API Reference

Conventions

Every route requires an x-api-key header. Whether a request acts on your personal library or your business's shared library is determined entirely by which key you send — there's no separate business URL prefix.

Errors are JSON: {"error": "..."} for a single problem, or {"errors": [{"index": 0, "error": "..."}]} when a batch request fails validation — batch creation is all-or-nothing, so a validation error on any one item means nothing in the batch was created.

A business-scoped key that creates a shared-library item creates it with "status": "draft" — the same review workflow a human teammate's manual entry goes through (see Shared Library & Review Workflow).

Static QR codes

Route	What it does
GET /qrcodes	List your (or your team's) saved QR codes.
POST /qrcodes	Create one QR code record.
POST /qrcodes/batch	Create up to 50 at once.
DELETE /qrcodes/{qr_id}	Delete one.
GET /qrcodes/export	CSV of every record.

curl -X POST .../v1/qrcodes/batch \
  -H "x-api-key: YOUR_KEY" -H "Content-Type: application/json" \
  -d '{"qrcodes": [
    {"url": "https://example.com/a", "name": "A"},
    {"url": "https://example.com/b", "name": "B"}
  ]}'

# -> 201
{"created": [
  {"qr_id": "...", "url": "https://example.com/a", "name": "A", "style": {}, "created_at": 1785500000, "updated_at": 1785500000},
  {"qr_id": "...", "url": "https://example.com/b", "name": "B", "style": {}, "created_at": 1785500000, "updated_at": 1785500000}
]}

Dynamic QR codes

Route	What it does
GET /dynqrcodes	List your (or your team's) dynamic QR codes.
POST /dynqrcodes	Create one.
POST /dynqrcodes/batch	Create up to 50 at once.
PATCH /dynqrcodes/{code}	Change destination URL, name, or status.
DELETE /dynqrcodes/{code}	Delete (soft-delete — stops resolving, doesn't erase scan history).
GET /dynqrcodes/export	CSV of every record.

curl -X POST .../v1/dynqrcodes \
  -H "x-api-key: YOUR_KEY" -H "Content-Type: application/json" \
  -d '{"destination_url": "https://example.com/landing", "name": "Spring campaign"}'

# -> 201
{"created": [{
  "code": "aB3xY9kQ", "short_url": "https://qordway.com/q/aB3xY9kQ",
  "destination_url": "https://example.com/landing", "name": "Spring campaign",
  "style": {}, "status": "active", "team_id": null,
  "created_at": 1785500000, "updated_at": 1785500000
}]}

Reporting (analytics)

Route	What it does
GET /dynqrcodes/analytics	Summary (total/unique scans) for every code you can see.
GET /dynqrcodes/{code}/analytics	Full breakdown for one code — daily counts, country, device, OS, browser.
GET /dynqrcodes/{code}/analytics/export	CSV of every individual scan event for one code.

See Dynamic QR Analytics for what each field means — the API returns the same data the analytics page shows, just as JSON/CSV instead of a chart.

Status codes

Code	Means	What to do
200 / 201	Success. 201 on creation.	—
400	Validation failed — a bad URL, a missing required field, or a batch over 50.	Read the error (or errors[].index) and fix the record. Retrying unchanged will fail identically.
403	The key is missing, revoked, or not valid yet — or the account behind it no longer has API access, because its plan changed or a temporary grant expired.	If the key is brand new, wait a few minutes for propagation. If the error mentions API access, the key is fine and the plan is the problem — regenerating won't help.
404	No such record, or it isn't in the library this key is scoped to.	Check the ID, and check whether you're using a personal key against a business record or vice versa.
429	Rate limit or daily quota exceeded.	Back off and retry. Batch your writes rather than looping single creates.

Frequently asked questions