---
title: "Create a private dynamic QR redirect"
method: POST
path: "/api/dynamic-qr"
---

# Create a private dynamic QR redirect

`POST /api/dynamic-qr`

Creates an editable HTTPS destination. The management token is returned only in this response; store it as a secret capability.

## Request body

- DynamicQrCreateRequest
  - `destination` string, uri, required — Public HTTPS destination. Private, local, reserved, and credential-bearing URLs are rejected.
  - `label` string

## Response `201`

Dynamic QR record created. Optional analytics retain only aggregate redirect counts and no visitor identifiers.

- DynamicQrCreateResponse
  - `success` boolean, required
  - `record` DynamicQrRecord, required
    - `slug` string, required
    - `destination` string, uri, required
    - `label` string, required
    - `status` 'active' | 'paused', required
    - `version` integer, required
    - `createdAt` string, date-time, required
    - `updatedAt` string, date-time, required
  - `managementToken` string, required — One-time bearer capability. It is never returned by later reads.
  - `redirectUrl` string, uri, required
  - `managementUrl` string, uri, required

## Other responses

- `400` — Invalid JSON, unsupported fields, unsafe destination, or invalid label
- `403` — Cross-origin management write rejected
- `405` — Method not allowed
- `429` — Create rate limit exceeded
- `503` — Dynamic QR storage unavailable or the hard active-record capacity has been reached

---

[API](https://skmtc.net/qrcodecrafter/apis/qrcodecrafter-api.md) · [All operations](https://skmtc.net/qrcodecrafter/apis/qrcodecrafter-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/qrcodecrafter/qrcodecrafter-api/versions/8b7eace2bb78/schema)