> ## Documentation Index
> Fetch the complete documentation index at: https://learn.biq.li/llms.txt
> Use this file to discover all available pages before exploring further.

# Create a QR code

> Create a standalone static or dynamic QR code with a validated design.

Create a QR code in the workspace bound to your API key. You do not send a workspace ID.

## Authentication and permissions

`POST /v1/qr` requires **QR codes: Write** (`qr_codes.create`). A non-empty `tag_ids` array also requires **Tags: Read** (`tags.view`).

```http theme={null}
Authorization: Bearer biqli_your_workspace_api_key
Accept: application/json
Content-Type: application/json
```

## Minimal dynamic link

```bash theme={null}
curl --request POST \
  --url https://biq.li/api/v1/qr \
  --header 'Authorization: Bearer biqli_your_workspace_api_key' \
  --header 'Accept: application/json' \
  --header 'Content-Type: application/json' \
  --data '{
    "type": "dynamic",
    "content_type": "link",
    "title": "Product QR",
    "payload": {
      "long_url": "https://example.com/product"
    }
  }'
```

`type`, `content_type`, `title`, and `payload` are required. A dynamic QR encodes a stable Biqli tracking URL, so you can update its destination later. A static QR directly encodes its content and cannot use dynamic routing features.

## Supported content

| Type    | `content_type` | Payload                                                                                                                                         |
| ------- | -------------- | ----------------------------------------------------------------------------------------------------------------------------------------------- |
| Static  | `text`         | `text` is required, maximum 300 characters.                                                                                                     |
| Static  | `sms`          | `phone` is required; `message` is optional, maximum 160 characters.                                                                             |
| Static  | `wifi`         | `ssid` is required. `encryption` is `none`, `WEP`, `WPA`, `WPA2`, or `WPA3`; secured networks require `password`.                               |
| Static  | `vcard`        | Supply at least one contact field: `first_name`, `last_name`, `organization`, `phone`, `fax`, `email`, `website`, or a supported social handle. |
| Static  | `event`        | `title` and `start` are required. Optional fields are `end`, `description`, `location`, and `url`; `end` cannot precede `start`.                |
| Dynamic | `link`         | `long_url` is required.                                                                                                                         |
| Dynamic | `email`        | `email` is required; `subject` and `message` are optional.                                                                                      |
| Dynamic | `phone`        | `phone` is required.                                                                                                                            |
| Dynamic | `sms`          | `phone` is required; `message` is optional.                                                                                                     |
| Dynamic | `vcard`        | Uses the same contact fields as static vCard.                                                                                                   |
| Dynamic | `application`  | Supply at least one of `app_store_url`, `google_play_url`, or `fallback_url`.                                                                   |
| Dynamic | `whatsapp`     | `phone` is required; `message` is optional.                                                                                                     |

The vCard `socials` object accepts `youtube`, `x`, `instagram`, `tiktok`, and `linkedin`. The public API does not upload vCard avatars.

## Optional dynamic behavior

| Field                                         | Applies to                                                                                                                   |
| --------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------- |
| `activates_at`, `expires_at`                  | All dynamic QR codes. Use ISO 8601 timestamps.                                                                               |
| `exp_clicks_rule`                             | All dynamic QR codes. `key` is the maximum scan count and `value` is an optional redirect URL.                               |
| `utm`                                         | Dynamic `link`, `application`, and `whatsapp`. Send an encoded query string such as `utm_source=poster&utm_campaign=launch`. |
| `geo_rules`, `device_rules`, `platform_rules` | Dynamic `link` and `application`. Each item has `key` and destination `value`.                                               |
| `tag_ids`                                     | Static and dynamic QR codes. Send workspace `biq_tag_...` IDs.                                                               |

## Styling

Send the optional `qr_config` object to control matrix, eye-frame, and eye styles, flat colors, gradients, gradient inheritance, and the default Biqli logo. See [Style a QR code](/docs/api-reference/qr-codes/styling) for every field and precedence rule.

```json theme={null}
{
  "qr_config": {
    "matrixStyle": "dots",
    "matrixColorMode": "gradient",
    "matrixGradient": {
      "colorOne": "#214687",
      "colorTwo": "#44C8DE",
      "angle": "45deg",
      "midpoint": 50
    },
    "applyGradientToAll": true,
    "eyeFrameStyle": "rounded-square",
    "eyeStyle": "circle",
    "showLogo": true
  }
}
```

## Response

Success returns `201 Created` with a complete `qr_code` resource and a `biq_qr_...` ID. `scan_value` contains the directly encoded value for static QR codes or the stable Biqli URL for dynamic QR codes.

Validation failures return `422 validation_error`. Unsafe destinations use the standard URL-safety response. Quota or plan restrictions return `403`; hiding the default logo without the required plan returns `upgrade_required`.

## Shared API behavior

Authentication is workspace-scoped; see [Authentication](/docs/api-reference/authentication). Errors use the standard envelope and request IDs described in [Errors](/docs/api-reference/errors), and requests are subject to [Rate limits](/docs/api-reference/rate-limits).


## OpenAPI

````yaml POST /v1/qr
openapi: 3.1.0
info:
  title: Biqli API
  version: 1.0.0
  description: Workspace-scoped REST API for Biqli.
servers:
  - url: https://biq.li/api
security:
  - bearerAuth: []
paths:
  /v1/qr:
    post:
      tags:
        - QR codes
      summary: Create a QR code
      description: Creates a QR code in the API key workspace. Requires qr_codes.create.
      operationId: qr.store
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/QrWrite'
      responses:
        '201':
          description: QR code created.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/QrResponse'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '422':
          $ref: '#/components/responses/UnprocessableEntity'
        '429':
          $ref: '#/components/responses/RateLimited'
        '500':
          $ref: '#/components/responses/InternalError'
components:
  schemas:
    QrWrite:
      allOf:
        - $ref: '#/components/schemas/QrFields'
        - type: object
          required:
            - type
            - content_type
            - title
            - payload
    QrResponse:
      type: object
      required:
        - qr_code
        - status
      properties:
        qr_code:
          $ref: '#/components/schemas/QrCode'
        status:
          type: string
          const: success
    QrFields:
      type: object
      additionalProperties: false
      properties:
        type:
          type: string
          enum:
            - static
            - dynamic
        content_type:
          type: string
          enum:
            - text
            - link
            - email
            - phone
            - sms
            - wifi
            - vcard
            - event
            - application
            - whatsapp
        title:
          type: string
          maxLength: 255
        payload:
          $ref: '#/components/schemas/QrPayload'
        qr_config:
          oneOf:
            - type: 'null'
            - $ref: '#/components/schemas/QrConfig'
        utm:
          type:
            - string
            - 'null'
          maxLength: 2000
        activates_at:
          type:
            - string
            - 'null'
          format: date-time
        expires_at:
          type:
            - string
            - 'null'
          format: date-time
        geo_rules:
          type: array
          items:
            $ref: '#/components/schemas/PublicRule'
        device_rules:
          type: array
          items:
            $ref: '#/components/schemas/PublicRule'
        platform_rules:
          type: array
          items:
            $ref: '#/components/schemas/PublicRule'
        exp_clicks_rule:
          type:
            - object
            - 'null'
        tag_ids:
          $ref: '#/components/schemas/PublicIdList'
    QrCode:
      type: object
      required:
        - id
        - type
        - content_type
        - title
        - payload
        - scan_value
        - qr_config
        - geo_rules
        - device_rules
        - platform_rules
        - tag_ids
        - clicks_count
        - safety_status
      properties:
        id:
          type: string
          pattern: ^biq_qr_[0-9A-HJKMNP-TV-Z]{26}$
        type:
          type: string
          enum:
            - static
            - dynamic
        content_type:
          type: string
          enum:
            - text
            - link
            - email
            - phone
            - sms
            - wifi
            - vcard
            - event
            - application
            - whatsapp
        title:
          type:
            - string
            - 'null'
        payload:
          $ref: '#/components/schemas/QrPayload'
        scan_value:
          type: string
        qr_config:
          $ref: '#/components/schemas/QrConfig'
        utm:
          type:
            - string
            - 'null'
        activates_at:
          type:
            - string
            - 'null'
          format: date-time
        expires_at:
          type:
            - string
            - 'null'
          format: date-time
        geo_rules:
          type: array
          items:
            $ref: '#/components/schemas/PublicRule'
        device_rules:
          type: array
          items:
            $ref: '#/components/schemas/PublicRule'
        platform_rules:
          type: array
          items:
            $ref: '#/components/schemas/PublicRule'
        exp_clicks_rule:
          type:
            - object
            - 'null'
        tag_ids:
          $ref: '#/components/schemas/PublicIdList'
        clicks_count:
          type: integer
          minimum: 0
        clicked_at:
          type:
            - string
            - 'null'
          format: date-time
        safety_status:
          type: string
          enum:
            - clear
            - pending
            - quarantined
        created_at:
          type:
            - string
            - 'null'
          format: date-time
        updated_at:
          type:
            - string
            - 'null'
          format: date-time
    ApiError:
      type: object
      required:
        - error
        - request_id
      properties:
        error:
          type: object
          required:
            - code
            - message
          properties:
            code:
              type: string
              enum:
                - invalid_token
                - insufficient_scope
                - upgrade_required
                - quota_exceeded
                - resource_not_found
                - domain_taken
                - alias_taken
                - external_id_taken
                - folder_name_taken
                - tag_name_taken
                - pixel_name_taken
                - biolink_name_taken
                - method_not_allowed
                - url_blocked
                - dns_verification_failed
                - validation_error
                - rate_limit_exceeded
                - internal_server_error
            message:
              type: string
            details:
              type: object
              additionalProperties: true
        request_id:
          type: string
          description: Request identifier to include when contacting support.
    QrPayload:
      type: object
      additionalProperties: false
      description: >-
        Fields must match content_type. See Create a QR code for required
        combinations.
      properties:
        long_url:
          type: string
        text:
          type: string
          maxLength: 300
        phone:
          type: string
          maxLength: 80
        message:
          type: string
          maxLength: 2000
        ssid:
          type: string
          maxLength: 255
        encryption:
          type: string
          enum:
            - none
            - WEP
            - WPA
            - WPA2
            - WPA3
        password:
          type: string
          maxLength: 255
        first_name:
          type: string
          maxLength: 100
        last_name:
          type: string
          maxLength: 100
        organization:
          type: string
          maxLength: 255
        fax:
          type: string
          maxLength: 80
        email:
          type: string
          format: email
          maxLength: 255
        subject:
          type: string
          maxLength: 255
        website:
          type: string
          maxLength: 255
        socials:
          $ref: '#/components/schemas/QrSocials'
        title:
          type: string
          maxLength: 255
        description:
          type: string
          maxLength: 2000
        location:
          type: string
          maxLength: 1000
        url:
          type: string
          format: uri
          maxLength: 1000
        start:
          type: string
          format: date-time
        end:
          type: string
          format: date-time
        app_store_url:
          type: string
          format: uri
          maxLength: 1000
        google_play_url:
          type: string
          format: uri
          maxLength: 1000
        fallback_url:
          type: string
          format: uri
          maxLength: 1000
    QrConfig:
      type: object
      additionalProperties: false
      description: >-
        Public QR design. applyGradientToAll gives the matrix gradient
        precedence over both eye sections. Otherwise applyEyeFrameGradientToEye
        gives the eye-frame gradient precedence over the eye center. Custom
        logos are not supported.
      properties:
        matrixColor:
          type: string
          pattern: ^#[0-9A-Fa-f]{6}$
        eyeFrameColor:
          type: string
          pattern: ^#[0-9A-Fa-f]{6}$
        eyeColor:
          type: string
          pattern: ^#[0-9A-Fa-f]{6}$
        matrixColorMode:
          type: string
          enum:
            - flat
            - gradient
        matrixGradient:
          $ref: '#/components/schemas/QrGradient'
        eyeFrameColorMode:
          type: string
          enum:
            - flat
            - gradient
        eyeFrameGradient:
          $ref: '#/components/schemas/QrGradient'
        eyeColorMode:
          type: string
          enum:
            - flat
            - gradient
        eyeGradient:
          $ref: '#/components/schemas/QrGradient'
        applyGradientToAll:
          type: boolean
          description: >-
            Requires matrixColorMode=gradient. When true, matrixGradient renders
            the matrix, eye frames, and eye centers.
        applyEyeFrameGradientToEye:
          type: boolean
          description: >-
            Requires eyeFrameColorMode=gradient. When true and
            applyGradientToAll is false, eyeFrameGradient renders the eye frames
            and eye centers.
        matrixStyle:
          type: string
          enum:
            - square
            - dots
            - organic
            - vertical-pills
            - horizontal-pills
        eyeFrameStyle:
          type: string
          enum:
            - square
            - rounded-square
            - circle
        eyeStyle:
          type: string
          enum:
            - square
            - rounded-square
            - circle
            - diamond
        showLogo:
          type: boolean
          description: Shows the default Biqli logo. Hiding it requires plan access.
    PublicRule:
      type: object
      additionalProperties: false
      required:
        - key
        - value
      properties:
        key:
          type: string
          maxLength: 250
        value:
          type: string
          maxLength: 1000
    PublicIdList:
      type: array
      maxItems: 100
      uniqueItems: true
      items:
        type: string
    QrSocials:
      type: object
      additionalProperties: false
      properties:
        youtube:
          type: string
          maxLength: 1000
        x:
          type: string
          maxLength: 1000
        instagram:
          type: string
          maxLength: 1000
        tiktok:
          type: string
          maxLength: 1000
        linkedin:
          type: string
          maxLength: 1000
    QrGradient:
      type: object
      additionalProperties: false
      required:
        - colorOne
        - colorTwo
        - angle
        - midpoint
      properties:
        colorOne:
          type: string
          pattern: ^#[0-9A-Fa-f]{6}$
          examples:
            - '#214687'
        colorTwo:
          type: string
          pattern: ^#[0-9A-Fa-f]{6}$
          examples:
            - '#44C8DE'
        angle:
          type: string
          enum:
            - 0deg
            - 45deg
            - 90deg
            - 135deg
            - 180deg
            - 225deg
            - 270deg
            - 315deg
        midpoint:
          type: integer
          minimum: 5
          maximum: 95
  responses:
    Unauthorized:
      $ref: '#/components/responses/ApiErrorResponse'
      description: The workspace API key is missing, invalid, or revoked.
    Forbidden:
      $ref: '#/components/responses/ApiErrorResponse'
      description: >-
        The key lacks a required scope, the workspace must upgrade, or its quota
        is exhausted.
    UnprocessableEntity:
      $ref: '#/components/responses/ApiErrorResponse'
      description: >-
        The payload is invalid, a destination was blocked, or domain DNS
        verification is not ready.
    RateLimited:
      description: The workspace exceeded its plan's API rate limit.
      headers:
        RateLimit-Policy:
          description: Current IETF HTTPAPI quota policy as a structured field.
          schema:
            type: string
            example: '"workspace-api";q=1000;w=60'
        RateLimit:
          description: Current IETF HTTPAPI service limit as a structured field.
          schema:
            type: string
            example: '"workspace-api";r=0;t=17'
        Retry-After:
          description: Seconds to wait before retrying the request.
          schema:
            type: integer
            minimum: 0
            example: 17
        X-RateLimit-Limit:
          description: Legacy maximum request count for the current window.
          schema:
            type: integer
            minimum: 1
            example: 1000
        X-RateLimit-Remaining:
          description: Legacy remaining request count.
          schema:
            type: integer
            minimum: 0
            example: 0
        X-RateLimit-Reset:
          description: Legacy reset time as a UTC Unix timestamp.
          schema:
            type: integer
            format: int64
            example: 1788126519
        X-Biq-Request-Id:
          description: Request identifier for support and tracing.
          schema:
            type: string
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ApiError'
    InternalError:
      $ref: '#/components/responses/ApiErrorResponse'
      description: The request failed unexpectedly.
    ApiErrorResponse:
      description: API error.
      headers:
        X-Biq-Request-Id:
          description: Request identifier for support and tracing.
          schema:
            type: string
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ApiError'
  securitySchemes:
    bearerAuth:
      type: http
      scheme: bearer
      bearerFormat: Workspace API key
      description: A workspace API key beginning with biqli_.

````