curl --fail-with-body -X POST https://maatstays.wtf/v1/reviews/2b1c3d4e-5f60-4718-9a2b-3c4d5e6f7081/reply \
-H "Authorization: Bearer $MAAT_PARTNER_TOKEN" \
-H "Content-Type: application/json" \
-d '{"body": "Thank you for staying with us — glad the street was as quiet as promised!"}'
const res = await fetch(
'https://maatstays.wtf/v1/reviews/2b1c3d4e-5f60-4718-9a2b-3c4d5e6f7081/reply',
{
method: 'POST',
headers: {
Authorization: `Bearer ${process.env.MAAT_PARTNER_TOKEN}`,
'Content-Type': 'application/json',
},
body: JSON.stringify({
body: 'Thank you for staying with us — glad the street was as quiet as promised!',
}),
},
);
const body = await res.json();
if (!res.ok) throw new Error(`${body.code}: ${body.detail}`);
console.log(body.reply.created_at);
import os
import requests
res = requests.post(
"https://maatstays.wtf/v1/reviews/2b1c3d4e-5f60-4718-9a2b-3c4d5e6f7081/reply",
headers={"Authorization": f"Bearer {os.environ['MAAT_PARTNER_TOKEN']}"},
json={
"body": "Thank you for staying with us — glad the street was as quiet as promised!",
},
timeout=30,
)
body = res.json()
if res.status_code >= 400:
raise RuntimeError(f"{body['code']}: {body.get('detail')}")
print(body["reply"]["created_at"])
package main
import (
"bytes"
"encoding/json"
"fmt"
"log"
"net/http"
"os"
)
type reply struct {
CreatedAt string `json:"created_at"`
}
type reviewView struct {
Reply reply `json:"reply"`
}
func main() {
body, _ := json.Marshal(map[string]string{
"body": "Thank you for staying with us — glad the street was as quiet as promised!",
})
req, _ := http.NewRequest(http.MethodPost,
"https://maatstays.wtf/v1/reviews/2b1c3d4e-5f60-4718-9a2b-3c4d5e6f7081/reply",
bytes.NewReader(body))
req.Header.Set("Authorization", "Bearer "+os.Getenv("MAAT_PARTNER_TOKEN"))
req.Header.Set("Content-Type", "application/json")
res, err := http.DefaultClient.Do(req)
if err != nil {
log.Fatal(err)
}
defer res.Body.Close()
if res.StatusCode >= 400 {
log.Fatalf("reply failed: %d", res.StatusCode)
}
var out reviewView
if err := json.NewDecoder(res.Body).Decode(&out); err != nil {
log.Fatal(err)
}
fmt.Println(out.Reply.CreatedAt)
}
Reply to a review, as the workspace
Posts a reply to a review, published as the workspace — exactly as the host
app publishes one. There is no author field and there cannot be: letting a
caller name an author would put a person’s name on public content through an API
key.
One field: body, 1 to 2000 characters. The request is strict — an undeclared
field is a 400 validation_failed naming it, never a silent drop.
One workspace reply per review over this API. 409 conflict when the review
already has one; edit it in the host app instead. 404 review_not_found is ONE
answer for “no such review” and “not in your workspace”.
A 403 on this operation carries one of two codes — insufficient_scope (the
key lacks reviews:reply) or workspace_scope_mismatch (a sandbox/production
mismatch). Branch on code.
Live in a sandbox workspace. Returns 501 against a production one.
curl --fail-with-body -X POST https://maatstays.wtf/v1/reviews/2b1c3d4e-5f60-4718-9a2b-3c4d5e6f7081/reply \
-H "Authorization: Bearer $MAAT_PARTNER_TOKEN" \
-H "Content-Type: application/json" \
-d '{"body": "Thank you for staying with us — glad the street was as quiet as promised!"}'
const res = await fetch(
'https://maatstays.wtf/v1/reviews/2b1c3d4e-5f60-4718-9a2b-3c4d5e6f7081/reply',
{
method: 'POST',
headers: {
Authorization: `Bearer ${process.env.MAAT_PARTNER_TOKEN}`,
'Content-Type': 'application/json',
},
body: JSON.stringify({
body: 'Thank you for staying with us — glad the street was as quiet as promised!',
}),
},
);
const body = await res.json();
if (!res.ok) throw new Error(`${body.code}: ${body.detail}`);
console.log(body.reply.created_at);
import os
import requests
res = requests.post(
"https://maatstays.wtf/v1/reviews/2b1c3d4e-5f60-4718-9a2b-3c4d5e6f7081/reply",
headers={"Authorization": f"Bearer {os.environ['MAAT_PARTNER_TOKEN']}"},
json={
"body": "Thank you for staying with us — glad the street was as quiet as promised!",
},
timeout=30,
)
body = res.json()
if res.status_code >= 400:
raise RuntimeError(f"{body['code']}: {body.get('detail')}")
print(body["reply"]["created_at"])
package main
import (
"bytes"
"encoding/json"
"fmt"
"log"
"net/http"
"os"
)
type reply struct {
CreatedAt string `json:"created_at"`
}
type reviewView struct {
Reply reply `json:"reply"`
}
func main() {
body, _ := json.Marshal(map[string]string{
"body": "Thank you for staying with us — glad the street was as quiet as promised!",
})
req, _ := http.NewRequest(http.MethodPost,
"https://maatstays.wtf/v1/reviews/2b1c3d4e-5f60-4718-9a2b-3c4d5e6f7081/reply",
bytes.NewReader(body))
req.Header.Set("Authorization", "Bearer "+os.Getenv("MAAT_PARTNER_TOKEN"))
req.Header.Set("Content-Type", "application/json")
res, err := http.DefaultClient.Do(req)
if err != nil {
log.Fatal(err)
}
defer res.Body.Close()
if res.StatusCode >= 400 {
log.Fatalf("reply failed: %d", res.StatusCode)
}
var out reviewView
if err := json.NewDecoder(res.Body).Decode(&out); err != nil {
log.Fatal(err)
}
fmt.Println(out.Reply.CreatedAt)
}
Authorizations
A short-lived partner token, obtained by exchanging your API key at
POST /token. Send it as Authorization: Bearer <access_token>.
Tokens live for fifteen minutes by default and never for more than an hour. Mint one per batch of work, not one per request.
The token carries the workspace and the environment its key was issued for. You cannot change either by asking: the exchange ignores everything in the request body for exactly that reason.
It also carries the key's scopes (scope, a list). Every operation names a
scope as x-maat-scope, and a token whose key lacks it is refused with
403 insufficient_scope, naming the scope. Scopes are fixed when a key is
issued and are re-read from the key on every request, so a key narrowed today is
narrowed on its next call — the token's scope is what the key held at exchange
time, for your own reading, never what authorizes a request.
x-maat-scope is the floor, and on the quick-action operations it is not the
whole requirement. PUT and DELETE /listings/{listing_id}/quick-actions/{template_key}
carry rules:write, and additionally require pricing:write when
template_key begins pricing. — the capability depends on the template in
the path, because a cleaning fee changes what a guest pays and a minimum stay
does not. The refusal is the same 403 insufficient_scope, naming
pricing:write. The two READS apply the same requirement without erroring:
GET /listings/{listing_id}/quick-actions still lists the pricing.* rows but
withholds their applied state, and GET /listings/{listing_id}/rules omits the
pricing rules entirely and reports pricing_withheld in warnings. These four
are the only operations in this document whose requirement is not exactly their
x-maat-scope, and each of them says so machine-readably:
x-maat-scope-additional lists the second scope it can require and
x-maat-scope-additional-when says what happens without it.
Never send it as a cookie or in a query string, and never store it — store the API key, mint tokens from it.
Path Parameters
Maat's id for the review.
Body
One field. There is no author and there cannot be: a reply is published as the
WORKSPACE, exactly as the host app publishes it, and letting a caller name an
author would put a person's name on public content through an API key.
The reply to publish. One workspace reply per review; a second is a 409 conflict.
1 - 2000Response
The review, read back with its reply on it.
The review, read back with its reply on it — the bare object.
Maat's id for the review.
The listing the review is about.
The shortened public label ("Sarah M."), never the full name.
"Sarah M."
The overall score.
What the guest wrote, in its public form. Empty string when they left a score and no words.
The per-axis scores behind the overall rating.
Show child attributes
Show child attributes
When the review was published.
The workspace's one reply, or null when there is none yet.
Show child attributes
Show child attributes
The host console's page for this listing's reputation.