# Connect a calendar with a password (/docs/api-reference/scheduling-calendars/create-scheduling-calendar-connection)

CalDAV (Apple and others) with an app password, or, in sandbox environments, a `simulated` calendar whose busy times you set yourself. Google and Microsoft use `authorize`.

`POST https://api.coss.com/v1/scheduling/hosts/{host}/calendar_connections`

Authenticate with your API key as a bearer token (`Authorization: Bearer coss_test_…`). Responses are JSON with snake_case fields; errors are `{ error: { type, code, message, param?, issues?, request_id } }` (https://coss.com/docs/api-reference/errors.md).

## Path parameters

- `host` (string, required): The host's id or uid.

## Request body

- One of (1):
  - `provider` ("caldav", required)
  - `url` (string, required, uri, at most 2000 characters): The server's https URL.
  - `username` (string, required, 1-320 characters)
  - `password` (string, required, 1-500 characters): An app-specific password. Encrypted, and never returned.
- One of (2):
  - `provider` ("simulated", required)

## Example request

TypeScript (the `coss` package):

```ts
import { Coss } from "coss";

const coss = new Coss({
  apiKey: process.env.COSS_API_KEY,
  baseUrl: "https://api.coss.com",
});

const { data, error } = await coss.scheduling.calendars.connect({
  value: "host_01kd2m9a0b1c2d3e4f5g6h7j8m",
}, {
  provider: "caldav",
  url: "https://caldav.icloud.com",
  username: "ana@example.com",
  password: "abcd-efgh-ijkl-mnop",
});
```

HTTP:

```sh
curl -X POST "https://api.coss.com/v1/scheduling/hosts/host_01kd2m9a0b1c2d3e4f5g6h7j8m/calendar_connections" \
  -H "Authorization: Bearer $COSS_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
  "provider": "caldav",
  "url": "https://caldav.icloud.com",
  "username": "ana@example.com",
  "password": "abcd-efgh-ijkl-mnop"
}'
```

## Response 201

The connection.

- `object` ("scheduling.calendar_connection", required)
- `id` (string, required)
- `host` (string, required)
- `provider` ("google" | "microsoft" | "caldav" | "simulated", required)
- `account` (string, required)
- `status` ("active" | "needs_reauth", required): `needs_reauth`: access was lost, and this host isn't offered until it's back.
- `calendars` (object[], required)
  - `id` (string, required)
  - `external_id` (string, required)
  - `read_busy` (boolean, required): Whether its busy times block slots.
  - `write_target` (boolean, required): Whether bookings are written to it.
  - `verified_at` (string | null, required)
- `created_at` (string, required)

Example:

```json
{
  "object": "scheduling.calendar_connection",
  "id": "calconn_01kd2m9a0b1c2d3e4f5g6h7j8m",
  "host": "host_01kd2m9a0b1c2d3e4f5g6h7j8m",
  "provider": "google",
  "account": "ana@example.com",
  "status": "active",
  "calendars": [
    {
      "id": "cal_01kd2m9a0b1c2d3e4f5g6h7j8m",
      "external_id": "ana@example.com",
      "read_busy": true,
      "write_target": true,
      "verified_at": "2027-01-01T10:00:00.000Z"
    }
  ],
  "created_at": "2027-01-01T10:00:00.000Z"
}
```

## Errors

- `400`: The body is not valid JSON (`invalid_json`). Also when the `Coss-Version` header names an unknown API version (`invalid_api_version`).
- `401`: The API key is missing, invalid, revoked or expired (`authentication_error`).
- `403`: The API key lacks the permission this endpoint needs (`permission_error`), or its organization is suspended (`organization_suspended`).
- `404`: Nothing with this id or uid exists in the environment (`not_found`).
- `415`: The body is not sent as `application/json` (`unsupported_media_type`).
- `422`: The request failed validation (`validation_error`, see `issues`), or can't be done: see `code`.
- `429`: Too many requests with this API key (`rate_limited`), or too many requests with invalid keys from this address (`too_many_failed_authentications`). Retry after `Retry-After` seconds. Successful responses carry `RateLimit-Limit`, `RateLimit-Remaining` and `RateLimit-Reset` (seconds until the limit is fully restored).
- `500`: Unexpected server error (`api_error` / `internal_error`).
- `503`: The API key could not be verified right now; retry (`service_unavailable`).