QRLS API v1

Use HTTPS and Authorization: Bearer YOUR_KEY. Create scoped keys in your organization dashboard. Keys are shown only once. Never embed them in browser JavaScript or mobile app source.

curl https://qr.lawlesssolutions.us/api/v1/credentials \
  -H 'Authorization: Bearer YOUR_KEY' \
  -H 'Content-Type: application/json' \
  -H 'Idempotency-Key: guest-order-123' \
  -d '{"label":"Guest pass","type":"guest_pass","policy":"single"}'

The creation response includes an opaque token and qr_payload. Store them securely. Do not place holder data in the QR.

Method & route	Scope
/api/v1: POST /credentials	issue
/api/v1: GET /credentials	read
/api/v1: GET /credentials/{id}	read
/api/v1: POST /credentials/{id}/revoke	revoke
/api/v1: POST /credentials/verify	verify
/api/v1: POST /credentials/redeem	redeem
/api/v1: GET /usage	usage

{"token":"OPAQUE_CREDENTIAL_TOKEN"}

Send that body to verify or redeem. Status values: valid, redeemed, reusable_verified, already_redeemed, expired, revoked, invalid. An invalid status is a processed lookup (HTTP 200, success false), not authorization to admit.

Creation and redemption accept Idempotency-Key (8–128 letters, numbers, dots, underscores, colons or hyphens). Replay with identical input returns the original result for 24 hours; changed input returns 409. Keys are scoped to organization, actor and operation. Verification is separate and does not redeem.

GET /credentials supports page (50 per page) and search. Error format: {"error":{"code":"http_403","message":"…"}}. Common errors: 401 key/login, 403 permission, 404 missing or inaccessible record, 409 conflict, 422 validation, 429 limit. Respect Retry-After and use bounded exponential retry.

120 requests per minute per key or browser organization session; 300 requests/minute per source IP. Monthly quotas are in /usage. No overages are billed. Raw tokens, keys and payload bodies are excluded from application audit logs.