When a user adds inventory to a cart or reservation system, the reservation is time-limited. If the purchase isn’t completed within the window, the inventory is released back to the available pool — automatically, server-side.
Typical timeouts by context:
• Concert tickets: 8–15 minutes to complete checkout before tickets are released
• Retail checkout: 10–30 minutes before cart items become available again
• Appointment slots: 5–10 minutes to confirm a slot before it’s re-opened
• Limited releases: 5 minutes — short enough that bots can’t hold inventory without actually purchasing
Bots that hold inventory without completing purchase (to test demand before committing funds) are forced to either complete the transaction or lose their hold. Short timeouts also limit the damage of abandoned bot carts — even if a bot holds 500 tickets, they’re released after 10 minutes if not purchased, giving real buyers another window.
A bot with 500 accounts can hold tickets in 500 separate carts simultaneously, each with its own 10-minute timer. Pair cart timeouts with per-identity cart limits (max 4 tickets per verified account, max 1 active cart per device fingerprint) to prevent this.
Ask whether your API can distinguish between a human customer and a bot making the same request. If the answer is no, ask what evidence you would have after an automated abuse event to understand what happened.