---
title: "Record the user's booking instruction (authorization)"
method: POST
path: "/mandates"
tags: ["mandates"]
---

# Record the user's booking instruction (authorization)

`POST /mandates`

## Request

- Base URL: `https://agentbookable.com`
- URL: `https://agentbookable.com/mandates`
- Auth: none declared

Creates a short-lived, single-use mandate that authorizes ONE booking action for ONE business. The instruction must be the user's own words — agents must not fabricate it. Use the returned `mandateRef` in `POST /bookings` within 15 minutes. The mandate is consumed by the booking it authorizes.

## Request body

- MandateCreate
  - `actorRef` string, required: Stable identifier for who is acting on the user's behalf (e.g. your agent/session id). Used in the audit trail.
  - `action` 'create_booking' | 'reschedule_booking' | 'cancel_booking', required
  - `businessId` string: Bind the mandate to this business. Strongly recommended; a bound mandate cannot be replayed elsewhere.
  - `serviceId` string: Optionally bind to a specific service.
  - `instruction` string, required: The user's exact words. Do not paraphrase or invent. This is the consent evidence.

## Response `200`

Mandate created

- MandateCreated
  - `mandateRef` string
  - `expiresAt` string: The mandate is invalid after this time (15 minutes).

## Other responses

- `400`: Missing/invalid fields
- `429`: Too many requests — slow down

---

[API](https://skmtc.dev/agentbookable/apis/agentbookable-booking-api-for-ai-agents.md) · [All operations](https://skmtc.dev/agentbookable/apis/agentbookable-booking-api-for-ai-agents/llms.txt) · [OpenAPI document](https://skmtc.dev/agentbookable/apis/agentbookable-booking-api-for-ai-agents/revisions/736963f5951a?raw)