curl --fail-with-body "https://maatstays.wtf/v1/listings/7c4b1e58-2a90-4f61-b3d2-5e8a1c0f7d24/pricing-mode" \
-H "Authorization: Bearer $MAAT_PARTNER_TOKEN"const res = await fetch('https://maatstays.wtf/v1/listings/7c4b1e58-2a90-4f61-b3d2-5e8a1c0f7d24/pricing-mode', {
headers: { Authorization: `Bearer ${process.env.MAAT_PARTNER_TOKEN}` },
});
const body = await res.json();
if (!res.ok) throw new Error(`${body.code}: ${body.detail}`);
// `owned_by_you` is absent unless you hold the mode.
if (body.owned_by_you) console.log('priced through', body.coverage_until);
import os
import requests
res = requests.get(
"https://maatstays.wtf/v1/listings/7c4b1e58-2a90-4f61-b3d2-5e8a1c0f7d24/pricing-mode",
headers={"Authorization": f"Bearer {os.environ['MAAT_PARTNER_TOKEN']}"},
timeout=30,
)
body = res.json()
if res.status_code >= 400:
raise RuntimeError(f"{body['code']}: {body.get('detail')}")
if body.get("owned_by_you"):
print("priced through", body["coverage_until"])
package main
import (
"encoding/json"
"fmt"
"log"
"net/http"
"os"
)
func main() {
req, _ := http.NewRequest(http.MethodGet, "https://maatstays.wtf/v1/listings/7c4b1e58-2a90-4f61-b3d2-5e8a1c0f7d24/pricing-mode", nil)
req.Header.Set("Authorization", "Bearer "+os.Getenv("MAAT_PARTNER_TOKEN"))
res, err := http.DefaultClient.Do(req)
if err != nil {
log.Fatal(err)
}
defer res.Body.Close()
if res.StatusCode != http.StatusOK {
var problem struct {
Code string `json:"code"`
Detail string `json:"detail"`
}
_ = json.NewDecoder(res.Body).Decode(&problem)
log.Fatalf("%d %s: %s", res.StatusCode, problem.Code, problem.Detail)
}
var body struct {
Mode string `json:"mode"`
OwnedByYou bool `json:"owned_by_you"`
CoverageUntil string `json:"coverage_until"`
}
if err := json.NewDecoder(res.Body).Decode(&body); err != nil {
log.Fatal(err)
}
fmt.Println(body.Mode, body.OwnedByYou, body.CoverageUntil)
}
{
"listing_id": "7c4b1e58-2a90-4f61-b3d2-5e8a1c0f7d24",
"mode": "partner",
"owned_by_you": true,
"coverage_until": "2026-12-31",
"currency": "EGP",
"last_received_at": "2026-09-01T09:14:22Z"
}Who prices this listing
What prices this listing right now.
mode | Meaning |
|---|---|
rules | Maat’s own pricing rules. Your rates, if any, are stored and inert. |
partner | You do. owned_by_you is true and the horizon fields are filled. |
external | Something else does. |
external is deliberately undifferentiated: this API reports that another source
prices the listing, never which one. You see your own horizon or you see nothing.
last_received_at is when you last sent a rate for this listing. It is the
field to watch: if your credentials are revoked the mode does not silently
change hands, so a horizon can run out night by night with nobody re-pushing.
Live in a sandbox workspace. Returns 501 against a production one, where
nothing is read.
curl --fail-with-body "https://maatstays.wtf/v1/listings/7c4b1e58-2a90-4f61-b3d2-5e8a1c0f7d24/pricing-mode" \
-H "Authorization: Bearer $MAAT_PARTNER_TOKEN"const res = await fetch('https://maatstays.wtf/v1/listings/7c4b1e58-2a90-4f61-b3d2-5e8a1c0f7d24/pricing-mode', {
headers: { Authorization: `Bearer ${process.env.MAAT_PARTNER_TOKEN}` },
});
const body = await res.json();
if (!res.ok) throw new Error(`${body.code}: ${body.detail}`);
// `owned_by_you` is absent unless you hold the mode.
if (body.owned_by_you) console.log('priced through', body.coverage_until);
import os
import requests
res = requests.get(
"https://maatstays.wtf/v1/listings/7c4b1e58-2a90-4f61-b3d2-5e8a1c0f7d24/pricing-mode",
headers={"Authorization": f"Bearer {os.environ['MAAT_PARTNER_TOKEN']}"},
timeout=30,
)
body = res.json()
if res.status_code >= 400:
raise RuntimeError(f"{body['code']}: {body.get('detail')}")
if body.get("owned_by_you"):
print("priced through", body["coverage_until"])
package main
import (
"encoding/json"
"fmt"
"log"
"net/http"
"os"
)
func main() {
req, _ := http.NewRequest(http.MethodGet, "https://maatstays.wtf/v1/listings/7c4b1e58-2a90-4f61-b3d2-5e8a1c0f7d24/pricing-mode", nil)
req.Header.Set("Authorization", "Bearer "+os.Getenv("MAAT_PARTNER_TOKEN"))
res, err := http.DefaultClient.Do(req)
if err != nil {
log.Fatal(err)
}
defer res.Body.Close()
if res.StatusCode != http.StatusOK {
var problem struct {
Code string `json:"code"`
Detail string `json:"detail"`
}
_ = json.NewDecoder(res.Body).Decode(&problem)
log.Fatalf("%d %s: %s", res.StatusCode, problem.Code, problem.Detail)
}
var body struct {
Mode string `json:"mode"`
OwnedByYou bool `json:"owned_by_you"`
CoverageUntil string `json:"coverage_until"`
}
if err := json.NewDecoder(res.Body).Decode(&body); err != nil {
log.Fatal(err)
}
fmt.Println(body.Mode, body.OwnedByYou, body.CoverageUntil)
}
{
"listing_id": "7c4b1e58-2a90-4f61-b3d2-5e8a1c0f7d24",
"mode": "partner",
"owned_by_you": true,
"coverage_until": "2026-12-31",
"currency": "EGP",
"last_received_at": "2026-09-01T09:14:22Z"
}Authorizations
A short-lived partner token, obtained by exchanging your API key at
POST /token. Send it as Authorization: Bearer <access_token>.
Tokens live for fifteen minutes by default and never for more than an hour. Mint one per batch of work, not one per request.
The token carries the workspace and the environment its key was issued for. You cannot change either by asking: the exchange ignores everything in the request body for exactly that reason.
It also carries the key's scopes (scope, a list). Every operation names a
scope as x-maat-scope, and a token whose key lacks it is refused with
403 insufficient_scope, naming the scope. Scopes are fixed when a key is
issued and are re-read from the key on every request, so a key narrowed today is
narrowed on its next call — the token's scope is what the key held at exchange
time, for your own reading, never what authorizes a request.
x-maat-scope is the floor, and on the quick-action operations it is not the
whole requirement. PUT and DELETE /listings/{listing_id}/quick-actions/{template_key}
carry rules:write, and additionally require pricing:write when
template_key begins pricing. — the capability depends on the template in
the path, because a cleaning fee changes what a guest pays and a minimum stay
does not. The refusal is the same 403 insufficient_scope, naming
pricing:write. The two READS apply the same requirement without erroring:
GET /listings/{listing_id}/quick-actions still lists the pricing.* rows but
withholds their applied state, and GET /listings/{listing_id}/rules omits the
pricing rules entirely and reports pricing_withheld in warnings. These four
are the only operations in this document whose requirement is not exactly their
x-maat-scope, and each of them says so machine-readably:
x-maat-scope-additional lists the second scope it can require and
x-maat-scope-additional-when says what happens without it.
Never send it as a cookie or in a query string, and never store it — store the API key, mint tokens from it.
Path Parameters
Maat's identifier for the listing.
Response
The listing's pricing mode, as far as you are entitled to see it.
Who prices this listing.
Everything past mode is present ONLY when you own it. A caller that does not
gets two fields and no way to tell one external source from another.
The listing this mode is about.
Present and true only when you hold the mode.
true
The last night a rate has been sent for, or null when none has.
"2027-01-31"
Present only when you hold the mode. true when a night past coverage_until, or any night you have not priced, is quoted at the host's base price rather than refused.
true
The currency every rate on this listing must be in, or null when no mode is held.
^[A-Z]{3}$"EGP"
When YOU last sent a rate for this listing. Watch it: revoking your own credentials does not release the mode, so a horizon can run out night by night with nobody re-pushing.
"2026-09-01T09:14:22Z"