curl --fail-with-body -X PUT https://maatstays.wtf/v1/properties/3c9d1f42-7b60-4a18-9e55-0d2a6f8c31b7/photos/order \
  -H "Authorization: Bearer $MAAT_PARTNER_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"photo_ids": ["0f2b9c81-4a7e-4d33-9b10-2c7e5a6f1d94", "9a4e77b0-1c2d-4e5f-8a91-3b6c0d7e2f45"]}'

// Read first: the list has to be COMPLETE, so build it from what we hold.
const listed = await fetch(
    'https://maatstays.wtf/v1/properties/3c9d1f42-7b60-4a18-9e55-0d2a6f8c31b7/photos',
    { headers: { Authorization: `Bearer ${process.env.MAAT_PARTNER_TOKEN}` } },
).then((r) => r.json());

const ready = listed.items.filter((p) => p.state === 'ready').map((p) => p.photo_id);
const [promote, ...rest] = ready.reverse();

const res = await fetch(
    'https://maatstays.wtf/v1/properties/3c9d1f42-7b60-4a18-9e55-0d2a6f8c31b7/photos/order',
    {
        method: 'PUT',
        headers: {
            Authorization: `Bearer ${process.env.MAAT_PARTNER_TOKEN}`,
            'Content-Type': 'application/json',
        },
        body: JSON.stringify({ photo_ids: [promote, ...rest] }),
    },
);

const body = await res.json();
if (!res.ok) throw new Error(`${body.code}: ${body.detail}`);
console.log(body.items[0].photo_id, body.items[0].is_cover);

import os

import requests

base = "https://maatstays.wtf/v1/properties/3c9d1f42-7b60-4a18-9e55-0d2a6f8c31b7/photos"
auth = {"Authorization": f"Bearer {os.environ['MAAT_PARTNER_TOKEN']}"}

# Read first: the list has to be COMPLETE, so build it from what we hold.
listed = requests.get(base, headers=auth, timeout=30).json()
ready = [p["photo_id"] for p in listed["items"] if p["state"] == "ready"]
ordered = list(reversed(ready))

res = requests.put(
    f"{base}/order", headers=auth, json={"photo_ids": ordered}, timeout=30
)

body = res.json()
if res.status_code >= 400:
    raise RuntimeError(f"{body['code']}: {body.get('detail')}")

print(body["items"][0]["photo_id"], body["items"][0]["is_cover"])

package main

import (
    "bytes"
    "encoding/json"
    "fmt"
    "log"
    "net/http"
    "os"
)

const base = "https://maatstays.wtf/v1/properties/3c9d1f42-7b60-4a18-9e55-0d2a6f8c31b7/photos"

type photo struct {
    PhotoID string `json:"photo_id"`
    IsCover bool   `json:"is_cover"`
    State   string `json:"state"`
}

type strip struct {
    Items []photo `json:"items"`
}

func send(method, url string, payload []byte) strip {
    req, _ := http.NewRequest(method, url, bytes.NewReader(payload))
    req.Header.Set("Authorization", "Bearer "+os.Getenv("MAAT_PARTNER_TOKEN"))
    if payload != nil {
        req.Header.Set("Content-Type", "application/json")
    }

    res, err := http.DefaultClient.Do(req)
    if err != nil {
        log.Fatal(err)
    }
    defer res.Body.Close()
    if res.StatusCode >= 400 {
        log.Fatalf("%s %s failed: %d", method, url, res.StatusCode)
    }

    var body strip
    if err := json.NewDecoder(res.Body).Decode(&body); err != nil {
        log.Fatal(err)
    }
    return body
}

func main() {
    // Read first: the list has to be COMPLETE, so build it from what we hold.
    listed := send(http.MethodGet, base, nil)

    ready := []string{}
    for _, p := range listed.Items {
        if p.State == "ready" {
            ready = append(ready, p.PhotoID)
        }
    }
    for i, j := 0, len(ready)-1; i < j; i, j = i+1, j-1 {
        ready[i], ready[j] = ready[j], ready[i]
    }

    payload, _ := json.Marshal(map[string]any{"photo_ids": ready})
    ordered := send(http.MethodPut, base+"/order", payload)
    fmt.Println(ordered.Items[0].PhotoID, ordered.Items[0].IsCover)
}