Autenticación
Todas las rutas /api/v1/* (salvo SSO) exigen clave API en el encabezado Authorization: Bearer qrp_…. Cada clave tiene ámbitos (qr:read, qr:write, etc.). Las peticiones POST son idempotentes y están limitadas por clave y plan.
Códigos QR
| Método | Ruta | Alcance |
|---|---|---|
| GET | /api/v1/qr-codes | qr:read |
| POST | /api/v1/qr-codes | qr:write |
| GET | /api/v1/qr-codes/{uuid} | qr:read |
| PATCH | /api/v1/qr-codes/{uuid} | qr:write |
| DELETE | /api/v1/qr-codes/{uuid} | qr:write |
| POST | /api/v1/qr-codes/{uuid}/render | qr:write |
| GET | /api/v1/qr-codes/{uuid}/versions | qr:read |
| GET | /api/v1/qr-codes/{uuid}/smart-rules | qr:read |
| POST | /api/v1/qr-codes/{uuid}/smart-rules | qr:write |
Carpetas, páginas, contactos y activos
| Método | Ruta |
|---|---|
| GET POST | /api/v1/folders, /api/v1/folders/{uuid} (+PATCH, DELETE) |
| GET POST | /api/v1/landing-pages, /api/v1/landing-pages/{uuid} (+PATCH, DELETE) |
| GET POST | /api/v1/contacts, /api/v1/contacts/{uuid} (+PATCH, DELETE) |
| GET POST | /api/v1/assets, /api/v1/assets/{uuid} (+DELETE) |
Analítica, webhooks e integraciones
| Método | Ruta |
|---|---|
| GET | /api/v1/analytics/scans, /api/v1/analytics/summary |
| GET POST | /api/v1/webhooks |
| POST | /api/v1/smtp, /api/v1/smtp/verify, /api/v1/smtp (DELETE) |
| GET POST | /api/v1/domains, /api/v1/domains/{domain}/verify (+DELETE) |
| GET PATCH | /api/v1/whitelabel |
QR dinámicos y campañas
| Método | Ruta |
|---|---|
| POST | /api/v1/qr |
| GET PUT | /api/v1/qrd/{code} (+DELETE, /stats) |
| GET POST | /api/v1/campaigns, /api/v1/campaigns/{id} (+PUT, DELETE, /stats) |
SSO y errores
Flujo OAuth sin clave: GET /api/v1/sso/providers, /sso/{provider}/redirect, /sso/{provider}/callback. Los errores siguen RFC 9457 (application/problem+json); la validación devuelve 422 con detalle por campo.
Contrato OpenAPI completo: openapi.yaml.