API reference

Change where a printed QR code points, from your own systems. Create codes in bulk, read scan figures, and keep everything in step with whatever you already run — without anyone opening a dashboard.

Prefer to click than to read? Try any endpoint with your own token in the API explorer. For your tools rather than for you, there is an OpenAPI 3.1 spec and a Postman collection.

The thing worth knowing first

A dynamic QR code encodes a short link, not your destination. The symbol on the packaging never changes; what it resolves to is a row in a database. So repointing a code that is already in the world is a single request, and it takes effect for every copy of it at once — the recalled batch, the seasonal menu, the campaign that moved.

Authentication

Every request carries a bearer token. Create one under API tokens; it is shown once and stored only as a hash, so it cannot be recovered later.

curl https://www.lynkarr.com/api/v1/me \
  -H "Authorization: Bearer lyn1_your_token_here"

Every plan can call the API. The allowance is monthly and resets on the 1st:

• Free — 1,000 requests per month
• Business — 5,000 requests per month
• Enterprise — unlimited

The allowance is counted per company, not per token, so issuing more tokens does not raise it. Exhausting it returns 402 with a quota_exceeded code.

Scopes

A token holds exactly the scopes it was given. A write scope does not imply the matching read scope — being explicit means a token's permissions are what the list says, with nothing inferred.

Endpoints

Repointing a code

The request most integrations exist to make.

curl -X PATCH https://www.lynkarr.com/api/v1/codes/code_abc123 \
  -H "Authorization: Bearer lyn1_your_token_here" \
  -H "Content-Type: application/json" \
  -d '{"url": "https://example.com/recall-notice"}'

The short link and the scan history are unchanged. Only the destination moves. A static code refuses this with 400, because its destination is encoded in the printed symbol and genuinely cannot change.

Creating a code

curl -X POST https://www.lynkarr.com/api/v1/codes \
  -H "Authorization: Bearer lyn1_your_token_here" \
  -H "Content-Type: application/json" \
  -d '{"name": "Batch 4471", "url": "https://example.com/batch/4471"}'

The response includes encode — the value to render into the QR symbol. Rendering happens on your side or in our designer; the API stores the definition and owns the redirect.

Reading scans

curl "https://www.lynkarr.com/api/v1/analytics/codes/code_abc123?days=30" \
  -H "Authorization: Bearer lyn1_your_token_here"

Aggregated rather than raw: totals, unique visitors, a daily series and a country breakdown. Individual scan records are never returned, and no IP address is stored to return.

Errors

Every failure returns the same shape. Match on code, never on the sentence — the wording will be improved, the code will not change.

{
  "error": {
    "code": "forbidden",
    "message": "This token does not have the `codes:write` scope.",
    "docs": "https://www.lynkarr.com/docs/api"
  }
}

A revoked token, an unknown token and one belonging to a suspended company all return the same 401. Distinguishing them would make this endpoint a way to test whether a guessed token exists.

Rate limit and quota

Two separate ceilings, because they fail for different reasons and are fixed in different ways.

120 requests per minute per token. Exceeding it returns 429 with Retry-After in seconds. This protects the platform rather than metering you — wait a moment and continue.

The monthly allowance above, per company. Exhausting it returns 402 and quota_exceeded; waiting will not help until the month turns over.

Every response carries both, so an integration can pace itself rather than discovering a ceiling by hitting it: RateLimit-Limit, RateLimit-Remaining, RateLimit-Reset, and — on metered plans — Quota-Limit and Quota-Remaining.

Versioning

The version is in the path. /api/v1 will not change shape beneath you: fields may be added, but nothing that exists today will be removed or repurposed. A breaking change would arrive as /api/v2.

Create a token →