---
title: "Render the passport's QR code (by serial)."
method: GET
path: "/api/v1/passports/by-serial/{serial}/qr"
tags: ["Passports"]
---

# Render the passport's QR code (by serial).

`GET /api/v1/passports/by-serial/{serial}/qr`

## Request

- Base URL: `https://app.tracepass.eu`
- URL: `https://app.tracepass.eu/api/v1/passports/by-serial/{serial}/qr`
- Auth: one of:
  - HTTP bearer
  - OAuth 2 (authorization code, authorization URL `https://app.tracepass.eu/api/oauth/authorize`, token URL `https://app.tracepass.eu/api/oauth/token`, scopes: `passports:read`)

Same shape as `GET /api/v1/passports/{id}/qr`.

## Query parameters

- `format` 'svg' | 'png' | 'json'
- `symbology` 'qr' | 'datamatrix'
- `useCompanyBranding` 'true'
- `color` string
- `backgroundColor` string

## Response `200`

QR rendering.

- QrJsonEnvelope: `format=json` response from the QR endpoints. Carries the SVG markup, a base64-encoded PNG data URI, and the encoded URL + passport status — useful for clients that want both renderings in one round-trip plus the metadata the QR encodes. `publicUrl` is the URL the QR encodes. For GS1 passports this is the Digital Link URI (`id.tracepass.eu/01/<gtin>/21/<serial>`). For iec61406, did, and doi passports it is the `/x/<scheme>/<value>` resolver form (`id.tracepass.eu/x/did/<encodedDid>`). All five schemes resolve to the same public viewer.
  - `passportId` string, required: MongoDB ObjectId hex string (24 chars).
  - `gtin` string: GS1 GTIN with a valid check digit. Accepts 8 digits (GTIN-8), 12 digits (GTIN-12/UPC-A), 13 digits (GTIN-13/EAN-13), or 14 digits (GTIN-14). All forms are left-padded to 14 digits before storage; stored and returned values are always 14 digits.
  - `serial` string
  - `identifier` string: For non-GS1 passports: the `identifierKey` string, e.g. `did:did:example:123abc`. Present when `gtin`/`serial` are absent.
  - `publicUrl` string, uri, required
  - `symbology` 'qr' | 'datamatrix': The symbology rendered. `qrSvg` and `qrPngDataUri` keep their names for compatibility and hold the Data Matrix image when this is `datamatrix`.
  - `status` 'draft' | 'in_review' | 'approved' | 'published' | 'suspended' | 'expired' | 'archived', required
  - `qrSvg` string, required: Inline `<svg>` markup, ready to embed.
  - `qrPngDataUri` string, required: data:image/png;base64,...
  - `colors` object, required
    - `foreground` string
    - `background` string

## Other responses

- `401`: Missing or invalid API key.
- `404`: Resource doesn't exist or is in a different workspace.
- `409`: The serial maps to more than one passport in your account (serials are unique per GTIN, not per account). The request is rejected rather than acting on the wrong passport. Pass `?gtin=<gtin>` to disambiguate, or address the passport by its id instead. `count` is how many passports the serial matched.
- `429`: Daily v1 write or passport-read budget exhausted. Resets at 00:00 UTC.

---

[API](https://skmtc.dev/tracepass/apis/tracepass-api.md) · [All operations](https://skmtc.dev/tracepass/apis/tracepass-api/llms.txt) · [OpenAPI document](https://skmtc.dev/tracepass/apis/tracepass-api/revisions/60ddeb25638b?raw)