curl --fail-with-body -X DELETE https://maatstays.wtf/v1/webhooks/endpoint \
-H "Authorization: Bearer $MAAT_PARTNER_TOKEN"const res = await fetch('https://maatstays.wtf/v1/webhooks/endpoint', {
method: 'DELETE',
headers: { Authorization: `Bearer ${process.env.MAAT_PARTNER_TOKEN}` },
});
// 204, with no body — whether or not there was one to delete.
if (!res.ok) {
const problem = await res.json();
throw new Error(`${problem.code}: ${problem.detail}`);
}
console.log('deliveries stopped');
import os
import requests
res = requests.delete(
"https://maatstays.wtf/v1/webhooks/endpoint",
headers={"Authorization": f"Bearer {os.environ['MAAT_PARTNER_TOKEN']}"},
timeout=30,
)
# 204, with no body — whether or not there was one to delete.
if res.status_code >= 400:
problem = res.json()
raise RuntimeError(f"{problem['code']}: {problem.get('detail')}")
print("deliveries stopped")
package main
import (
"fmt"
"log"
"net/http"
"os"
)
func main() {
req, _ := http.NewRequest(http.MethodDelete, "https://maatstays.wtf/v1/webhooks/endpoint", nil)
req.Header.Set("Authorization", "Bearer "+os.Getenv("MAAT_PARTNER_TOKEN"))
res, err := http.DefaultClient.Do(req)
if err != nil {
log.Fatal(err)
}
defer res.Body.Close()
// 204, with no body — whether or not there was one to delete.
if res.StatusCode >= 400 {
log.Fatalf("delete failed: %d", res.StatusCode)
}
fmt.Println("deliveries stopped")
}
Delete your endpoint
Deletes your endpoint. Idempotent: deleting one that is already gone is the
same 204, never a 404 — a second delete is not an error, and the answer does
not tell you whether there was one, because acting on that is the 404 handling
idempotency exists to spare you.
This stops delivery and forgets the event subscription. It does NOT throw away
the delivery history — your existing deliveries stay readable through
GET /webhooks/deliveries — and it does not discard the signing secret either,
so a later re-registration keeps working with what you already have stored.
Re-registering after a delete always re-arms the challenge: a URL that verified before is not evidence about the same URL now.
Deliveries still queued for the endpoint are parked failed with
endpoint_removed. Their bodies are kept, so they can be replayed — but only
after you register the endpoint again and answer the challenge; until then a
redrive answers 409 conflict. Deleting also starts the payload-retention clock
those rows were exempt from while they were queued.
Live in a sandbox workspace. Returns 501 against a production one.
curl --fail-with-body -X DELETE https://maatstays.wtf/v1/webhooks/endpoint \
-H "Authorization: Bearer $MAAT_PARTNER_TOKEN"const res = await fetch('https://maatstays.wtf/v1/webhooks/endpoint', {
method: 'DELETE',
headers: { Authorization: `Bearer ${process.env.MAAT_PARTNER_TOKEN}` },
});
// 204, with no body — whether or not there was one to delete.
if (!res.ok) {
const problem = await res.json();
throw new Error(`${problem.code}: ${problem.detail}`);
}
console.log('deliveries stopped');
import os
import requests
res = requests.delete(
"https://maatstays.wtf/v1/webhooks/endpoint",
headers={"Authorization": f"Bearer {os.environ['MAAT_PARTNER_TOKEN']}"},
timeout=30,
)
# 204, with no body — whether or not there was one to delete.
if res.status_code >= 400:
problem = res.json()
raise RuntimeError(f"{problem['code']}: {problem.get('detail')}")
print("deliveries stopped")
package main
import (
"fmt"
"log"
"net/http"
"os"
)
func main() {
req, _ := http.NewRequest(http.MethodDelete, "https://maatstays.wtf/v1/webhooks/endpoint", nil)
req.Header.Set("Authorization", "Bearer "+os.Getenv("MAAT_PARTNER_TOKEN"))
res, err := http.DefaultClient.Do(req)
if err != nil {
log.Fatal(err)
}
defer res.Body.Close()
// 204, with no body — whether or not there was one to delete.
if res.StatusCode >= 400 {
log.Fatalf("delete failed: %d", res.StatusCode)
}
fmt.Println("deliveries stopped")
}
Authorizations
A short-lived partner token, obtained by exchanging your API key at
POST /token. Send it as Authorization: Bearer <access_token>.
Tokens live for fifteen minutes by default and never for more than an hour. Mint one per batch of work, not one per request.
The token carries the workspace and the environment its key was issued for. You cannot change either by asking: the exchange ignores everything in the request body for exactly that reason.
It also carries the key's scopes (scope, a list). Every operation names a
scope as x-maat-scope, and a token whose key lacks it is refused with
403 insufficient_scope, naming the scope. Scopes are fixed when a key is
issued and are re-read from the key on every request, so a key narrowed today is
narrowed on its next call — the token's scope is what the key held at exchange
time, for your own reading, never what authorizes a request.
x-maat-scope is the floor, and on the quick-action operations it is not the
whole requirement. PUT and DELETE /listings/{listing_id}/quick-actions/{template_key}
carry rules:write, and additionally require pricing:write when
template_key begins pricing. — the capability depends on the template in
the path, because a cleaning fee changes what a guest pays and a minimum stay
does not. The refusal is the same 403 insufficient_scope, naming
pricing:write. The two READS apply the same requirement without erroring:
GET /listings/{listing_id}/quick-actions still lists the pricing.* rows but
withholds their applied state, and GET /listings/{listing_id}/rules omits the
pricing rules entirely and reports pricing_withheld in warnings. These four
are the only operations in this document whose requirement is not exactly their
x-maat-scope, and each of them says so machine-readably:
x-maat-scope-additional lists the second scope it can require and
x-maat-scope-additional-when says what happens without it.
Never send it as a cookie or in a query string, and never store it — store the API key, mint tokens from it.
Response
Deliveries are stopped. No body.