Book a slot, one of four ways, each checked the same way. With invite (a booking link's token, from ?invite= on the link the page's owner gave): booked, 201. With turnstileToken (the booking page's form): booked, 201. Signed by an allowlisted operator's agent (Web Bot Auth: Signature, Signature-Input and Signature-Agent headers from https://chatgpt.com or https://agent.bot.goog): booked, 201, whatever the body's turnstileToken. With none of these (an invitee's agent): nothing is booked or held; a 6-digit code is emailed to email, 202, and POST /api/pages/{handle}/bookings/confirm books. 409 slot_taken carries alternatives; 409 page_changed: the handle moved since the page was read (pageId).