Skip to main content
POST
Create one short link in the workspace bound to your API key. Only long_url is required.
You do not send a workspace ID. A biqli_ API key belongs to exactly one workspace, and every resource created or attached by this request is scoped to that workspace.

Authentication and permissions

Send your workspace API key as a Bearer token:
The key always needs Links: Write (links.create). If you attach existing workspace resources, it also needs the matching read permission. Creating a QR code attached to the new link only needs Links: Write. It does not need a standalone QR code permission and does not consume standalone QR code quota. The user who created the key must still have access to the workspace and be allowed to create links there. Revoking the key or removing that workspace access immediately prevents new requests.

Minimal request

Biqli normalizes a destination without a scheme to HTTPS. For example, example.com/product becomes https://example.com/product. Custom aliases are unique per domain across short links, folders, and bio pages. A duplicate alias returns 409 alias_taken and does not create a link. An external_id is unique within the API key’s workspace. A duplicate returns 409 external_id_taken.

Access and expiration

UTM parameters

Use utm for an ampersand-separated query string without a leading ?. Biqli prefixes keys with utm_ when the prefix is missing, then appends the parameters to the destination without replacing its existing query string.
The redirect destination becomes:

Dynamic routing

Use targeting rules to override the destination for matching visitors. Each rule has a key and destination value. Biqli uses the first matching rule. Each list accepts up to 100 rules. Rule keys are limited to 250 characters and destinations to 1,000 characters.
All rule destinations, including the click-expiration destination, pass through the same URL validation and safety flow as long_url.

Attach workspace resources

Pass public IDs to attach resources that already exist in the key’s workspace. Internal numeric database IDs are not accepted.
If any supplied ID is malformed or uses the wrong resource prefix, validation returns 422. If it is valid but missing or belongs to another workspace, the API returns 404 resource_not_found. This prevents cross-workspace resource disclosure.

Conversion tracking and indexing

Set conversion_tracking_enabled to append a Biqli click ID to the destination for conversion attribution. It defaults to false. Set allow_search_engine_indexing to true only when you want search engines to index the short-link page. It defaults to false, which sends no-index instructions.

Custom social preview

Set proxy to true to use your own social preview metadata. You can provide any combination of title, description, and image.
image rejects local hostnames, private or reserved IP literals, and non-HTTPS URLs. Providing preview metadata without proxy: true returns a validation error. Set proxy to false or omit it to use destination metadata instead.

Create an attached QR code

Set create_qr_code to true to generate a 1,024-pixel SVG QR code that points to the new short URL.
qr_logo accepts:
  • app: Include the Biqli logo. This is the default.
  • none: Generate the QR code without a center logo. This option requires the workspace plan permission for unbranded QR codes.
You can only send qr_logo when create_qr_code is true. The response includes the stored SVG URL, format, and selected logo mode.

Complete request

Successful response

A link that clears synchronous safety checks returns 201 Created.
The API never returns the internal numeric link or workspace ID. It also never returns the password hash or plaintext password.

Pending safety response

If a destination redirects or needs deeper inspection, Biqli atomically creates the link and returns 202 Accepted with safety_status: "pending". The following abridged response highlights the pending state:
The short URL shows a pending-safety response and does not redirect until the background check marks every destination clear. A failed background check quarantines the link. A destination blocked by the synchronous checks returns 422 url_blocked and no link is created.

Plans, quotas, and atomicity

Workspace plan permissions and quotas apply before Biqli writes the link. Plan-gated options include custom aliases, passwords, activation and expiration, click expiration, UTM parameters, dynamic routing, and unbranded QR codes.
  • A missing plan entitlement returns 403 upgrade_required.
  • Exhausted monthly link quota returns 403 quota_exceeded.
  • The API rate limit uses the plan attached to the key’s workspace, not another workspace owned by the same user.
  • Link fields, rules, tags, folders, pixels, and the attached QR code are created as one operation. A failure rolls back the database changes and removes a QR file created by that failed operation.
The endpoint rejects unknown top-level fields. It also rejects workspaceId, workspace_id, accessToken, type, and type_id; those are internal or legacy fields and are never part of the workspace API contract.

Errors

Every error uses the same envelope:
The same request ID is returned in the X-Biq-Request-Id response header. You can send your own X-Biq-Request-Id value up to 100 characters for distributed tracing. Include it when contacting support. Validation errors include an error.details.errors object keyed by field. Upgrade errors can include current_plan, required_plan, and feature. Quota errors include current workspace usage details.
This endpoint does not currently accept an idempotency key. Retrying a request after an ambiguous network failure can create another random-alias link. A caller-controlled alias or unique external_id provides conflict protection for workflows that require retry-safe creation.

Shared API behavior

Authentication is workspace-scoped; see Authentication. Errors use the standard envelope and request IDs described in Errors, and requests are subject to Rate limits.

Authorizations

Authorization
string
header
required

A workspace API key beginning with biqli_.

Body

application/json
long_url
string
required

Destination URL. Biqli normalizes a missing scheme to HTTPS.

Required string length: 3 - 1000
Example:

"https://example.com/product"

name
string | null

Internal label for the link.

Maximum string length: 150
external_id
string | null

Caller-controlled identifier, unique within the API key's workspace.

Maximum string length: 255
domain_id
string | null

Public ID of a custom domain available to this workspace. Omit it to use the Biqli default domain.

Pattern: ^biq_dom_[0-9A-HJKMNP-TV-Z]{26}$
alias
string | null

Requested short-link alias. The configured alias character and length rules apply.

Maximum string length: 50
active
boolean
default:true

Whether the link can redirect after it passes safety checks.

password
string | null

Password visitors must enter before redirecting.

Maximum string length: 250
activates_at
string<date-time> | null

ISO 8601 date and time when the link becomes active.

expires_at
string<date-time> | null

Future ISO 8601 expiration date and time. It must be later than activates_at.

exp_clicks_rule
object | null
utm
string | null

Ampersand-separated UTM parameters without a leading question mark. Biqli prefixes keys with utm_ when needed.

Maximum string length: 2000
Example:

"source=newsletter&medium=email&campaign=summer"

geo_rules
object[] | null

Destination overrides evaluated for matching visitors.

Maximum array length: 100
device_rules
object[] | null

Destination overrides evaluated for matching visitors.

Maximum array length: 100
platform_rules
object[] | null

Destination overrides evaluated for matching visitors.

Maximum array length: 100
folder_ids
string[] | null

Unique public IDs of folders in this workspace.

Maximum array length: 100
Pattern: ^biq_fld_[0-9A-HJKMNP-TV-Z]{26}$
pixel_ids
string[] | null

Unique public IDs of tracking pixels in this workspace.

Maximum array length: 100
Pattern: ^biq_pxl_[0-9A-HJKMNP-TV-Z]{26}$
tag_ids
string[] | null

Unique public IDs of tags in this workspace.

Maximum array length: 100
Pattern: ^biq_tag_[0-9A-HJKMNP-TV-Z]{26}$
conversion_tracking_enabled
boolean
default:false

Append a Biqli click ID for conversion attribution.

allow_search_engine_indexing
boolean
default:false

Allow search engines to index the short-link page.

proxy
boolean
default:false

Enable the custom social preview supplied by title, description, and image.

title
string | null

Custom social preview title. Requires proxy=true.

Maximum string length: 255
description
string | null

Custom social preview description. Requires proxy=true.

Maximum string length: 1000
image
string<uri> | null

Public HTTPS URL for the custom social preview image. Requires proxy=true. Private and local hosts are rejected.

Maximum string length: 2048
create_qr_code
boolean
default:false

Generate and attach an SVG QR code for this short link.

qr_logo
enum<string> | null
default:app

Use the Biqli app logo or no center logo. Requires create_qr_code=true. The none option is plan-gated.

Available options:
app,
none,
null

Response

The link was created and is ready to redirect.

status
string
required
Allowed value: "success"