May as well weigh in. How about:

    POST /booking/:id/cancellation

Because you are creating a 'cancellation object' belonging to that booking.

Ninja Edit: Really it is about being consistent, and predictable, so that people using your API can guess how it will act. If you are using an API of yours, and can't guess what the correct url/method is, you should change the API. (I forget who said that)