Skip to main content
Every call in this API is made with a key, and your workspace issues its own. A key belongs to one workspace and reaches that workspace’s properties, calendars, rates, bookings and reviews — nobody else’s.

​
Issuing your own keys

Self-serve, inside the Maat host app, under Developer in the sidebar — the entry appears only for members who hold View Developer Access. Four steps, and the first three happen once for the workspace rather than once per key.
1

Request developer access

The Request developer access button on the Developer page. It needs the Manage Developer Access permission on your workspace; without it the button is replaced by a line naming the permission to ask for, rather than a control that does nothing. One request covers the workspace, not the person.Seeing the page at all needs View Developer Access. Neither permission is carried by any of Maat’s predefined roles, so on a new workspace an Owner — who holds everything — grants them, to themselves or to whoever is building.
2

Maat reviews it

The card reads Your request is with Maat until somebody answers. A decline comes back with the reason on the same card and a Request again button — a declined request is not a dead end.
3

Read and sign the Developer Terms

Once accepted, the card becomes Read and sign the Developer Terms. The terms are presented in English only, and the English text is the binding one. Signing records who signed, when, the exact version, and a SHA-256 of the text they saw.Nothing can be issued before this: the signature is what every key your workspace issues is checked against, on every request.
4

Issue a key

Once access is active the page gains an API keys card with an Issue key button. You choose a name, an Environment — Sandbox or Live — the scopes it carries, and optionally an earlier expiry than the default.The secret is shown once, on the screen that issues it. See Managing your keys.
Start with a Sandbox key. It addresses the sandbox workspace paired with yours, where everything writes for real and nothing reaches the public — see Sandbox. A Live key authenticates and validates exactly the same way and then answers 501, which is what every operation says about itself.
The Scopes control on that form is the only chance you get. No key can be widened afterwards — scopes are fixed when the key is issued, and adding one means issuing a new key — so read Scopes before the first one.

​
What is not published yet

Maat has not published a support address, a request form, a turnaround, an incident channel or a status page for this API, and this page will not invent one. Everything above happens in your own app and needs no address at all; for anything else, go through your Maat contact.