# Create a manage session (/docs/api-reference/scheduling-bookings/create-scheduling-manage-session)

Lets an attendee reschedule or cancel this one booking, within the event type's cutoffs. Stops working when the booking's cancelled, or a day after it ends.

`POST https://api.coss.com/v1/scheduling/bookings/{id}/manage_sessions`

Authenticate with your API key as a bearer token (`Authorization: Bearer coss_test_…`). Responses are JSON with snake_case fields; errors are `{ error: { type, code, message, param?, issues?, request_id } }` (https://coss.com/docs/api-reference/errors.md).

## Path parameters

- `id` (string, required): The booking's id.

## Example request

TypeScript (the `coss` package):

```ts
import { Coss } from "coss";

const coss = new Coss({
  apiKey: process.env.COSS_API_KEY,
  baseUrl: "https://api.coss.com",
});

const { data, error } = await coss.scheduling.sessions.createForBooking("book_01kd2m9a0b1c2d3e4f5g6h7j8m");
```

HTTP:

```sh
curl -X POST "https://api.coss.com/v1/scheduling/bookings/book_01kd2m9a0b1c2d3e4f5g6h7j8m/manage_sessions" \
  -H "Authorization: Bearer $COSS_API_KEY"
```

## Response 201

The session.

- `object` ("scheduling.session", required)
- `id` (string, required)
- `token` (string, required): Shown only now. A bearer token for the client API.
- `url` (string | null, required): coss.com's hosted page, with the token in its fragment.
- `expires_at` (string, required)

Example:

```json
{
  "object": "scheduling.session",
  "id": "schs_01kd2m9a0b1c2d3e4f5g6h7j8m",
  "token": "cossch_abc123",
  "url": "https://example.test/h/schs_01kd2m9a0b1c2d3e4f5g6h7j8m#cossch_abc123",
  "expires_at": "2027-01-01T11:00:00.000Z"
}
```

## Errors

- `400`: The `Coss-Version` header names an unknown API version (`invalid_api_version`).
- `401`: The API key is missing, invalid, revoked or expired (`authentication_error`).
- `403`: The API key lacks the permission this endpoint needs (`permission_error`), or its organization is suspended (`organization_suspended`).
- `404`: Nothing with this id or uid exists in the environment (`not_found`).
- `429`: Too many requests with this API key (`rate_limited`), or too many requests with invalid keys from this address (`too_many_failed_authentications`). Retry after `Retry-After` seconds. Successful responses carry `RateLimit-Limit`, `RateLimit-Remaining` and `RateLimit-Reset` (seconds until the limit is fully restored).
- `500`: Unexpected server error (`api_error` / `internal_error`).
- `503`: The API key could not be verified right now; retry (`service_unavailable`).