QR code API for CRUD, not screenshots
SmartQRCode editorial · Updated October 2026
The qr code api for crud is the public REST surface at /api/v1. You create, read, patch, and delete hosted codes with an API key. Patching a destination does not reprint the pattern. A Canva static file is still the right tool when you have one frozen URL and will not count scans.
What the qr code api for crud can change
Auth is x-api-key or bearer. Send an idempotency key header on creates you might retry. The field is short_code not shortcode. Analytics uses period seven thirty ninety or 365.
Authentication is x-api-key or bearer carrying a sk_live_ key. The first sixteen characters are a public prefix for lookup. The secret is stored as a hash. Do not build scan URLs by hand. The response field is short_code not shortcode, and scan_url is the string you print.
Redirect encodings return a scan_url on /api/track/{short_code}. Landing pages return /qr/{short_code}. Static encodings return null because the payload is in the image. Wi-Fi is that static type: not editable after printing, not trackable. CRUD will not turn it into analytics.
List is paginated with limit at most 100 and an offset. Create is POST. Read one is GET by id. PATCH updates target_url, name, and paused. DELETE is a soft delete. Analytics is a separate GET with period seven thirty ninety or 365. Every call costs one against the monthly quota. Burst is about 120 requests per minute per key, per instance.
Paid options are $1.99, $29, $97, and $197. We do not sell an unpaid tier. Teams share one quota on the owner. See QR codes for teams. Events out to your servers are QR code API webhooks log. Large mints are bulk QR code batch jobs.
Dynamic QR codes, tracked QR codes, and the website URL generator are the human faces of the same hosted class. Product launch placements are the usual reason a PIM talks to /api/v1.
How to create and patch without reprinting
The printed modules encode the scan_url, not the marketing destination. Changing target_url after print is the point of a hosted type.
- Mint a key in the account area. Copy it once. Rotation is a regenerate, not an edit of the hash.
- POST /api/v1/qr-codes with the destination you will open on a phone. Send an idempotency key header on creates you might retry.
- Persist the returned id and short_code in your system of record. Printers need the image, not the JSON.
- Export PNG, JPG, SVG, or PDF at the final size. Do not screenshot /qr-preview.
- Print at least 2 cm across at 30 cm with a four-module quiet zone. Proof-scan on cellular.
- When the campaign URL changes, PATCH target_url. Do not mint a second code unless the host in the modules must change.
- Set paused true to stop resolution without deleting history. Archive behaviour is separate: archived codes keep scanning.
- GET analytics when you need counts. Country and device come from headers. There is no name or email.
If the first POST is still running, a retry with the same idempotency key header returns 409 still in progress. The same key and same body after success replays. The same key and a different body is 409. A reservation that cannot be written is 503; the work does not run unprotected.
Which fields PATCH actually accepts
target_url, name, paused. That is the write set. Colour and logo are design settings on create, not a PATCH bag of SVG. If you need a new host in the modules, you are creating a new object and reprinting. The API will not rewrite pixels that already left the plant.
Pause uses 302 behaviour on the live hop when the code is a redirect. A 301 would cache the old destination. Do not ask a CDN in front of the destination to 301 if you still plan to edit.
Name changes lists and the activity log. They do not change ISO/IEC 18004 modules. Useful for bulk QR code naming rules parity when a machine names what a sheet would have named.
How analytics periods are labelled
period_scans covers the requested window. total_scans is lifetime. Breakdowns follow the window. Both live scans and the archive are unioned so nightly archival does not make a dashboard look like traffic died.
You get device type and country. You do not get a person. If a report needs identity, this API cannot supply it. Unique-scanner reporting, where it exists, is a hash, not a login.
OpenAPI lives at GET /api/v1/openapi. Use it as the contract. Do not copy field names from a blog that says shortcode.
API failures that reprint nothing
401 means the key is missing or revoked. Do not reprint. Fix auth.
403 on create often means the QR limit. Reprinting will not raise the limit.
409 on idempotency means you reused a key. Inspect the recorded body before you mint a duplicate that ships twice.
A 500 should be retried. A recorded 500 would pin a transient fault to the key, so faults are not stored as replays.
Null scan_url on Wi-Fi is not an outage. There is nothing to host. If you needed counts, you picked the wrong type.
Provider dependency remains. An API that returns 200 does not keep resolving scans if the account is paused. F91 still applies.
How to store what the printer actually needs
Your PIM should keep three values per SKU: the API id, the short_code not shortcode, and the scan_url you printed. Destination can change. Those three should not, unless you reprint. A fourth value, paused, is operational. Do not overwrite scan_url with target_url in a join. One is the hop. The other is the marketing page.
Retries belong on POST with an idempotency key header scoped to that SKU create. If two warehouse robots mint at once without keys, you get two short codes and a coin flip on which SVG the plant used. 409 on a reused key with a different body is a gift. Read it.
Rate headers tell you when the monthly quota is thin. Burst around 120 per minute is per instance and approximate. The monthly number is the one that must be exact. Do not DDoS yourself with a tight loop of analytics GETs to draw a chart. Period seven thirty ninety already aggregates.
Log 401 and 403 separately from 500. Reprinting on a 401 wastes plates. Rotating a leaked key is a regenerate, then an update of secrets in the PIM, then a check that old keys 401. Soft delete does not unsay a carton. Pause does.
Store paused as a boolean next to the SKU, and make the warehouse printer refuse to emit a label when paused is true. A human remembering to check a dashboard at 4am is not a control.
When a CSV or Canva file is simpler
Hundreds of new hosted URLs with no originating system: the CSV job. The qr code api for crud is extra machinery.
One poster, never edited, never counted: Canva or another free static generator. You would be calling POST to produce a frozen string the modules could have held themselves.
A catalogue that already has IDs, retries, and a warehouse printer: /api/v1. Persist short_code. Patch destinations. Leave the ink alone until the host itself must change.
Questions this raises
PATCH on /api/v1/qr-codes/{id} updates target_url, name, and paused. It does not reprint modules. A Wi-Fi payload is not a hosted target_url and cannot be edited after printing.
GET analytics takes period 7, 30, 90, or 365 days. total_scans is lifetime. period_scans and the breakdowns cover that window. Figures union live scans and the archive so a total does not shrink.
A spreadsheet job is simpler for hundreds of new hosted codes. A Canva one-off is simpler for one destination that will never move and will never be counted. The qr code api for crud is for systems that already create and patch records.
Static encodings have no hosted URL. The payload is in the image. Redirects use /api/track/{short_code}. Landing pages use /qr/{short_code}.
The API answers 409. The same key with the same body replays the recorded response. A key whose first request is still running also 409s.
Keep going
The tools and playbooks this post refers to, one click away.
Make the code this post is about
$1.99 for 7 days, then a paid plan. Pick a type, brand it, and edit the destination whenever you like, even after it is printed.