QR codes API
REST endpoints for qr codes in SKUFlow: 7 operations with parameters, request and response fields, permissions and curl examples.
Base URL: https://app.skuflow.ai/api. Every call needs Authorization: Bearer skf_… (Authentication); {organizationId} ($ORGANIZATION_ID in the examples) is your business's id.
| Operation | Endpoint | Risk |
|---|---|---|
| List QR codes | GET /organizations/{organizationId}/qr-codes | read |
| Create a QR code | POST /organizations/{organizationId}/qr-codes | write |
| Get a QR code | GET /organizations/{organizationId}/qr-codes/{qrCodeId} | read |
| Change a QR code | PATCH /organizations/{organizationId}/qr-codes/{qrCodeId} | write |
| Delete a QR code | DELETE /organizations/{organizationId}/qr-codes/{qrCodeId} | sensitive |
| QR code scans | GET /organizations/{organizationId}/qr-codes/{qrCodeId}/stats | read |
| Download a QR code | GET /organizations/{organizationId}/qr-codes/{qrCodeId}/image | read |
List QR codes
GET /organizations/{organizationId}/qr-codes
Every QR code with its short link, destination, look, scans and leads, newest first. Read-only.
| Permission | website.read (Owner, Admin, Staff) |
| Risk | read, OAuth scope skuflow.read. Read: reads only. |
| MCP tool | qrCodes_list (toolset marketing) |
Example
curl "https://app.skuflow.ai/api/organizations/$ORGANIZATION_ID/qr-codes" \
-H "Authorization: Bearer $SKUFLOW_API_KEY"Response
200: the answer's fields
An array of objects:
| Field | Type | Description |
|---|---|---|
id | string | |
code | string | The short link's code (7 characters). |
shortLink | string | What the printed code holds: {app}/go/{code}. |
name | string | |
targetType | enum | One of WEBSITE, WEBSITE_PAGE, BOOKING, URL. |
targetPath | string or null | WEBSITE_PAGE: the page's address. |
targetUrl | string or null | Url: the address. |
addTracking | boolean | |
enabled | boolean | |
style | object | |
style.foreground | string | |
style.background | string | |
style.dotStyle | enum | One of square, rounded, dots. |
style.logoUrl | string | Up to 2000 characters. |
style.logoSize | number | 0.12–0.28. |
style.caption | string | Up to 40 characters. |
scanCount | integer | |
lastScannedAt | string (date-time) or null | |
leads | integer | Requests (quote requests, messages) that came in through this code. |
createdAt | string (date-time) | |
updatedAt | string (date-time) |
Create a QR code
POST /organizations/{organizationId}/qr-codes
Makes a dynamic QR code: it prints as a short SKUFlow link that counts each scan and forwards to the destination, which can be changed later without reprinting. Download it with GET …/{qrCodeId}/image.
| Permission | website.manage (Owner, Admin) |
| Risk | write, OAuth scope skuflow.write. Write: creates or changes records inside the business; nothing leaves it. |
| MCP tool | qrCodes_create (toolset marketing) |
Request body
| Field | Type | Required | Description |
|---|---|---|---|
name | string | Yes | Where it's used: "Trade show booth", "Packing slip insert". Up to 120 characters. |
targetType | enum | Yes | WEBSITE (home page), WEBSITE_PAGE (targetPath), BOOKING (the public request form) or URL (targetUrl). A website target falls back to the request form while the site isn't published. One of WEBSITE, WEBSITE_PAGE, BOOKING, URL. |
targetPath | string or null | No | Up to 60 characters. |
targetUrl | string or null | No | Up to 2000 characters. |
addTracking | boolean | No | Add utm_source=qr, utm_medium=print, utm_campaign, utm_content={code} (default true). |
enabled | boolean | No | Off: scans show a 'no longer active' page. |
style | object | No | Colours (dark on light, contrast checked), dot style, centre logo and size, caption. |
style.foreground | string | No | |
style.background | string | No | |
style.dotStyle | enum | No | One of square, rounded, dots. |
style.logoUrl | string | No | Up to 2000 characters. |
style.logoSize | number | No | 0.12–0.28. |
style.caption | string | No | Up to 40 characters. |
Example
curl -X POST "https://app.skuflow.ai/api/organizations/$ORGANIZATION_ID/qr-codes" \
-H "Authorization: Bearer $SKUFLOW_API_KEY" \
-H "Content-Type: application/json" \
-d '{"name":"Dana Whitfield","targetType":"WEBSITE"}'Response
201: the answer's fields
| Field | Type | Description |
|---|---|---|
id | string | |
code | string | The short link's code (7 characters). |
shortLink | string | What the printed code holds: {app}/go/{code}. |
name | string | |
targetType | enum | One of WEBSITE, WEBSITE_PAGE, BOOKING, URL. |
targetPath | string or null | WEBSITE_PAGE: the page's address. |
targetUrl | string or null | Url: the address. |
addTracking | boolean | |
enabled | boolean | |
style | object | |
style.foreground | string | |
style.background | string | |
style.dotStyle | enum | One of square, rounded, dots. |
style.logoUrl | string | Up to 2000 characters. |
style.logoSize | number | 0.12–0.28. |
style.caption | string | Up to 40 characters. |
scanCount | integer | |
lastScannedAt | string (date-time) or null | |
leads | integer | Requests (quote requests, messages) that came in through this code. |
createdAt | string (date-time) | |
updatedAt | string (date-time) |
Get a QR code
GET /organizations/{organizationId}/qr-codes/{qrCodeId}
One QR code with its short link, destination, look, all-time scans and leads. Read-only.
| Permission | website.read (Owner, Admin, Staff) |
| Risk | read, OAuth scope skuflow.read. Read: reads only. |
| MCP tool | qrCodes_get (toolset marketing) |
Parameters
| Name | In | Type | Required | Description |
|---|---|---|---|---|
qrCodeId | path | string | Yes |
Example
curl "https://app.skuflow.ai/api/organizations/$ORGANIZATION_ID/qr-codes/{qrCodeId}" \
-H "Authorization: Bearer $SKUFLOW_API_KEY"Response
200: the answer's fields
| Field | Type | Description |
|---|---|---|
id | string | |
code | string | The short link's code (7 characters). |
shortLink | string | What the printed code holds: {app}/go/{code}. |
name | string | |
targetType | enum | One of WEBSITE, WEBSITE_PAGE, BOOKING, URL. |
targetPath | string or null | WEBSITE_PAGE: the page's address. |
targetUrl | string or null | Url: the address. |
addTracking | boolean | |
enabled | boolean | |
style | object | |
style.foreground | string | |
style.background | string | |
style.dotStyle | enum | One of square, rounded, dots. |
style.logoUrl | string | Up to 2000 characters. |
style.logoSize | number | 0.12–0.28. |
style.caption | string | Up to 40 characters. |
scanCount | integer | |
lastScannedAt | string (date-time) or null | |
leads | integer | Requests (quote requests, messages) that came in through this code. |
createdAt | string (date-time) | |
updatedAt | string (date-time) |
Change a QR code
PATCH /organizations/{organizationId}/qr-codes/{qrCodeId}
Changes the fields sent. Changing the destination re-points codes already printed, at once.
| Permission | website.manage (Owner, Admin) |
| Risk | write, OAuth scope skuflow.write. Write: creates or changes records inside the business; nothing leaves it. |
| MCP tool | qrCodes_update (toolset marketing) |
Parameters
| Name | In | Type | Required | Description |
|---|---|---|---|---|
qrCodeId | path | string | Yes |
Request body
| Field | Type | Required | Description |
|---|---|---|---|
name | string | No | Where it's used: "Trade show booth", "Packing slip insert". Up to 120 characters. |
targetType | enum | No | WEBSITE (home page), WEBSITE_PAGE (targetPath), BOOKING (the public request form) or URL (targetUrl). A website target falls back to the request form while the site isn't published. One of WEBSITE, WEBSITE_PAGE, BOOKING, URL. |
targetPath | string or null | No | Up to 60 characters. |
targetUrl | string or null | No | Up to 2000 characters. |
addTracking | boolean | No | Add utm_source=qr, utm_medium=print, utm_campaign, utm_content={code} (default true). |
enabled | boolean | No | Off: scans show a 'no longer active' page. |
style | object | No | Colours (dark on light, contrast checked), dot style, centre logo and size, caption. |
style.foreground | string | No | |
style.background | string | No | |
style.dotStyle | enum | No | One of square, rounded, dots. |
style.logoUrl | string | No | Up to 2000 characters. |
style.logoSize | number | No | 0.12–0.28. |
style.caption | string | No | Up to 40 characters. |
Example
curl -X PATCH "https://app.skuflow.ai/api/organizations/$ORGANIZATION_ID/qr-codes/{qrCodeId}" \
-H "Authorization: Bearer $SKUFLOW_API_KEY" \
-H "Content-Type: application/json" \
-d '{"name":"Dana Whitfield","targetType":"WEBSITE","targetPath":"string"}'Response
200: the answer's fields
| Field | Type | Description |
|---|---|---|
id | string | |
code | string | The short link's code (7 characters). |
shortLink | string | What the printed code holds: {app}/go/{code}. |
name | string | |
targetType | enum | One of WEBSITE, WEBSITE_PAGE, BOOKING, URL. |
targetPath | string or null | WEBSITE_PAGE: the page's address. |
targetUrl | string or null | Url: the address. |
addTracking | boolean | |
enabled | boolean | |
style | object | |
style.foreground | string | |
style.background | string | |
style.dotStyle | enum | One of square, rounded, dots. |
style.logoUrl | string | Up to 2000 characters. |
style.logoSize | number | 0.12–0.28. |
style.caption | string | Up to 40 characters. |
scanCount | integer | |
lastScannedAt | string (date-time) or null | |
leads | integer | Requests (quote requests, messages) that came in through this code. |
createdAt | string (date-time) | |
updatedAt | string (date-time) |
Delete a QR code
DELETE /organizations/{organizationId}/qr-codes/{qrCodeId}
Destructive: printed copies stop working (scans show 'no longer active') and its scan history is deleted. Prefer enabled: false.
| Permission | website.manage (Owner, Admin) |
| Risk | sensitive, OAuth scope skuflow.sensitive. Sensitive: moves money, deletes, sends or shows something to a customer, or grants or revokes access. |
| MCP tool | qrCodes_delete (toolset marketing) |
| Approval | Over MCP, this tool always waits for your approval in SKUFlow. See Approvals. |
Parameters
| Name | In | Type | Required | Description |
|---|---|---|---|---|
qrCodeId | path | string | Yes |
Example
curl -X DELETE "https://app.skuflow.ai/api/organizations/$ORGANIZATION_ID/qr-codes/{qrCodeId}" \
-H "Authorization: Bearer $SKUFLOW_API_KEY"Response
200: the answer's fields
| Field | Type | Description |
|---|---|---|
ok | true |
QR code scans
GET /organizations/{organizationId}/qr-codes/{qrCodeId}/stats
Scans and unique scanners per day over days (default 30), devices, phone systems, all-time scans and leads. No addresses are stored. Read-only.
| Permission | website.read (Owner, Admin, Staff) |
| Risk | read, OAuth scope skuflow.read. Read: reads only. |
| MCP tool | qrCodes_stats (toolset marketing) |
Parameters
| Name | In | Type | Required | Description |
|---|---|---|---|---|
qrCodeId | path | string | Yes | |
days | query | integer | No | 7–365. |
Example
curl "https://app.skuflow.ai/api/organizations/$ORGANIZATION_ID/qr-codes/{qrCodeId}/stats" \
-H "Authorization: Bearer $SKUFLOW_API_KEY"Response
200: the answer's fields
| Field | Type | Description |
|---|---|---|
from | string | |
to | string | |
scans | integer | |
uniqueVisitors | integer | |
totalScans | integer | |
leads | integer | |
days | array of object | |
days[].date | string | |
days[].scans | integer | |
days[].visitors | integer | |
devices | object | |
devices.MOBILE | integer | |
devices.TABLET | integer | |
devices.DESKTOP | integer | |
systems | array of object | |
systems[].name | string | |
systems[].count | integer |
Download a QR code
GET /organizations/{organizationId}/qr-codes/{qrCodeId}/image
The code as SVG (vector: print at any size) or PNG size pixels wide (256–4096; 2048+ for print), base64. Read-only.
| Permission | website.read (Owner, Admin, Staff) |
| Risk | read, OAuth scope skuflow.read. Read: reads only. |
| MCP tool | qrCodes_image (toolset marketing) |
Parameters
| Name | In | Type | Required | Description |
|---|---|---|---|---|
qrCodeId | path | string | Yes | |
format | query | enum | No | One of svg, png. Default svg. |
size | query | integer | No | 256–4096. |
Example
curl "https://app.skuflow.ai/api/organizations/$ORGANIZATION_ID/qr-codes/{qrCodeId}/image" \
-H "Authorization: Bearer $SKUFLOW_API_KEY"Response
200: the answer's fields
| Field | Type | Description |
|---|---|---|
fileName | string | |
contentType | string | |
base64 | string |