# POST /client-data/reservations

Section: [Client Account](https://appengine.appmint.io/documentation/tag/client-account.md) · Full index: https://appengine.appmint.io/documentation.md
## POST /client-data/reservations

**Make a reservation**

`operationId: ClientAccountController_createReservation`

Books a reservation for the customer.

#### Signature

```http
POST /client-data/reservations (body) -> The created reservation
```

#### Access

Requires a bearer JWT (`Authorization: Bearer <token>`).

#### Errors

| Status | Code | Message | When | What to do |
| --- | --- | --- | --- | --- |
| `401` | CUSTOMER_REQUIRED | Customer required | No signed-in customer could be resolved. | Sign in. Every endpoint here is scoped to the caller and none work anonymously. |

Plus the standard platform errors: `403`, `429`, `500`.

#### See also

- `POST /client-data/reservations/available-slots`

### Parameters

| Name | In | Type | Required | Description |
| --- | --- | --- | --- | --- |
| `orgid` | header | string | yes | Organization (tenant) identifier. Every request is scoped to this org; data from other orgs is never visible. Issued with your API credentials. |
| `x-client-info` | header | string | yes |  |

### Request body

For a timed service: use the selected definition id and service name, exact startTime/endTime returned by availability, and answers keyed by the configured form schema. The bearer session supplies customer identity. Replace the illustrative id, service, date and form answers with your own configuration.

```json
{
  "reservationDefinitionId": "6acb4561d685f653775b8772",
  "service": "Room planning",
  "startTime": "2026-10-22T16:00:00.000Z",
  "endTime": "2026-10-22T16:30:00.000Z",
  "form": {
    "projectType": "Single room",
    "brief": "Plan a reading corner with accessible shelving.",
    "contactConsent": true
  }
}
```

### Responses

| Status | Meaning |
| --- | --- |
| `201` | The created reservation |
| `401` | Customer required — No signed-in customer could be resolved. |
| `403` | You do not have permission to perform this action — The caller is authenticated but lacks the role required by the endpoint, or is acting on another org. |
| `429` | Too Many Requests — More than 100,000 requests from one IP within 5 minutes (configurable per deployment). CORS preflights and requests from inside the platform cluster are not counted. The limiter answers before the error filter, so the body is `{ statusCode, error, message }` with no `path`, `method` or `timeStamp`; the `RateLimit-*` response headers say when the window resets. |
| `500` | An unexpected error occurred. Our team has been notified. — An unhandled server-side failure. |