# Your endpoint must answer the signed endpoint.challenge we POST
# to it DURING this call — see the webhooks guide.
curl --fail-with-body -X PUT https://maatstays.wtf/v1/webhooks/endpoint \
  -H "Authorization: Bearer $MAAT_PARTNER_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "url": "https://hooks.example-partner.invalid/maat",
    "events": ["booking.confirmed", "booking.cancelled", "booking.requested"]
  }'

// Your endpoint must answer the signed endpoint.challenge we POST
// to it DURING this call — see the webhooks guide.
const res = await fetch('https://maatstays.wtf/v1/webhooks/endpoint', {
    method: 'PUT',
    headers: {
        Authorization: `Bearer ${process.env.MAAT_PARTNER_TOKEN}`,
        'Content-Type': 'application/json',
    },
    body: JSON.stringify({
        url: 'https://hooks.example-partner.invalid/maat',
        events: ['booking.confirmed', 'booking.cancelled', 'booking.requested'],
    }),
});

const body = await res.json();
if (!res.ok) throw new Error(`${body.code}: ${body.detail}`);

if (body.signing_secret) {
    // Present only on the FIRST registration, and never shown again.
    // Store it in your secret manager NOW. Never log it.
}
console.log(body.status); // 'active' once the challenge was echoed

import os

import requests

# Your endpoint must answer the signed endpoint.challenge we POST
# to it DURING this call — see the webhooks guide.
res = requests.put(
    "https://maatstays.wtf/v1/webhooks/endpoint",
    headers={"Authorization": f"Bearer {os.environ['MAAT_PARTNER_TOKEN']}"},
    json={
        "url": "https://hooks.example-partner.invalid/maat",
        "events": ["booking.confirmed", "booking.cancelled", "booking.requested"],
    },
    timeout=30,
)

body = res.json()
if res.status_code >= 400:
    raise RuntimeError(f"{body['code']}: {body.get('detail')}")

if "signing_secret" in body:
    # Present only on the FIRST registration, and never shown again.
    # Store it in your secret manager NOW. Never log it.
    pass
print(body["status"])  # 'active' once the challenge was echoed

package main

import (
    "bytes"
    "encoding/json"
    "fmt"
    "log"
    "net/http"
    "os"
)

func main() {
    // Your endpoint must answer the signed endpoint.challenge we POST
    // to it DURING this call — see the webhooks guide.
    payload, _ := json.Marshal(map[string]any{
        "url":    "https://hooks.example-partner.invalid/maat",
        "events": []string{"booking.confirmed", "booking.cancelled", "booking.requested"},
    })

    req, _ := http.NewRequest(http.MethodPut,
        "https://maatstays.wtf/v1/webhooks/endpoint",
        bytes.NewReader(payload))
    req.Header.Set("Authorization", "Bearer "+os.Getenv("MAAT_PARTNER_TOKEN"))
    req.Header.Set("Content-Type", "application/json")

    res, err := http.DefaultClient.Do(req)
    if err != nil {
        log.Fatal(err)
    }
    defer res.Body.Close()

    var body map[string]any
    if err := json.NewDecoder(res.Body).Decode(&body); err != nil {
        log.Fatal(err)
    }
    if res.StatusCode >= 400 {
        log.Fatalf("%v: %v", body["code"], body["detail"])
    }

    if _, ok := body["signing_secret"]; ok {
        // Present only on the FIRST registration, and never shown again.
        // Store it in your secret manager NOW. Never log it.
    }
    fmt.Println(body["status"]) // "active" once the challenge was echoed
}