---
title: "Scan event delivered to your registered endpoint"
method: POST
path: "scan"
---

# Scan event delivered to your registered endpoint

`POST scan` (webhook)

Sent asynchronously for every scan of your organization's codes while at least one endpoint is active. Delivery is at-least-once: design your handler to be idempotent. Reply with any 2xx within 8 seconds to acknowledge; any other status or a timeout is retried with exponential backoff (roughly 2^attempt minutes, capped at 12 hours) for up to 8 attempts, after which the event is dropped.

Verify authenticity: compute HMAC-SHA256 of the raw request body using your endpoint's `signing_secret` and compare the hex digest with the value after `sha256=` in the `X-QRTap-Signature` header.

Privacy: the payload carries no personal data — only the code identity, your references, a timestamp and a coarse device class.

## Headers

- `X-QRTap-Event` 'scan', required
- `X-QRTap-Signature` string, required

## Payload

- ScanEvent
  - `code_id` string, uuid, nullable, required
  - `external_ref` string, nullable, required
  - `group` string, nullable, required
  - `ts` string, date-time, nullable, required
  - `device_type` string, nullable, required: mobile | tablet | desktop | other.

## Acknowledgement `200`

Any 2xx acknowledges the delivery.

---

[API](https://skmtc.dev/qrtap/apis/qrtap-rest-api.md) · [All operations](https://skmtc.dev/qrtap/apis/qrtap-rest-api/llms.txt) · [OpenAPI document](https://skmtc.dev/qrtap/apis/qrtap-rest-api/revisions/8af17ac525bd?raw)