---
title: "Edit a dynamic code (any field the dashboard can edit)"
method: PATCH
path: "/v1/dynamic/{id}"
---

# Edit a dynamic code (any field the dashboard can edit)

`PATCH /v1/dynamic/{id}`

Send only the fields you want to change: destination, label, custom slug, tags, folder or style.

## Request body

- object
  - `destination` string, uri
  - `label` string, nullable
  - `slug` string — Custom short-link back-half: 3–48 letters, numbers or hyphens.
  - `tags` string[] — Replaces the code's tags (max 10).
  - `folder_id` string, nullable — Folder id to file under, or null to un-file.
  - `style` object — QR style JSON (colours, dot/corner shapes, etc.) for re-download.
  - `theme` string — A saved theme id or name to restyle the code with (sets style).
  - `password` string, nullable — Pro: require this password (min 4 characters) before the code redirects. Pass null to remove all protection.
  - `pin` string, nullable — Pro: require a 4-digit PIN before the code redirects. Exactly 4 digits. Pass null to remove all protection.
  - `lock_type` 'pin' | 'password' — Which input scanners see.
  - `lock_hint` string, nullable — Optional hint shown on the unlock page, e.g. "Ask at the bar". Max 60 characters.
  - `ios_destination` string, uri, nullable — App links: iOS scanners follow this URL instead of destination (e.g. the App Store page). Null clears the override. Applies to the plain redirect path only.
  - `android_destination` string, uri, nullable — App links: Android scanners follow this URL instead of destination (e.g. the Google Play page). Null clears the override.
  - `pause_until` string, date-time, nullable — Schedule a pause: while this timestamp is in the future the code serves its inactive page, then self-resumes at the deadline (no cron, no status change). Pass null to clear the schedule. Future timestamps only, active codes only.

## Response `200`

Updated.

- object
  - `id` string
  - `slug` string
  - `short_url` string, uri
  - `destination` string, uri
  - `label` string, nullable

## Other responses

- `400` — Invalid request — malformed JSON, a missing/invalid required field, or a disallowed dynamic-code destination (destinations must be public http(s) URLs; private/internal hosts and oqr.to self-loops are rejected).
- `401` — The `Authorization: Bearer oqr_…` header is missing or the API key is invalid or revoked.
- `404` — The referenced code, folder or theme doesn't exist or isn't owned by your API key.
- `409` — The requested custom `slug` is already taken by another code.
- `500` — An unexpected server-side error.

## Changes

- **2026-09-01** `726b5233bc8a` — 3 info
  - added the new optional request property `android_destination`
  - added the new optional request property `ios_destination`
  - added the new optional request property `pause_until`
- **2026-08-06** `f1b3796cd1f6` — 4 info
  - added the new optional request property `lock_hint`
  - added the new optional request property `lock_type`
  - added the new optional request property `password`
  - added the new optional request property `pin`

[Change history](https://skmtc.dev/openqr/apis/openqr-api/changes/v1/dynamic/:id/patch.md)

---

[API](https://skmtc.dev/openqr/apis/openqr-api.md) · [All operations](https://skmtc.dev/openqr/apis/openqr-api/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/openqr/openqr-api/revisions/726b5233bc8a/schema)