Qr - Devotel Orbit Documentation

Worked QR samples

The endpoint list below documents every operation’s parameters; this overlay walks a QR render the way a checkout or loyalty integration actually uses it: render the JSON envelope → save the PNG binary → branch on the script-scheme rejection. Success envelopes are { data, meta } when you ask for JSON (format=json), and raw binary when you let the default image/png content-type carry the pixels — see How to read a worked sample. Rendering runs fully in-cluster — the payload never leaves the platform. Every response carries meta.request_id. Quote it when you report a render the SDK will not link to, or a phone number that failed the normalization the SMS route applies.

1. Render a QR for arbitrary data, returned as a JSON envelope

Pass format=json to get the base64 data URL inside the standard { data, meta } envelope instead of raw PNG bytes:

curl -X GET \
  "https://api.orbit.devotel.io/api/v1/qr/generate?data=https%3A%2F%2Fbrand.example%2Fcheckin%2Ftoken&format=json" \
  -H "X-API-Key: dv_test_sk_YOUR_KEY"

const res = await fetch(
  "https://api.orbit.devotel.io/api/v1/qr/generate?data=https%3A%2F%2Fbrand.example%2Fcheckin%2Ftoken&format=json",
  {
    headers: { "X-API-Key": process.env.ORBIT_API_KEY! },
  },
);
console.log(await res.json());

import json
import os
import urllib.request

req = urllib.request.Request(
    "https://api.orbit.devotel.io/api/v1/qr/generate?data=https%3A%2F%2Fbrand.example%2Fcheckin%2Ftoken&format=json",
    headers={"X-API-Key": os.environ["ORBIT_API_KEY"]},
)
with urllib.request.urlopen(req) as resp:
    print(json.loads(resp.read()))

package main

import (
	"fmt"
	"io"
	"net/http"
	"os"
)

func main() {
	req, _ := http.NewRequest(
		"GET",
		"https://api.orbit.devotel.io/api/v1/qr/generate?data=https%3A%2F%2Fbrand.example%2Fcheckin%2Ftoken&format=json",
		nil,
	)
	req.Header.Set("X-API-Key", os.Getenv("ORBIT_API_KEY"))

	resp, _ := http.DefaultClient.Do(req)
	defer resp.Body.Close()
	body, _ := io.ReadAll(resp.Body)
	fmt.Println(string(body))
}

require 'net/http'
require 'json'

uri = URI('https://api.orbit.devotel.io/api/v1/qr/generate?data=https%3A%2F%2Fbrand.example%2Fcheckin%2Ftoken&format=json')
req = Net::HTTP::Get.new(uri)
req['X-API-Key'] = ENV['ORBIT_API_KEY']

res = Net::HTTP.start(uri.host, uri.port, use_ssl: true) { |h| h.request(req) }
puts res.body

<?php
$ch = curl_init('https://api.orbit.devotel.io/api/v1/qr/generate?data=https%3A%2F%2Fbrand.example%2Fcheckin%2Ftoken&format=json');
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_HTTPHEADER, [
  'X-API-Key: ' . getenv('ORBIT_API_KEY'),
]);

echo curl_exec($ch);

200

{
  "data": {
    "qr_data_url": "data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAA…",
    "data": "https://brand.example/checkin/token",
    "size": 300
  },
  "meta": {
    "request_id": "req_qr_generate",
    "timestamp": "2026-08-26T12:00:00.000Z"
  }
}

2. Save the QR as a raw PNG

Omit format (or pass format=png) and the route streams image/png bytes straight to disk — useful for batch print jobs and attach-to-CDN pipelines:

curl -X GET -H "Accept: image/png" \
  "https://api.orbit.devotel.io/api/v1/qr/generate?data=https%3A%2F%2Fbrand.example%2Fcheckin%2Ftoken" \
  -H "X-API-Key: dv_test_sk_YOUR_KEY" \
  -o checkin-qr.png

import { writeFile } from "node:fs/promises";

const res = await fetch(
  "https://api.orbit.devotel.io/api/v1/qr/generate?data=https%3A%2F%2Fbrand.example%2Fcheckin%2Ftoken",
  {
    headers: {
      "X-API-Key": process.env.ORBIT_API_KEY!,
      Accept: "image/png",
    },
  },
);
// Buffer the raw bytes — never res.json() on this form.
await writeFile("checkin-qr.png", Buffer.from(await res.arrayBuffer()));

import os
import urllib.request

req = urllib.request.Request(
    "https://api.orbit.devotel.io/api/v1/qr/generate?data=https%3A%2F%2Fbrand.example%2Fcheckin%2Ftoken",
    headers={
        "X-API-Key": os.environ["ORBIT_API_KEY"],
        "Accept": "image/png",
    },
)
with urllib.request.urlopen(req) as resp:
    with open("checkin-qr.png", "wb") as f:
        f.write(resp.read())

package main

import (
	"io"
	"net/http"
	"os"
)

func main() {
	req, _ := http.NewRequest(
		"GET",
		"https://api.orbit.devotel.io/api/v1/qr/generate?data=https%3A%2F%2Fbrand.example%2Fcheckin%2Ftoken",
		nil,
	)
	req.Header.Set("X-API-Key", os.Getenv("ORBIT_API_KEY"))
	req.Header.Set("Accept", "image/png")

	resp, _ := http.DefaultClient.Do(req)
	defer resp.Body.Close()

	out, _ := os.Create("checkin-qr.png")
	defer out.Close()
	// Stream the PNG body straight to disk — not a JSON envelope.
	io.Copy(out, resp.Body)
}

require 'net/http'

uri = URI('https://api.orbit.devotel.io/api/v1/qr/generate?data=https%3A%2F%2Fbrand.example%2Fcheckin%2Ftoken')
req = Net::HTTP::Get.new(uri)
req['X-API-Key'] = ENV['ORBIT_API_KEY']
req['Accept'] = 'image/png'

res = Net::HTTP.start(uri.host, uri.port, use_ssl: true) { |h| h.request(req) }
File.binwrite('checkin-qr.png', res.body)

<?php
$ch = curl_init('https://api.orbit.devotel.io/api/v1/qr/generate?data=https%3A%2F%2Fbrand.example%2Fcheckin%2Ftoken');
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_HTTPHEADER, [
  'X-API-Key: ' . getenv('ORBIT_API_KEY'),
  'Accept: image/png',
]);

$png = curl_exec($ch);
file_put_contents('checkin-qr.png', $png);

The output is square; the size query param (50–1024, default 300) sets the edge length.
Responses are cacheable for five minutes (private, max-age=300), so a CDN between you and the API can serve repeat scans without a re-render.

3. Deep-link a QR to the native SMS composer

GET /api/v1/qr/sms encodes an sms:<phone>?body=… deep link — scanning it opens the device’s native SMS composer addressed to the given number with an optional pre-filled body. The number is validated and normalised to E.164 before render.

curl -X GET \
  "https://api.orbit.devotel.io/api/v1/qr/sms?phone=%2B14155552671&body=I%20want%20to%20rebook&format=json" \
  -H "X-API-Key: dv_test_sk_YOUR_KEY"

const res = await fetch(
  "https://api.orbit.devotel.io/api/v1/qr/sms?phone=%2B14155552671&body=I%20want%20to%20rebook&format=json",
  {
    headers: { "X-API-Key": process.env.ORBIT_API_KEY! },
  },
);
console.log(await res.json());

import json
import os
import urllib.request

req = urllib.request.Request(
    "https://api.orbit.devotel.io/api/v1/qr/sms?phone=%2B14155552671&body=I%20want%20to%20rebook&format=json",
    headers={"X-API-Key": os.environ["ORBIT_API_KEY"]},
)
with urllib.request.urlopen(req) as resp:
    print(json.loads(resp.read()))

package main

import (
	"fmt"
	"io"
	"net/http"
	"os"
)

func main() {
	req, _ := http.NewRequest(
		"GET",
		"https://api.orbit.devotel.io/api/v1/qr/sms?phone=%2B14155552671&body=I%20want%20to%20rebook&format=json",
		nil,
	)
	req.Header.Set("X-API-Key", os.Getenv("ORBIT_API_KEY"))

	resp, _ := http.DefaultClient.Do(req)
	defer resp.Body.Close()
	body, _ := io.ReadAll(resp.Body)
	fmt.Println(string(body))
}

require 'net/http'
require 'json'

uri = URI('https://api.orbit.devotel.io/api/v1/qr/sms?phone=%2B14155552671&body=I%20want%20to%20rebook&format=json')
req = Net::HTTP::Get.new(uri)
req['X-API-Key'] = ENV['ORBIT_API_KEY']

res = Net::HTTP.start(uri.host, uri.port, use_ssl: true) { |h| h.request(req) }
puts res.body

<?php
$ch = curl_init('https://api.orbit.devotel.io/api/v1/qr/sms?phone=%2B14155552671&body=I%20want%20to%20rebook&format=json');
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_HTTPHEADER, [
  'X-API-Key: ' . getenv('ORBIT_API_KEY'),
]);

echo curl_exec($ch);

200

{
  "data": {
    "qr_data_url": "data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAA…",
    "sms_link": "sms:+14155552671?body=I%20want%20to%20rebook",
    "phone": "+14155552671",
    "size": 300
  },
  "meta": {
    "request_id": "req_qr_sms",
    "timestamp": "2026-08-26T12:01:00.000Z"
  }
}

The envelope echoes the exact sms_link encoded into the QR, plus the normalised E.164 phone — pass a national-format number and the route returns the same envelope with E.164 applied.
A 400 fires when the phone is undialable under the numbering plan; the rejected input is echoed back, not stored.

4. Click-to-chat a WhatsApp conversation from a QR

GET /api/v1/qr/whatsapp encodes a https://wa.me/<phone>?text=… click-to-chat deep link — scanning it opens a WhatsApp chat with the given number and an optional pre-filled message. Same envelope shape as the SMS route, so a checkout scanner picks the channel by preference and renders the data URL inline:

curl -X GET \
  "https://api.orbit.devotel.io/api/v1/qr/whatsapp?phone=%2B14155552671&text=Hi%20I%20want%20a%20demo&format=json" \
  -H "X-API-Key: dv_test_sk_YOUR_KEY"

const res = await fetch(
  "https://api.orbit.devotel.io/api/v1/qr/whatsapp?phone=%2B14155552671&text=Hi%20I%20want%20a%20demo&format=json",
  {
    headers: { "X-API-Key": process.env.ORBIT_API_KEY! },
  },
);
console.log(await res.json());

import json
import os
import urllib.request

req = urllib.request.Request(
    "https://api.orbit.devotel.io/api/v1/qr/whatsapp?phone=%2B14155552671&text=Hi%20I%20want%20a%20demo&format=json",
    headers={"X-API-Key": os.environ["ORBIT_API_KEY"]},
)
with urllib.request.urlopen(req) as resp:
    print(json.loads(resp.read()))

package main

import (
	"fmt"
	"io"
	"net/http"
	"os"
)

func main() {
	req, _ := http.NewRequest(
		"GET",
		"https://api.orbit.devotel.io/api/v1/qr/whatsapp?phone=%2B14155552671&text=Hi%20I%20want%20a%20demo&format=json",
		nil,
	)
	req.Header.Set("X-API-Key", os.Getenv("ORBIT_API_KEY"))

	resp, _ := http.DefaultClient.Do(req)
	defer resp.Body.Close()
	body, _ := io.ReadAll(resp.Body)
	fmt.Println(string(body))
}

require 'net/http'
require 'json'

uri = URI('https://api.orbit.devotel.io/api/v1/qr/whatsapp?phone=%2B14155552671&text=Hi%20I%20want%20a%20demo&format=json')
req = Net::HTTP::Get.new(uri)
req['X-API-Key'] = ENV['ORBIT_API_KEY']

res = Net::HTTP.start(uri.host, uri.port, use_ssl: true) { |h| h.request(req) }
puts res.body

<?php
$ch = curl_init('https://api.orbit.devotel.io/api/v1/qr/whatsapp?phone=%2B14155552671&text=Hi%20I%20want%20a%20demo&format=json');
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_HTTPHEADER, [
  'X-API-Key: ' . getenv('ORBIT_API_KEY'),
]);

echo curl_exec($ch);

200

{
  "data": {
    "qr_data_url": "data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAA…",
    "whatsapp_link": "https://wa.me/14155552671?text=Hi%20I%20want%20a%20demo",
    "phone": "14155552671",
    "size": 300
  },
  "meta": {
    "request_id": "req_qr_wa",
    "timestamp": "2026-08-26T12:02:00.000Z"
  }
}

The whatsapp_link is the exact deep link encoded into the QR — paste it into a <a href> for an SMS-fallback path when the scanner strips wa.me.
phone is echoed in bare-digit form (no +), matching the seeded recipient string wa.me itself renders.

5. Errors

Errors follow the { error, meta } envelope. The failure every integrator builds a branch for: 400 — script-scheme rejection. A payload starting with javascript:, data:, vbscript: or another pseudo-scheme never reaches the renderer, so a misrouted user gesture cannot become a stored XSS in someone’s scanner; plain text and http(s) URLs still encode:

400

{
  "error": {
    "code": "VALIDATION_ERROR",
    "message": "QR data must not use script-execution URL schemes.",
    "status": 400
  },
  "meta": {
    "request_id": "req_qr_err",
    "timestamp": "2026-08-26T12:03:00.000Z"
  }
}

API Reference

All Endpoints

Qr

Worked QR samples

1. Render a QR for arbitrary data, returned as a JSON envelope

2. Save the QR as a raw PNG

3. Deep-link a QR to the native SMS composer

4. Click-to-chat a WhatsApp conversation from a QR

5. Errors

​Worked QR samples

​1. Render a QR for arbitrary data, returned as a JSON envelope

​2. Save the QR as a raw PNG

​3. Deep-link a QR to the native SMS composer

​4. Click-to-chat a WhatsApp conversation from a QR

​5. Errors

Worked QR samples

1. Render a QR for arbitrary data, returned as a JSON envelope

2. Save the QR as a raw PNG

3. Deep-link a QR to the native SMS composer

4. Click-to-chat a WhatsApp conversation from a QR

5. Errors