Skip to main content

API reference

89 operations generated from OpenAPI 3.1.0, platform 0.24.0.

Use the operation sidebar for authentication, parameters, request bodies and responses. Download OpenAPI.

Authentication​

{
  "browserSession": {
    "type": "apiKey",
    "in": "cookie",
    "name": "__Host-qr_session",
    "description": "Canonical qscan.dev browser session; POST requires same-origin Origin header."
  },
  "identityBootstrapSecret": {
    "type": "http",
    "scheme": "bearer",
    "description": "One-time initial operator bootstrap; disabled after provisioning."
  },
  "organizationCredential": {
    "type": "http",
    "scheme": "bearer",
    "bearerFormat": "qr.<organization-uuid>.<secret>",
    "description": "Scoped organization API credential. Keep it out of source, URLs, and logs."
  },
  "bootstrapSecret": {
    "type": "http",
    "scheme": "bearer",
    "description": "Deployment provisioning secret; this is not an organization credential. Provisioning is disabled when no bootstrap secret is configured."
  }
}

Pagination and errors​

Follow each operation's cursor and limit fields. Cursors traverse live data, not a frozen snapshot. HTTP 429 responses include Retry-After; preserve idempotency keys when retrying ingestion. Never put credentials into URLs or documentation examples.

The schema is authoritative for documented payload shapes. Some identity responses are still broad objects; richer response models and executable examples remain documentation work.