Every endpoint, parameter and response. Generated from the specification the API itself is tested against, so it cannot describe something that is not there.
Create and manage dynamic QR codes, and read their scan analytics.
Every request takes a bearer token: Authorization: Bearer sk_live_.... Keys are
created in the dashboard under API access and are shown once — we store only a
SHA-256 hash, so a lost key is replaced rather than recovered.
Responses carry X-RateLimit-Limit, X-RateLimit-Remaining and
X-RateLimit-Reset. The limit is a monthly request quota and resets at the start
of the next UTC month; X-RateLimit-Limit is the string unlimited on plans with
no cap. There is also a short burst limit, which responds 429 with Retry-After
in seconds.
POST accepts an Idempotency-Key header. Sending the same key with the same
body replays the original response — including its status code — with
Idempotent-Replay: true, rather than creating a second code. Sending the same key
with a *different* body is a 409: reusing a key for a different request is
always a client bug, and replaying the wrong response would hide it.
Keys are remembered for 24 hours. Retries are safe to send without a key too; they simply are not deduplicated.
Changing target_url on a dynamic code is the point of the product: the printed
code keeps working and resolves somewhere new. Static and landing-page codes have
no single target, so they reject a target_url update with a 409 instead of
silently accepting one that could not take effect.
The machine-readable OpenAPI 3.1 document is at GET /api/v1/openapi and needs any valid key. Generate a client from it rather than from this page.
Every response is JSON. Errors carry a single error string, and every endpoint can return 401 for a missing key or 429 when a limit is hit.
/api/v1/qr-codesYour codes, newest first, excluding deleted ones. scan_count includes archived scans, so it never shrinks.
Parameters
limitquery · integeroffsetquery · integerResponses
/api/v1/qr-codesCreates a redirect code. Send Idempotency-Key to make a retry safe. Codes created here are always dynamic redirects: a landing-page type needs content this endpoint does not accept yet, and defaulting to one would produce a code that scans to an empty page.
Headers and parameters
Idempotency-Keyheader · stringRequest body
target_urlstring · requirednamestring · optionalcampaign_typestring · optionaldomain_idstring · optionalResponses
/api/v1/qr-codes/{id}Responses
/api/v1/qr-codes/{id}Retarget, rename, or pause. Send only the fields you want to change; omitted fields are left alone. At least one recognised field is required.
Request body
target_urlstring · optionalnamestring or null · optionalpausedboolean · optionalResponses
/api/v1/qr-codes/{id}A soft delete: the code stops resolving and scans of the printed code reach a 'no longer active' page. Its scan history is retained and it can be restored from the dashboard.
Responses
/api/v1/qr-codes/{id}/analyticstotal_scans is the code's lifetime total including archived scans. The breakdowns cover the requested window only — the two are different periods on purpose, and labelled as such.
Parameters
periodquery · integerResponses
Business plans include the API, webhooks and a monthly request quota. Tell us the call volume you expect and we will point you at the right tier.