---
title: "Create a capability-managed dynamic QR vault"
method: POST
path: "/api/dynamic-qr-vaults"
---

# Create a capability-managed dynamic QR vault

`POST /api/dynamic-qr-vaults`

Creates a private no-account vault for up to 50 project-owned redirects. The vault management token is returned only by this operation and is never recoverable.

## Request body

- DynamicQrVaultCreateRequest
  - `name` string

## Response `201`

Vault created with its one-time bearer capability

- DynamicQrVaultCreateResponse
  - `success` boolean, required
  - `vault` DynamicQrVaultRecord, required — Public authorized representation. Never contains managementTokenHash, qrSlugs, child credentials, or internal storage fields.
    - `vaultId` string, required
    - `name` string, required
    - `version` integer, required
    - `createdAt` string, date-time, required
    - `updatedAt` string, date-time, required
    - `emptyExpiresAt` string, date-time, nullable, required — Empty projects expire after six hours. This is null once the project contains a QR code.
    - `records` DynamicQrVaultChildRecord[], required
      - `slug` string, required
      - `destination` string, uri, required
      - `label` string, required
      - `status` 'active' | 'paused', required
      - `version` integer, required
      - `createdAt` string, date-time, required
      - `updatedAt` string, date-time, required
      - `folder` string
      - `tags` string[]
  - `managementToken` string, required — One-time vault bearer capability, returned only on creation.
  - `managementUrl` string, uri, required

## Other responses

- `400` — Invalid JSON
- `403` — Cross-origin write rejected
- `503` — Vault storage unavailable or at capacity

---

[API](https://skmtc.net/qrcodecrafter/apis/qrcodecrafter-api.md) · [All operations](https://skmtc.net/qrcodecrafter/apis/qrcodecrafter-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/qrcodecrafter/qrcodecrafter-api/versions/8b7eace2bb78/schema)