---
title: "Cancel a pass window"
method: POST
path: "/v1/projects/{project}/pass-windows/{window}/cancel"
tags: ["Pass Windows"]
---

# Cancel a pass window

`POST /v1/projects/{project}/pass-windows/{window}/cancel`

## Request

- Base URL: `https://api.subscriby.net`
- URL: `https://api.subscriby.net/v1/projects/{project}/pass-windows/{window}/cancel`
- Auth: HTTP bearer

```bash
curl -X POST https://api.subscriby.net/v1/projects/$PROJECT_ID/pass-windows/$WINDOW_ID/cancel \
  -H "Authorization: Bearer $SUBSCRIBY_TOKEN" \
  -H "Idempotency-Key: $(uuidgen)"
```

By the time the response arrives every holder has been resettled, and `meta` says how:

| Tally          | What happened to those holders                                                                                                                  |
| -------------- | ----------------------------------------------------------------------------------------------------------------------------------------------- |
| `rebound`      | Moved to the plan's next window on sale, and told so. Their invite links are re-issued when the new window opens.                               |
| `refund_due`   | The schedule had nothing left to offer, so their pass was ended and they were told to ask the creator for a refund.                             |
| `legs_dropped` | Season-ticket holders who lost this one date and keep the rest of their series. Their message states what the date was worth of what they paid. |

> **Subscriby never moves the refunds.** `refund_due` and `legs_dropped` are statements, not actions. The money stays where it is until the creator refunds it at the gateway. An integration that wants to act on them should subscribe to `pass.holder_stranded` and `pass_series.leg_dropped`, which carry the amount per holder.

Cancelling is a `POST` verb and not a `DELETE` on purpose: it resettles every holder, moving them on or ending their pass, which is far too consequential to read as removing a row. It also cannot be undone: the window keeps its start permanently, so the same instant can never be re-created on that plan.

Raises `pass.window_cancelled` carrying the tallies, plus one event per holder: `pass.holder_moved` or `pass.holder_stranded` for ordinary passes, `pass_series.leg_substituted` or `pass_series.leg_dropped` for season-ticket holders. A window that is already cancelled is answered `200` with every tally at zero, so a retry after a lost response changes nothing.

## Path parameters

- `project` string, uuid, required
- `window` string, uuid, required

## Headers

- `Idempotency-Key` string, uuid, required

## Response `200`

The window, cancelled, with `meta.rebound`, `meta.refund_due` and `meta.legs_dropped`.

- object
  - `data` PassWindowResource, required: A pass window: one dated stretch of access on a time-limited pass plan, generated from the plan's slots or placed by hand.
    - `id` string, required: The window's id, what a pass series points at.
    - `plan_id` string, required: The pass plan the window belongs to.
    - `plan_name` string, required: That plan's name, so a list reads without a plan lookup.
    - `starts_at` string, required: When access opens, ISO 8601 in UTC. Store and compare this.
    - `ends_at` string, required: When access closes, ISO 8601 in UTC.
    - `timezone` string, nullable, required: The IANA zone the plan's schedule was authored in. Render window times in this, never in UTC.
    - `local_range` string, required: The same window as a person reads it, already in `timezone`; what the dashboard, the portal and the bot all print.
    - `duration_minutes` integer, required: The length in minutes, derived from the two instants.
    - `status` string, required: `scheduled`, `open`, `closed` or `canceled`. Set by the scheduler as the window's start and end pass; `canceled` only by an explicit cancel.
    - `source` string, required: `generated` from the plan's slots, or `manual` when placed by hand. Manual windows survive a schedule rebuild; generated ones are regenerated.
    - `sellable` boolean, required: Whether a buyer could purchase this window right now: the plan's sales cutoff, resolved for the whole page in one query rather than per row.
    - `holders` integer, required: How many purchases currently hold the window.
  - `meta` object, required: How every holder was resettled, as three tallies; all zero when the window was already cancelled.
    - `rebound` integer, required: Holders moved to the plan's next window on sale and told so.
    - `refund_due` integer, required: Holders whose pass was ended because the schedule had nothing left, and who were told to ask for a refund.
    - `legs_dropped` integer, required: Season-ticket holders who lost this one date and keep the rest of their series.

## Other responses

- `400`: `IDEMPOTENCY_KEY_MISSING`: every write needs an `Idempotency-Key` header. Send a fresh UUID per distinct operation.
- `401`: `AUTHENTICATION_REQUIRED`: the request carries no bearer token, or one that is revoked, malformed, or minted for another environment (an `sbt_test_` token on production).
- `403`: `TOKEN_MISSING_ABILITY`: the token is valid but does not carry the ability this endpoint requires; `error.context.required_ability` names the one to grant. An endpoint that also checks who owns a row or which tier the account is on answers `FORBIDDEN`, `TEAM_TIER_REQUIRED` or `CONNECTOR_TIER_REQUIRED` with the same status, and says so in its own description.
- `404`: `RESOURCE_NOT_FOUND`: an id in the path names nothing the token can see. `TENANT_MISMATCH`: the project sits outside the token's `scope:project:` allow-list, or the token carries no team scope. Both answer 404 rather than 403 so that existence outside the token's scope cannot be inferred.
- `409`: `IDEMPOTENCY_KEY_REUSED`: the key was already used in the last 24 hours with a different request body.
- `425`: `IDEMPOTENCY_REPLAY_IN_PROGRESS`: the first request with this key is still running; retry in a few seconds and the original response is replayed.
- `429`: `RATE_LIMITED`: the token has spent its 300 requests a minute or 10,000 an hour; `Retry-After` says when the next one is accepted.

---

[API](https://skmtc.dev/memberpass/apis/subscriby-rest-api.md) · [All operations](https://skmtc.dev/memberpass/apis/subscriby-rest-api/llms.txt) · [OpenAPI document](https://skmtc.dev/memberpass/apis/subscriby-rest-api/revisions/59c4df91d764?raw)