> ## Documentation Index
> Fetch the complete documentation index at: https://docs.scanova.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Bulk-update QR Code fields

> PUT /qr/multi/

Sets the same field values across many QR Codes at once.

```
PUT    https://api.scanova.io/qr/multi/
Authorization: 401f7ac837da42b97f613d789819ff93537bee6a
```

<ParamField body="qrids" type="array">
  The `qrid` values to update.
</ParamField>

<ParamField body="all" type="boolean" default="false">
  Apply to **every** QR Code the account owns, ignoring `qrids`.
</ParamField>

Any remaining top-level keys are applied as raw QR-code field overrides — `{"is_active": false}` in the example below.

<RequestExample>
  ```bash cURL theme={null}
  curl -X PUT "https://api.scanova.io/qr/multi/" \
    -H "Authorization: 401f7ac837da42b97f613d789819ff93537bee6a" \
    -H "Content-Type: application/json" \
    -d '{
        "qrids": [
            "Qa1b2c3d4e5f6g7h8",
            "Qb2c3d4e5f6g7h8i9"
        ],
        "is_active": false
    }'
  ```
</RequestExample>

Returns `204 No Content`.

<Warning>
  This is a **low-level field-set that bypasses per-category schema validation** entirely for the fields it writes. It does not carry the same safety as [Update a QR Code](/api-reference/management-api/qr/update) — a value that endpoint would reject can be written here, leaving content that fails validation the next time it is edited or published. Use it for simple flags across a selection, not for content.
</Warning>

<Note>
  Toggling `is_active` has a side effect beyond the flag itself: it clears or re-derives `expire_on` on the related dynamic URL objects, so a previously-expired QR Code reactivated this way does not immediately re-expire.
</Note>

## Related

* [Update a QR Code](/api-reference/management-api/qr/update) — the validated, single-QR update path.
* [Copy a QR Code](/api-reference/management-api/qr/bulk-copy-create) — the `POST` operation on this same path.
* [Delete many QR Codes](/api-reference/management-api/qr/multi-delete) — the bulk delete equivalent.
* [QR Manager overview](/api-reference/management-api/qr/overview) — the quotas, role permissions, and Trash model shared by every endpoint in this module.
* [Management API overview](/api-reference/management-api/overview) — the auth scheme and quota rules that apply to this endpoint.


## OpenAPI

````yaml api-reference/openapi/management-api.json PUT /qr/multi/
openapi: 3.1.0
info:
  title: Scanova Management API (v2)
  description: >-
    The complete Scanova Management API — every endpoint available at
    api.scanova.io (QR codes, folders, tags, leads, forms, analytics, plans,
    shared users & roles), plus the token-creation and usage-stats endpoints
    used to authenticate against it. Every path and request/response shape below
    was verified live against a real API key and the actual running backend
    (Phase 7, 2026-08-16) — not guessed from reading urls.py alone.
  version: 2.0.0
servers:
  - url: https://api.scanova.io
    description: Management API — QR/folder/tag/lead/form/analytics/plans endpoints
security:
  - apiKeyAuth: []
paths:
  /qr/multi/:
    put:
      summary: Bulk-set fields on many QR codes
      description: >-
        Low-level bulk field-set. Targets QR codes by `qrids` or `all: true`,
        and applies the remaining top-level keys as raw QRCode field overrides.
        WARNING: this BYPASSES the per-category JSON-schema validation the
        single-update endpoint runs, so it does not carry the same safety.
        Toggling `is_active` also clears or re-derives `expire_on` on the
        related dynamic URL objects. Returns 204.
      operationId: bulkUpdateQrCodeFields
      requestBody:
        content:
          application/json:
            example:
              qrids:
                - Qa1b2c3d4e5f6g7h8
                - Qb2c3d4e5f6g7h8i9
              is_active: false
      responses:
        '204':
          description: Fields applied.
        '400':
          description: Neither `qrids` nor `all` was given, or nothing matched.
components:
  securitySchemes:
    apiKeyAuth:
      type: apiKey
      in: header
      name: Authorization
      description: >-
        Send your Management API key as the raw value of the Authorization
        header — no "Bearer " or "Token " prefix, and no other characters.
        Example: `Authorization: 401f7ac837da42b97f613d789819ff93537bee6a`. A
        header containing more than one space-separated part is rejected
        outright. Requests also require the request's Host header to be the
        management API host (e.g. api.scanova.io) — the same key sent to the
        regular API host will not authenticate.

````