Manhattin API documentation

Try it without a key

Pricing and the OpenAPI document are public and unauthenticated. Use them to confirm connectivity, TLS and CORS before anyone issues you a key.

curl -s https://manhattin.com/api/public/pricing
curl -s https://manhattin.com/openapi.json

Manhattin developer resources

Every link below is a live URL on this domain. The markdown guides accept ?raw=1 for plain markdown with no HTML wrapper.

• Manhattin API catalogue

  The RFC 9727 catalogue: one fixed URL listing every API description and guide on this domain, so an agent finds them without guessing a path.

  /.well-known/api-catalog

• Manhattin MCP server manifest

  Where the Model Context Protocol server is, which transport it speaks and how to authenticate to it.

  /.well-known/mcp

• OpenAPI 3.1 specification (JSON)

  The machine-readable description of every endpoint, schema and error. Load it into Postman, Swagger UI, or an agent function-calling bridge.

  /openapi.json

• OpenAPI 3.1 specification (YAML)

  The same document in YAML.

  /api/openapi.yaml

• Manhattin function-calling tools

  Every endpoint as a ready-made LLM tool, in both the OpenAI and Anthropic shapes, with a typed input schema on all of them. Use it instead of converting the OpenAPI document yourself.

  /tools.json

• Agent brief

  A short integration brief for coding agents: authentication, endpoints, inquiry fields, and the mistakes that generate support tickets.

  /api/docs/api/FOR_AGENTS.md?raw=1

• Quick start

  A five-minute walkthrough from key to first request.

  /api/docs/api/QUICK_START.md?raw=1

• API reference

  Field-level documentation: inclusion rules, response schemas, error codes, caching and CORS.

  /api/docs/api/API_REFERENCE.md?raw=1

• Organization API guide

  Multi-property keys and the portfolio-wide endpoints, whose paths and response shapes differ from the property API.

  /api/docs/api/ORG_API_GUIDE.md?raw=1

• Client options

  Ways to call the API from a website, and which one to choose.

  /api/docs/api/CLIENT_OPTIONS.md?raw=1

• WordPress integration

  Plugin setup and a manual snippet for a WordPress property site.

  /docs/wordpress-integration

Manhattin API keys and authentication

Three key families, each scoped differently. Sending a key to the wrong family returns 403 INVALID_KEY, which is the single most common integration mistake. Send the key as X-API-Key, or as Authorization: Bearer. There is no query-parameter fallback.

curl -s https://manhattin.com/api/public/availability \
  -H "X-API-Key: pk_live_..."

Keep the key server-side. The inquiry endpoints create lead records, so a leaked key lets anyone file inquiries against your property. Allowed origins are a browser CORS allowlist, not an IP allowlist — they do not protect a key that has escaped.

Getting a key

Keys are issued by Manhattin and shown once at creation; only a SHA-256 hash is stored, so a lost key is replaced rather than recovered. Email developer@manhattin.com to request one, and say which site will use it.

Claim a key you were invited to

Manhattin API endpoints

Full parameter and response documentation lives in the OpenAPI document and the API reference. This is the map.

• GET/api/public/pricing

  Published subscription plans. No key required.

• GET/api/public/availability

  Units on this property that can be advertised today. Filters: unit_type, bedrooms, min_rent, max_rent.

• GET/api/public/units

  The full building roster with promotions and an explicit unavailable list. No filters. Cached for five minutes.

• GET/api/public/unit/{unit_id}

  One residential unit in detail. Commercial units answer 404.

• POST/api/public/inquiries

  Create a lead from a website contact form. Responds 201.

• GET/api/public/org/properties

  Every active property in the organization, with amenities, photos and unit counts.

• GET/api/public/org/availability

  Advertisable units across the whole portfolio, optionally filtered to one property.

• GET/api/public/org/units

  Every active unit with a computed availability status and lease dates.

• POST/api/public/org/inquiries

  Create a lead against the organization, optionally tied to a property or a unit.

• GET/api/v1/agency/availability

  Availability snapshot for the properties in an agency partnership. Five requests per day.

Manhattin MCP server

The same endpoints are exposed as sixteen Model Context Protocol tools, so an assistant can read availability and file an enquiry without anyone writing an HTTP client. It authenticates with the same keys, calls the same endpoints and is subject to the same rate limits — it is a client of this API, not a privileged path around it.

Send the same API key as an Authorization: Bearer header or an X-API-Key header on the MCP request. Two tools — list_pricing_plans and get_openapi_specification — need no key, so a client can connect and list the tools before one has been issued.

curl -s https://manhattin.com/api/mcp \
  -H "Content-Type: application/json" \
  -H "Accept: application/json, text/event-stream" \
  -d '{"jsonrpc":"2.0","id":1,"method":"tools/list"}'

Thirteen of the sixteen tools only read. Three write and are annotated so a client can ask for confirmation first: submit_inquiry and submit_organization_inquiry create a lead a person will act on, and extend_console_window extends your own console window.

Five of the sixteen are for building the integration rather than running it: describe_console_access, list_recent_api_requests, list_form_submissions, test_integration and extend_console_window. They read your API-key console — which property a key is bound to, what your website actually sent, which posted fields the endpoint ignored, why an origin is refused — from inside the assistant you are building with. They take a console token in the X-Manhattin-Console-Token header, minted from your console, not an API key. It lasts at most twelve hours, never outlives the console window, and can be revoked without signing you out. list_form_submissions redacts names, emails, phone numbers and message bodies by default: those belong to prospective tenants, and everything needed to debug a form works redacted.

Versioning and deprecation

The API is versioned in the URL path. A breaking change gets a new path rather than altering one already in use, and adding a field to a response is not a breaking change — ignore fields you do not recognise. When an endpoint is retired, its own responses say so.

• Deprecation (RFC 9745) gives the moment it became deprecated, as an at sign followed by epoch seconds.
• Sunset (RFC 8594) gives the moment it stops working, as an HTTP date.
• A Link header with rel="deprecation" points back at this page, and the operation is flagged as deprecated in the OpenAPI document.
• After the sunset date it answers 410 Gone with the code ENDPOINT_WITHDRAWN and keeps sending both headers. It never degrades to a 404, and the path is never reused.

At least 90 days separate the Deprecation date from the Sunset date. The only exception is a retirement forced by a security or legal obligation, where the window may be shorter; the headers carry the real dates either way, so read them rather than counting on the minimum.

Withdrawn so far: POST /api/public/units/update-status, deprecated and sunset on 4 August 2026 with no notice period — it predates this policy and had never been called.

Limits and conventions

Design for these rather than discovering them in production.

• Every response carries RateLimit, RateLimit-Policy, RateLimit-Limit, RateLimit-Remaining and RateLimit-Reset, plus Retry-After on a 429, so a client can pace itself before it is refused.
• Per key: 100 requests per hour by default, raisable to 10000. Agency keys are limited to five requests per day.
• Per IP: 30 requests per minute across all public API traffic, applied before the key is read.
• No pagination and no cursors — list endpoints return the whole result set.
• No webhooks. Poll on a schedule and serve from your own cache.
• The full roster endpoint sends Cache-Control: public, max-age=300, so a status change can take up to five minutes to appear there.
• Every error is JSON with a stable code and a human message. Retry 5xx with backoff; do not retry a 4xx other than 429.