# Create Guest Session

> Create a guest credential

**Endpoint:** `POST /v1/guest-sessions`  
**Access:** Public (no credentials needed)

Also sets the `vi_guest` cookie. Usually unnecessary: `createApplication` creates one when needed.

## cURL example

```bash
curl -X POST "https://api.verifiedinbox.ai/v1/guest-sessions"
```

## Responses

### 201 OK

Guest credential (shown once).

```json
{
  "expires_at": "2026-10-31T12:00:00Z",
  "guest_token": "string",
  "note": "string"
}
```

### 422 (unprocessable)

`unprocessable` / `blocked_provider` — understood but can't be done (plain-English reason).

```json
{
  "error": {
    "code": "unprocessable",
    "message": "Shared mailbox providers like gmail.com cannot be verified."
  }
}
```

### 429 (rate_limited)

`rate_limited` — retry after `Retry-After` seconds (`details.retry_after_seconds`). `limit_reached` — a quota is used up; `details.limit` names it and `next_action` offers support.

```json
{
  "error": {
    "code": "rate_limited",
    "message": "Too many requests. Please wait a moment and try again."
  }
}
```