> ## Documentation Index
> Fetch the complete documentation index at: https://docs.scanova.io/llms.txt
> Use this file to discover all available pages before exploring further.

# QR Manager overview

> Shared quotas, permissions, and conventions for every /qr/ endpoint

This page collects what's common across every endpoint in this module — the QR-code CRUD surface of the Management API, mounted at `qr/` on `api.scanova.io`. Read [Management API overview](/api-reference/management-api/overview) first for the authentication scheme; this page only covers what's specific to QR Codes.

## Authentication is always required here

Unlike the public (OAuth2-authenticated) API, QR **creation** on the Management API host always requires an authenticated request — there is no anonymous-QR-then-link-later flow when you're calling with an API key. [Link QR Codes to your account](/api-reference/management-api/qr/link) exists for account-linking scenarios that originate elsewhere (e.g. the public API), not for calls made directly against this host.

## Quotas

Most mutating endpoints are gated by one or more of these plan-level quotas:

`TOTAL_QR_CODES`, `DYNAMIC_QR_CODES`, `STATIC_QR_CODES`, `GS1_QR_CODES`, `CHILD_QR_CODES`, `AI_QR_CODE`, `CUSTOM_URL_HASH`, `RASTER_EXPORTING`, `VECTOR_EXPORTING`, `CUSTOM_TAG`, `TAG_MANAGEMENT`, `SHARED_USERS`.

A quota failure returns `403` with either a flat "your plan doesn't include this" message, or (when the check is a remaining-count limit rather than plain existence) a `{"detail": "...", "limit": <n>}` shape naming the exhausted limit.

## Role permissions

Independent of quota, most endpoints also check a role-based permission on the calling account:

`QR_CODE_CAN_VIEW` / `PAGE_CAN_VIEW`, `QR_CODE_CAN_ADD` / `PAGE_CAN_ADD` / `GS1_CAN_ADD`, `QR_CODE_CAN_EDIT` / `PAGE_CAN_EDIT`, `QR_CODE_CAN_DELETE` / `PAGE_CAN_DELETE`, `QR_CODE_CAN_EXPORT` / `PAGE_CAN_EXPORT`, `QR_CODE_CAN_DOWNLOAD`, `QR_CODE_TAG_CAN_ADD`, `GS1_RECALL_CREATE`.

The `PAGE_*` variant of a permission applies when the QR Code (or category) is a landing-page type; the plain variant applies otherwise.

## Soft delete and Trash

QR Codes are soft-deleted by default: [Delete a QR Code](/api-reference/management-api/qr/delete) moves a QR Code to Trash rather than removing it. Trash has its own [list](/api-reference/management-api/qr/trash-list), [restore](/api-reference/management-api/qr/trash-restore), and [permanent delete](/api-reference/management-api/qr/trash-delete) endpoints — restoring is itself quota-checked against your current plan limits, so a restore can fail with `403` if it would put the account over its limit.

## The GS1 referential-integrity guard

Every delete path (single, bulk, and permanent) runs the same check before removing anything: a QR Code that a GS1 code's resolution references, or a GS1 parent with linked child variants, cannot be deleted — the request fails with `400` rather than cascading. See [Check GS1 references](/api-reference/management-api/qr/gs1-references) to check before you delete, and [child QR Codes](/api-reference/management-api/qr/child-list-create) for the parent/variant relationship itself.

## Related

* [List QR Codes](/api-reference/management-api/qr/list)
* [Create a QR Code](/api-reference/management-api/qr/create)
* [Management API overview](/api-reference/management-api/overview) — authentication and general quota architecture.