QR codes API

REST endpoints for qr codes in ServFlo: 7 operations with parameters, request and response fields, permissions and curl examples.

Base URL: https://app.servflo.ai/api. Every call needs Authorization: Bearer sfk_… (Authentication); {organizationId} ($ORGANIZATION_ID in the examples) is your business's id.

Operation	Endpoint	Risk
List QR codes	`GET /organizations/{organizationId}/qr-codes`	`read`
Create a QR code	`POST /organizations/{organizationId}/qr-codes`	`write`
Get a QR code	`GET /organizations/{organizationId}/qr-codes/{qrCodeId}`	`read`
Change a QR code	`PATCH /organizations/{organizationId}/qr-codes/{qrCodeId}`	`write`
Delete a QR code	`DELETE /organizations/{organizationId}/qr-codes/{qrCodeId}`	`sensitive`
QR code scans	`GET /organizations/{organizationId}/qr-codes/{qrCodeId}/stats`	`read`
Download a QR code	`GET /organizations/{organizationId}/qr-codes/{qrCodeId}/image`	`read`

List QR codes

GET /organizations/{organizationId}/qr-codes

Every QR code with its short link, destination, look, scans and leads, newest first. Read-only.


Permission	`website.read` (Owner, Admin, Dispatcher)
Risk	`read`, OAuth scope `servflo.read`. Read: reads only.
MCP tool	`qrCodes_list` (toolset `marketing`)

Example

curl "https://app.servflo.ai/api/organizations/$ORGANIZATION_ID/qr-codes" \
  -H "Authorization: Bearer $SERVFLO_API_KEY"

Response

200: the answer's fields

An array of objects:

Field	Type	Description
`id`	string
`code`	string	The short link's code (7 characters).
`shortLink`	string	What the printed code holds: {app}/go/{code}.
`name`	string
`targetType`	enum	One of `WEBSITE`, `WEBSITE_PAGE`, `BOOKING`, `URL`.
`targetPath`	string or null	WEBSITE_PAGE: the page's address.
`targetUrl`	string or null	Url: the address.
`addTracking`	boolean
`enabled`	boolean
`style`	object
`style.foreground`	string
`style.background`	string
`style.dotStyle`	enum	One of `square`, `rounded`, `dots`.
`style.logoUrl`	string	Up to 2000 characters.
`style.logoSize`	number	0.12–0.28.
`style.caption`	string	Up to 40 characters.
`scanCount`	integer
`lastScannedAt`	string (date-time) or null
`leads`	integer	Requests (bookings, messages) that came in through this code.
`createdAt`	string (date-time)
`updatedAt`	string (date-time)

Create a QR code

POST /organizations/{organizationId}/qr-codes

Makes a dynamic QR code: it prints as a short ServFlo link that counts each scan and forwards to the destination, which can be changed later without reprinting. Download it with GET …/{qrCodeId}/image.


Permission	`website.manage` (Owner, Admin)
Risk	`write`, OAuth scope `servflo.write`. Write: creates or changes records inside the business; nothing leaves it.
MCP tool	`qrCodes_create` (toolset `marketing`)

Request body

Field	Type	Required	Description
`name`	string	Yes	Where it's used: "Truck wrap", "Spring yard signs". Up to 120 characters.
`targetType`	enum	Yes	WEBSITE (home page), WEBSITE_PAGE (`targetPath`), BOOKING (the booking form) or URL (`targetUrl`). A website target falls back to the booking form while the site isn't published. One of `WEBSITE`, `WEBSITE_PAGE`, `BOOKING`, `URL`.
`targetPath`	string or null	No	Up to 60 characters.
`targetUrl`	string or null	No	Up to 2000 characters.
`addTracking`	boolean	No	Add utm_source=qr, utm_medium=print, utm_campaign, utm_content={code} (default true).
`enabled`	boolean	No	Off: scans show a 'no longer active' page.
`style`	object	No	Colours (dark on light, contrast checked), dot style, centre logo and size, caption.
`style.foreground`	string	No
`style.background`	string	No
`style.dotStyle`	enum	No	One of `square`, `rounded`, `dots`.
`style.logoUrl`	string	No	Up to 2000 characters.
`style.logoSize`	number	No	0.12–0.28.
`style.caption`	string	No	Up to 40 characters.

Example

curl -X POST "https://app.servflo.ai/api/organizations/$ORGANIZATION_ID/qr-codes" \
  -H "Authorization: Bearer $SERVFLO_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"name":"Dana Whitfield","targetType":"WEBSITE"}'

Response

201: the answer's fields

Field	Type	Description
`id`	string
`code`	string	The short link's code (7 characters).
`shortLink`	string	What the printed code holds: {app}/go/{code}.
`name`	string
`targetType`	enum	One of `WEBSITE`, `WEBSITE_PAGE`, `BOOKING`, `URL`.
`targetPath`	string or null	WEBSITE_PAGE: the page's address.
`targetUrl`	string or null	Url: the address.
`addTracking`	boolean
`enabled`	boolean
`style`	object
`style.foreground`	string
`style.background`	string
`style.dotStyle`	enum	One of `square`, `rounded`, `dots`.
`style.logoUrl`	string	Up to 2000 characters.
`style.logoSize`	number	0.12–0.28.
`style.caption`	string	Up to 40 characters.
`scanCount`	integer
`lastScannedAt`	string (date-time) or null
`leads`	integer	Requests (bookings, messages) that came in through this code.
`createdAt`	string (date-time)
`updatedAt`	string (date-time)

Get a QR code

GET /organizations/{organizationId}/qr-codes/{qrCodeId}

One QR code with its short link, destination, look, all-time scans and leads. Read-only.


Permission	`website.read` (Owner, Admin, Dispatcher)
Risk	`read`, OAuth scope `servflo.read`. Read: reads only.
MCP tool	`qrCodes_get` (toolset `marketing`)

Parameters

Name	In	Type	Required	Description
`qrCodeId`	path	string	Yes

Example

curl "https://app.servflo.ai/api/organizations/$ORGANIZATION_ID/qr-codes/{qrCodeId}" \
  -H "Authorization: Bearer $SERVFLO_API_KEY"

Response

200: the answer's fields

Field	Type	Description
`id`	string
`code`	string	The short link's code (7 characters).
`shortLink`	string	What the printed code holds: {app}/go/{code}.
`name`	string
`targetType`	enum	One of `WEBSITE`, `WEBSITE_PAGE`, `BOOKING`, `URL`.
`targetPath`	string or null	WEBSITE_PAGE: the page's address.
`targetUrl`	string or null	Url: the address.
`addTracking`	boolean
`enabled`	boolean
`style`	object
`style.foreground`	string
`style.background`	string
`style.dotStyle`	enum	One of `square`, `rounded`, `dots`.
`style.logoUrl`	string	Up to 2000 characters.
`style.logoSize`	number	0.12–0.28.
`style.caption`	string	Up to 40 characters.
`scanCount`	integer
`lastScannedAt`	string (date-time) or null
`leads`	integer	Requests (bookings, messages) that came in through this code.
`createdAt`	string (date-time)
`updatedAt`	string (date-time)

Change a QR code

PATCH /organizations/{organizationId}/qr-codes/{qrCodeId}

Changes the fields sent. Changing the destination re-points codes already printed, at once.


Permission	`website.manage` (Owner, Admin)
Risk	`write`, OAuth scope `servflo.write`. Write: creates or changes records inside the business; nothing leaves it.
MCP tool	`qrCodes_update` (toolset `marketing`)

Parameters

Name	In	Type	Required	Description
`qrCodeId`	path	string	Yes

Request body

Field	Type	Required	Description
`name`	string	No	Where it's used: "Truck wrap", "Spring yard signs". Up to 120 characters.
`targetType`	enum	No	WEBSITE (home page), WEBSITE_PAGE (`targetPath`), BOOKING (the booking form) or URL (`targetUrl`). A website target falls back to the booking form while the site isn't published. One of `WEBSITE`, `WEBSITE_PAGE`, `BOOKING`, `URL`.
`targetPath`	string or null	No	Up to 60 characters.
`targetUrl`	string or null	No	Up to 2000 characters.
`addTracking`	boolean	No	Add utm_source=qr, utm_medium=print, utm_campaign, utm_content={code} (default true).
`enabled`	boolean	No	Off: scans show a 'no longer active' page.
`style`	object	No	Colours (dark on light, contrast checked), dot style, centre logo and size, caption.
`style.foreground`	string	No
`style.background`	string	No
`style.dotStyle`	enum	No	One of `square`, `rounded`, `dots`.
`style.logoUrl`	string	No	Up to 2000 characters.
`style.logoSize`	number	No	0.12–0.28.
`style.caption`	string	No	Up to 40 characters.

Example

curl -X PATCH "https://app.servflo.ai/api/organizations/$ORGANIZATION_ID/qr-codes/{qrCodeId}" \
  -H "Authorization: Bearer $SERVFLO_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"name":"Dana Whitfield","targetType":"WEBSITE","targetPath":"string"}'

Response

200: the answer's fields

Field	Type	Description
`id`	string
`code`	string	The short link's code (7 characters).
`shortLink`	string	What the printed code holds: {app}/go/{code}.
`name`	string
`targetType`	enum	One of `WEBSITE`, `WEBSITE_PAGE`, `BOOKING`, `URL`.
`targetPath`	string or null	WEBSITE_PAGE: the page's address.
`targetUrl`	string or null	Url: the address.
`addTracking`	boolean
`enabled`	boolean
`style`	object
`style.foreground`	string
`style.background`	string
`style.dotStyle`	enum	One of `square`, `rounded`, `dots`.
`style.logoUrl`	string	Up to 2000 characters.
`style.logoSize`	number	0.12–0.28.
`style.caption`	string	Up to 40 characters.
`scanCount`	integer
`lastScannedAt`	string (date-time) or null
`leads`	integer	Requests (bookings, messages) that came in through this code.
`createdAt`	string (date-time)
`updatedAt`	string (date-time)

Delete a QR code

DELETE /organizations/{organizationId}/qr-codes/{qrCodeId}

Destructive: printed copies stop working (scans show 'no longer active') and its scan history is deleted. Prefer enabled: false.


Permission	`website.manage` (Owner, Admin)
Risk	`sensitive`, OAuth scope `servflo.sensitive`. Sensitive: moves money, deletes, sends or shows something to a customer, or grants or revokes access.
MCP tool	`qrCodes_delete` (toolset `marketing`)
Approval	Over MCP, this tool always waits for your approval in ServFlo. See Approvals.

Parameters

Name	In	Type	Required	Description
`qrCodeId`	path	string	Yes

Example

curl -X DELETE "https://app.servflo.ai/api/organizations/$ORGANIZATION_ID/qr-codes/{qrCodeId}" \
  -H "Authorization: Bearer $SERVFLO_API_KEY"

Response

200: the answer's fields

Field	Type	Description
`ok`	true

QR code scans

GET /organizations/{organizationId}/qr-codes/{qrCodeId}/stats

Scans and unique scanners per day over days (default 30), devices, phone systems, all-time scans and leads. No addresses are stored. Read-only.


Permission	`website.read` (Owner, Admin, Dispatcher)
Risk	`read`, OAuth scope `servflo.read`. Read: reads only.
MCP tool	`qrCodes_stats` (toolset `marketing`)

Parameters

Name	In	Type	Required	Description
`qrCodeId`	path	string	Yes
`days`	query	integer	No	7–365.

Example

curl "https://app.servflo.ai/api/organizations/$ORGANIZATION_ID/qr-codes/{qrCodeId}/stats" \
  -H "Authorization: Bearer $SERVFLO_API_KEY"

Response

200: the answer's fields

Field	Type	Description
`from`	string
`to`	string
`scans`	integer
`uniqueVisitors`	integer
`totalScans`	integer
`leads`	integer
`days`	array of object
`days[].date`	string
`days[].scans`	integer
`days[].visitors`	integer
`devices`	object
`devices.MOBILE`	integer
`devices.TABLET`	integer
`devices.DESKTOP`	integer
`systems`	array of object
`systems[].name`	string
`systems[].count`	integer

Download a QR code

GET /organizations/{organizationId}/qr-codes/{qrCodeId}/image

The code as SVG (vector: print at any size) or PNG size pixels wide (256–4096; 2048+ for print), base64. Read-only.


Permission	`website.read` (Owner, Admin, Dispatcher)
Risk	`read`, OAuth scope `servflo.read`. Read: reads only.
MCP tool	`qrCodes_image` (toolset `marketing`)

Parameters

Name	In	Type	Required	Description
`qrCodeId`	path	string	Yes
`format`	query	enum	No	One of `svg`, `png`. Default `svg`.
`size`	query	integer	No	256–4096.

Example

curl "https://app.servflo.ai/api/organizations/$ORGANIZATION_ID/qr-codes/{qrCodeId}/image" \
  -H "Authorization: Bearer $SERVFLO_API_KEY"

Response

200: the answer's fields

Field	Type	Description
`fileName`	string
`contentType`	string
`base64`	string

On this page