Sent asynchronously for every scan of your organization's codes while at least one endpoint is active. Delivery is at-least-once: design your handler to be idempotent. Reply with any 2xx within 8 seconds to acknowledge; any other status or a timeout is retried with exponential backoff (roughly 2^attempt minutes, capped at 12 hours) for up to 8 attempts, after which the event is dropped.

Verify authenticity: compute HMAC-SHA256 of the raw request body using your endpoint's signing_secret and compare the hex digest with the value after sha256= in the X-QRTap-Signature header.

Privacy: the payload carries no personal data — only the code identity, your references, a timestamp and a coarse device class.