Skip to main content
This page collects what’s common across every endpoint in this module — the QR-code CRUD surface of the Management API, mounted at qr/ on api.scanova.io. Read Management API overview first for the authentication scheme; this page only covers what’s specific to QR Codes.

​
Authentication is always required here

Unlike the public (OAuth2-authenticated) API, QR creation on the Management API host always requires an authenticated request — there is no anonymous-QR-then-link-later flow when you’re calling with an API key. Link QR Codes to your account exists for account-linking scenarios that originate elsewhere (e.g. the public API), not for calls made directly against this host.

​
Quotas

Most mutating endpoints are gated by one or more of these plan-level quotas: TOTAL_QR_CODES, DYNAMIC_QR_CODES, STATIC_QR_CODES, GS1_QR_CODES, CHILD_QR_CODES, AI_QR_CODE, CUSTOM_URL_HASH, RASTER_EXPORTING, VECTOR_EXPORTING, CUSTOM_TAG, TAG_MANAGEMENT, SHARED_USERS. A quota failure returns 403 with either a flat “your plan doesn’t include this” message, or (when the check is a remaining-count limit rather than plain existence) a {"detail": "...", "limit": <n>} shape naming the exhausted limit.

​
Role permissions

Independent of quota, most endpoints also check a role-based permission on the calling account: QR_CODE_CAN_VIEW / PAGE_CAN_VIEW, QR_CODE_CAN_ADD / PAGE_CAN_ADD / GS1_CAN_ADD, QR_CODE_CAN_EDIT / PAGE_CAN_EDIT, QR_CODE_CAN_DELETE / PAGE_CAN_DELETE, QR_CODE_CAN_EXPORT / PAGE_CAN_EXPORT, QR_CODE_CAN_DOWNLOAD, QR_CODE_TAG_CAN_ADD, GS1_RECALL_CREATE. The PAGE_* variant of a permission applies when the QR Code (or category) is a landing-page type; the plain variant applies otherwise.

​
Soft delete and Trash

QR Codes are soft-deleted by default: Delete a QR Code moves a QR Code to Trash rather than removing it. Trash has its own list, restore, and permanent delete endpoints — restoring is itself quota-checked against your current plan limits, so a restore can fail with 403 if it would put the account over its limit.

​
The GS1 referential-integrity guard

Every delete path (single, bulk, and permanent) runs the same check before removing anything: a QR Code that a GS1 code’s resolution references, or a GS1 parent with linked child variants, cannot be deleted — the request fails with 400 rather than cascading. See Check GS1 references to check before you delete, and child QR Codes for the parent/variant relationship itself.