Skip to main content
POST
cURL

Authorizations

Authorization
string
header
required

A short-lived partner token, obtained by exchanging your API key at POST /token. Send it as Authorization: Bearer <access_token>.

Tokens live for fifteen minutes by default and never for more than an hour. Mint one per batch of work, not one per request.

The token carries the workspace and the environment its key was issued for. You cannot change either by asking: the exchange ignores everything in the request body for exactly that reason.

It also carries the key's scopes (scope, a list). Every operation names a scope as x-maat-scope, and a token whose key lacks it is refused with 403 insufficient_scope, naming the scope. Scopes are fixed when a key is issued and are re-read from the key on every request, so a key narrowed today is narrowed on its next call — the token's scope is what the key held at exchange time, for your own reading, never what authorizes a request.

x-maat-scope is the floor, and on the quick-action operations it is not the whole requirement. PUT and DELETE /listings/{listing_id}/quick-actions/{template_key} carry rules:write, and additionally require pricing:write when template_key begins pricing. — the capability depends on the template in the path, because a cleaning fee changes what a guest pays and a minimum stay does not. The refusal is the same 403 insufficient_scope, naming pricing:write. The two READS apply the same requirement without erroring: GET /listings/{listing_id}/quick-actions still lists the pricing.* rows but withholds their applied state, and GET /listings/{listing_id}/rules omits the pricing rules entirely and reports pricing_withheld in warnings. These four are the only operations in this document whose requirement is not exactly their x-maat-scope, and each of them says so machine-readably: x-maat-scope-additional lists the second scope it can require and x-maat-scope-additional-when says what happens without it.

Never send it as a cookie or in a query string, and never store it — store the API key, mint tokens from it.

Path Parameters

review_id
string<uuid>
required

Maat's id for the review.

Body

application/json

One field. There is no author and there cannot be: a reply is published as the WORKSPACE, exactly as the host app publishes it, and letting a caller name an author would put a person's name on public content through an API key.

body
string
required

The reply to publish. One workspace reply per review; a second is a 409 conflict.

Required string length: 1 - 2000

Response

The review, read back with its reply on it.

The review, read back with its reply on it — the bare object.

review_id
string<uuid>
required

Maat's id for the review.

listing_id
string<uuid>
required

The listing the review is about.

reviewer_name
string
required

The shortened public label ("Sarah M."), never the full name.

Example:

"Sarah M."

rating
number
required

The overall score.

comment
string
required

What the guest wrote, in its public form. Empty string when they left a score and no words.

categories
DeveloperReviewCategoryScore · object[]
required

The per-axis scores behind the overall rating.

created_at
string<date-time>
required

When the review was published.

reply
DeveloperReviewReply · object | null
required

The workspace's one reply, or null when there is none yet.

console_url
string<uri>
required

The host console's page for this listing's reputation.