---
title: "Create a managed code"
method: POST
path: "/api/v1/codes"
tags: ["codes"]
---

# Create a managed code

`POST /api/v1/codes`

## Request

- Base URL: `https://app.qrtap.kg`
- URL: `https://app.qrtap.kg/api/v1/codes`
- Auth: HTTP bearer

Creates one managed QR code / short link. The response contains `short_url` — the stable printed link encoded in the QR; it never changes when you retarget. Creation is idempotent by `external_ref`: re-sending the same `external_ref` returns the existing (non-archived) code without touching its destination.

## Request body

- CreateCodeRequest
  - `target_url` string, uri, required: Destination URL the code redirects to. http(s) only. Can be changed later without reprinting.
  - `label` string: Human-readable title shown in the cabinet. Defaults to "Код".
  - `external_ref` string: Your identifier for this code (partner id, SKU, event id). Unique per organization among non-archived codes; creation is idempotent by this field.
  - `group` 'partner' | 'equipment' | 'event_menu' | 'bag_insert' | 'training': Code type used to slice analytics.
  - `design_template_id` string, uuid: Apply a branded design template (must belong to your organization).

## Response `201`

Code created (or an existing code returned for a repeated `external_ref`).

- Code
  - `id` string, uuid, required
  - `label` string, required
  - `target_url` string, nullable, required: Current destination URL.
  - `external_ref` string, nullable, required
  - `group` string, nullable, required
  - `state` string, required: Lifecycle state; API-created codes are `deployed`.
  - `design_template_id` string, uuid, nullable, required
  - `slug` string, required: Short-link slug. The QR encodes short_url = base + / + slug.
  - `short_url` string, uri, required: Stable printed link encoded in the QR. Never changes on retarget.
  - `png_url` string, uri, required: Artifact URL (PNG). Requires the same Bearer auth.
  - `svg_url` string, uri, required: Artifact URL (SVG). Requires the same Bearer auth.
  - `scans` integer: All-time non-bot scan count. Present only when listing with include=stats.
  - `created_at` string, date-time, required
  - `updated_at` string, date-time, required

## Other responses

- `400`: Validation failed. `error` is one of `invalid_request` (schema violation, see `detail`), `invalid_url` (target_url is not a valid http(s) URL), `unknown_design_template` (design_template_id does not belong to your organization).
- `401`: Missing, invalid or revoked API key.
- `429`: Limit exceeded — the request had no effect. `error` is `rate_limited` with `scope: "minute"` (a burst brake: wait `retry_after` seconds and continue) or `quota_exceeded` with `scope: "day"` (the workspace's daily quota, counted in UTC; it returns at `reset_at`, the next UTC midnight, and only a higher plan raises it before then).

---

[API](https://skmtc.dev/qrtap/apis/qrtap-rest-api.md) · [All operations](https://skmtc.dev/qrtap/apis/qrtap-rest-api/llms.txt) · [OpenAPI document](https://skmtc.dev/qrtap/apis/qrtap-rest-api/revisions/8af17ac525bd?raw)