricing.* rows but
withholds their applied state, and GET /listings/{listing_id}/rules omits the
pricing rules entirely and reports pricing_withheld in warnings. These four
are the only operations in this document whose requirement is not exactly their
x-maat-scope, and each of them says so machine-readably:
x-maat-scope-additional lists the second scope it can require and
x-maat-scope-additional-when says what happens without it.
Never send it as a cookie or in a query string, and never store it — store the API key, mint tokens from it.
Path Parameters
Maat's identifier for the listing.
Body
The nights to reopen. Only host blocks are released.
The nights to release. Nights that were not blocked are ignored rather than refused.
1 - 366 elements["2026-09-14"]
Response
The host blocks you named are gone.