curl --fail-with-body "https://maatstays.wtf/v1/listings/7c4b1e58-2a90-4f61-b3d2-5e8a1c0f7d24/rates?from=2026-12-20&to=2026-12-31" \
-H "Authorization: Bearer $MAAT_PARTNER_TOKEN"const url = new URL('https://maatstays.wtf/v1/listings/7c4b1e58-2a90-4f61-b3d2-5e8a1c0f7d24/rates');
url.searchParams.set('from', '2026-12-20');
url.searchParams.set('to', '2026-12-31');
const res = await fetch(url, {
headers: { Authorization: `Bearer ${process.env.MAAT_PARTNER_TOKEN}` },
});
const body = await res.json();
if (!res.ok) throw new Error(`${body.code}: ${body.detail}`);
for (const night of body.items) {
console.log(night.night, night.nightly_rate.value, night.min_stay);
}
import os
import requests
res = requests.get(
"https://maatstays.wtf/v1/listings/7c4b1e58-2a90-4f61-b3d2-5e8a1c0f7d24/rates",
params={"from": "2026-12-20", "to": "2026-12-31"},
headers={"Authorization": f"Bearer {os.environ['MAAT_PARTNER_TOKEN']}"},
timeout=30,
)
body = res.json()
if res.status_code >= 400:
raise RuntimeError(f"{body['code']}: {body.get('detail')}")
for night in body["items"]:
print(night["night"], night["nightly_rate"]["value"])
package main
import (
"encoding/json"
"fmt"
"log"
"net/http"
"os"
)
func main() {
req, _ := http.NewRequest(http.MethodGet, "https://maatstays.wtf/v1/listings/7c4b1e58-2a90-4f61-b3d2-5e8a1c0f7d24/rates?from=2026-12-20&to=2026-12-31", nil)
req.Header.Set("Authorization", "Bearer "+os.Getenv("MAAT_PARTNER_TOKEN"))
res, err := http.DefaultClient.Do(req)
if err != nil {
log.Fatal(err)
}
defer res.Body.Close()
if res.StatusCode != http.StatusOK {
var problem struct {
Code string `json:"code"`
Detail string `json:"detail"`
}
_ = json.NewDecoder(res.Body).Decode(&problem)
log.Fatalf("%d %s: %s", res.StatusCode, problem.Code, problem.Detail)
}
var body struct {
Items []struct {
Night string `json:"night"`
NightlyRate struct {
Value string `json:"value"`
} `json:"nightly_rate"`
} `json:"items"`
}
if err := json.NewDecoder(res.Body).Decode(&body); err != nil {
log.Fatal(err)
}
fmt.Println(len(body.Items))
}
{
"listing_id": "7c4b1e58-2a90-4f61-b3d2-5e8a1c0f7d24",
"items": [
{
"night": "2026-12-20",
"nightly_rate": {
"value": "1450.00",
"currency": "EGP"
},
"min_stay": 3
},
{
"night": "2026-12-21",
"nightly_rate": {
"value": "1450.00",
"currency": "EGP"
},
"min_stay": 3
}
],
"currency": "EGP",
"mode": "partner",
"binding": true,
"coverage_until": "2026-12-31"
}Read back the rates you sent
The nights you sent for this listing, over an inclusive window of at most 366 nights.
This is a receipt: nothing on it is something Maat holds that you did not send.
You never read a rate this platform derived on its own. If the listing is priced by another source you
still read back your own rows — they are simply not in force, which binding
tells you.
A night you never sent is absent, not zero.
Live in a sandbox workspace. Returns 501 against a production one, where
nothing is read.
curl --fail-with-body "https://maatstays.wtf/v1/listings/7c4b1e58-2a90-4f61-b3d2-5e8a1c0f7d24/rates?from=2026-12-20&to=2026-12-31" \
-H "Authorization: Bearer $MAAT_PARTNER_TOKEN"const url = new URL('https://maatstays.wtf/v1/listings/7c4b1e58-2a90-4f61-b3d2-5e8a1c0f7d24/rates');
url.searchParams.set('from', '2026-12-20');
url.searchParams.set('to', '2026-12-31');
const res = await fetch(url, {
headers: { Authorization: `Bearer ${process.env.MAAT_PARTNER_TOKEN}` },
});
const body = await res.json();
if (!res.ok) throw new Error(`${body.code}: ${body.detail}`);
for (const night of body.items) {
console.log(night.night, night.nightly_rate.value, night.min_stay);
}
import os
import requests
res = requests.get(
"https://maatstays.wtf/v1/listings/7c4b1e58-2a90-4f61-b3d2-5e8a1c0f7d24/rates",
params={"from": "2026-12-20", "to": "2026-12-31"},
headers={"Authorization": f"Bearer {os.environ['MAAT_PARTNER_TOKEN']}"},
timeout=30,
)
body = res.json()
if res.status_code >= 400:
raise RuntimeError(f"{body['code']}: {body.get('detail')}")
for night in body["items"]:
print(night["night"], night["nightly_rate"]["value"])
package main
import (
"encoding/json"
"fmt"
"log"
"net/http"
"os"
)
func main() {
req, _ := http.NewRequest(http.MethodGet, "https://maatstays.wtf/v1/listings/7c4b1e58-2a90-4f61-b3d2-5e8a1c0f7d24/rates?from=2026-12-20&to=2026-12-31", nil)
req.Header.Set("Authorization", "Bearer "+os.Getenv("MAAT_PARTNER_TOKEN"))
res, err := http.DefaultClient.Do(req)
if err != nil {
log.Fatal(err)
}
defer res.Body.Close()
if res.StatusCode != http.StatusOK {
var problem struct {
Code string `json:"code"`
Detail string `json:"detail"`
}
_ = json.NewDecoder(res.Body).Decode(&problem)
log.Fatalf("%d %s: %s", res.StatusCode, problem.Code, problem.Detail)
}
var body struct {
Items []struct {
Night string `json:"night"`
NightlyRate struct {
Value string `json:"value"`
} `json:"nightly_rate"`
} `json:"items"`
}
if err := json.NewDecoder(res.Body).Decode(&body); err != nil {
log.Fatal(err)
}
fmt.Println(len(body.Items))
}
{
"listing_id": "7c4b1e58-2a90-4f61-b3d2-5e8a1c0f7d24",
"items": [
{
"night": "2026-12-20",
"nightly_rate": {
"value": "1450.00",
"currency": "EGP"
},
"min_stay": 3
},
{
"night": "2026-12-21",
"nightly_rate": {
"value": "1450.00",
"currency": "EGP"
},
"min_stay": 3
}
],
"currency": "EGP",
"mode": "partner",
"binding": true,
"coverage_until": "2026-12-31"
}Authorizations
A short-lived partner token, obtained by exchanging your API key at
POST /token. Send it as Authorization: Bearer <access_token>.
Tokens live for fifteen minutes by default and never for more than an hour. Mint one per batch of work, not one per request.
The token carries the workspace and the environment its key was issued for. You cannot change either by asking: the exchange ignores everything in the request body for exactly that reason.
It also carries the key's scopes (scope, a list). Every operation names a
scope as x-maat-scope, and a token whose key lacks it is refused with
403 insufficient_scope, naming the scope. Scopes are fixed when a key is
issued and are re-read from the key on every request, so a key narrowed today is
narrowed on its next call — the token's scope is what the key held at exchange
time, for your own reading, never what authorizes a request.
x-maat-scope is the floor, and on the quick-action operations it is not the
whole requirement. PUT and DELETE /listings/{listing_id}/quick-actions/{template_key}
carry rules:write, and additionally require pricing:write when
template_key begins pricing. — the capability depends on the template in
the path, because a cleaning fee changes what a guest pays and a minimum stay
does not. The refusal is the same 403 insufficient_scope, naming
pricing:write. The two READS apply the same requirement without erroring:
GET /listings/{listing_id}/quick-actions still lists the pricing.* rows but
withholds their applied state, and GET /listings/{listing_id}/rules omits the
pricing rules entirely and reports pricing_withheld in warnings. These four
are the only operations in this document whose requirement is not exactly their
x-maat-scope, and each of them says so machine-readably:
x-maat-scope-additional lists the second scope it can require and
x-maat-scope-additional-when says what happens without it.
Never send it as a cookie or in a query string, and never store it — store the API key, mint tokens from it.
Path Parameters
Maat's identifier for the listing.
Query Parameters
First night to read, inclusive.
Last night to read, inclusive. At most 366 nights after from.
Response
Your own rates for the window.
The listing these rates belong to.
Only nights YOU sent, in date order. A night you never sent is absent, not zero. Not paged — the window is the bound, so there is no has_more here.
Show child attributes
Show child attributes
The listing's currency, which is the currency of every night below; null when there are no nights. It cannot disagree with a night's own nightly_rate.currency — a rate in another currency is refused on the way in — and where you are reading a single amount, the one on the amount is the one to use. It is repeated here so a caller that renders a heading over an empty or partial window has one to render.
^[A-Z]{3}$"EGP"
Whether these rates are what a guest is currently quoted.
true
Last night of the CONTIGUOUS run of your own rates that starts today,
or null when you have not priced tonight. Not the furthest night you
have priced: a horizon with a hole in it is not covered past the hole.
It describes YOUR calendar whether or not you hold the pricing mode, and
it is the same number PUT /v1/listings/{listing_id}/rates returns — so
pushing and reading straight back always agree. Whether those nights are
in force is binding and mode, never this field.
"2027-01-31"