---
title: "Update a QR: label, status, content (payload, validated for its type), targetUrl (url type), design or folder. The printed code does not change."
method: PATCH
path: "/api/v1/qrs/{id}"
tags: ["QR Codes"]
---

# Update a QR: label, status, content (payload, validated for its type), targetUrl (url type), design or folder. The printed code does not change.

`PATCH /api/v1/qrs/{id}`

## Request

- Base URL: `https://qrlia.dev.castlesoft.eu`
- URL: `https://qrlia.dev.castlesoft.eu/api/v1/qrs/{id}`
- Auth: one of:
  - HTTP bearer
  - API key in cookie `qrc_session`

## Path parameters

- `id` string, uuid, required

## Request body

- object
  - `label` string
  - `status` 'active' | 'paused' | 'archived': paused/archived QRs stop redirecting; active resumes.
  - `targetUrl` string, uri: URL QRs only: shorthand for changing payload.targetUrl.
  - `payload` object: Replace the QR's content. Same shape as the type's create field (e.g. profile, menu, wifi payload); validated against the QR's type. The printed code does not change.
  - `designId` string, uuid, nullable: Saved design (designs_list) to render this QR with.
  - `folderId` string, uuid, nullable: Folder to file the QR in; null = company root. Plan feature qr_folders.
  - `access` object: Password, start date, expiry date or scan limit.
    - `password` string, nullable: Visitors must enter it before the code opens.
    - `startsAt` string, date-time, nullable: Code shows a 'not active yet' message (or fallbackUrl) before this time.
    - `expiresAt` string, date-time, nullable: After this time the code shows its expiry message (or fallbackUrl).
    - `maxScans` integer, nullable: Stop after this many scans by people (bots don't count).
    - `fallbackUrl` string, uri, nullable: Where not-started / expired / used-up codes send visitors.
    - `fallbackMessage` string, nullable
  - `tracking` object: Analytics tags and opt-in location for the landing page; URL codes show a short consent page first.
    - `ga4Id` string, nullable
    - `metaPixelId` string, nullable
    - `gtmId` string, nullable
    - `requestLocation` boolean, nullable: Ask visitors (opt-in) to share an approximate location (~1 km).

## Response `200`

Updated

- Qr
  - `id` string, uuid, required
  - `tenantId` string, uuid, required
  - `companyId` string, uuid, required
  - `type` 'url' | 'vcard' | 'profile_card' | 'text' | 'email' | 'phone' | 'sms' | 'whatsapp' | 'wifi' | 'pdf' | 'image' | 'audio' | 'video' | 'app' | 'multilink' | 'menu' | 'feedback' | 'event' | 'dpp' | 'coupon' | 'sepa' | 'paypal' | 'crypto' | 'lead_form', required: Discriminator for QR payload shape.
  - `slug` string, nullable, required
  - `label` string, required
  - `payload` object, required
  - `designId` string, uuid, nullable, required
  - `folderId` string, uuid, nullable, required
  - `status` 'active' | 'paused' | 'archived', required
  - `createdAt` string, date-time, required
  - `updatedAt` string, date-time, required
  - `shortLink` string, uri, nullable: The link the printed code encodes (https://<host>/r/<slug>).
  - `access` object
    - `passwordProtected` boolean, required
    - `startsAt` string, nullable, required
    - `expiresAt` string, nullable, required
    - `maxScans` number, nullable, required
    - `fallbackUrl` string, nullable, required
    - `fallbackMessage` string, nullable, required
  - `tracking` object
    - `ga4Id` string
    - `metaPixelId` string
    - `gtmId` string
    - `requestLocation` boolean
  - `totalScans` integer: All-time scans; included by list and get.

## Other responses

- `400`: Validation failed
- `401`: Authentication required
- `403`: Forbidden
- `404`: Not found
- `409`: Conflict
- `500`: Internal

---

[API](https://skmtc.dev/qrlia/apis/qrlia-api.md) · [All operations](https://skmtc.dev/qrlia/apis/qrlia-api/llms.txt) · [OpenAPI document](https://skmtc.dev/qrlia/apis/qrlia-api/revisions/01c5dd6002ab?raw)