> ## Documentation Index
> Fetch the complete documentation index at: https://docs.orbit.devotel.io/llms.txt
> Use this file to discover all available pages before exploring further.

# QR API

> QR endpoints exposed by the Devotel CPaaS API

# QR API

QR endpoints exposed by the Devotel CPaaS API

**Base path:** `/api/v1/qr`

**Endpoint count:** 3

***

### Generate a QR code for arbitrary data

<Note>
  `GET /api/v1/qr/generate`
</Note>

Render a QR code for any text or URL payload. Returns `image/png` bytes by default, or a base64 data URL in the standard envelope when `format=json`. Script-execution URL schemes (`javascript:`, `data:`, `vbscript:`, …) are rejected with 400; rendering runs fully in-cluster — the payload never leaves the platform.

<ParamField query="data" type="string" required>
  Payload to encode (plain text or a URL, max 2048 chars). Must not start with a script-execution URL scheme such as `javascript:` or `data:`.
</ParamField>

<ParamField query="size" type="integer">
  Image edge length in pixels (50–1024, default 300). The output PNG is always square.
</ParamField>

<ParamField query="format" type="string (enum: png|json)">
  `png` (default) returns raw `image/png` bytes; `json` returns the standard envelope with `data.qr_data_url` as a base64 data URL.
</ParamField>

<ParamField header="X-Test-Mode" type="string (enum: true|false)">
  Sandbox opt-in for Clerk-session-authenticated requests. Set to `true` to route the call through the test-mode pipeline: no real provider delivery, no credits deducted, response `meta.test_mode: true`. **Ignored for live API keys (`dv_live_sk_*`)** — server-to-server clients must use a test-prefixed key (`dv_test_sk_*`) to exercise sandbox. Test-prefixed keys unconditionally enable sandbox regardless of this header.
</ParamField>

<RequestExample>
  <CodeGroup>
    ```bash cURL theme={null}
    curl -X GET "https://api.orbit.devotel.io/api/v1/qr/generate" \
      -H "X-API-Key: dv_live_sk_your_key_here" 
    ```

    ```typescript Node.js theme={null}
    import { Orbit } from '@devotel-orbit/node'

    const orbit = new Orbit({
      apiKey: process.env.ORBIT_API_KEY!,
    })

    const res = await fetch('https://api.orbit.devotel.io/api/v1/qr/generate', {
      method: 'GET',
      headers: {
        'X-API-Key': process.env.ORBIT_API_KEY!,
      },
    })
    console.log(await res.json())


    ```

    ```python Python theme={null}
    import os, requests

    headers = {"X-API-Key": os.environ["ORBIT_API_KEY"]}
    r = requests.get("https://api.orbit.devotel.io/api/v1/qr/generate", headers=headers)
    print(r.json())
    ```

    ```go Go theme={null}
    package main

    import (
    	"bytes"
    	"net/http"
    	"os"
    )

    func main() {
    	req, _ := http.NewRequest("GET", "https://api.orbit.devotel.io/api/v1/qr/generate", nil)
    	req.Header.Set("X-API-Key", os.Getenv("ORBIT_API_KEY"))

    	http.DefaultClient.Do(req)
    }
    ```

    ```ruby Ruby theme={null}
    require 'net/http'
    require 'json'

    uri = URI('https://api.orbit.devotel.io/api/v1/qr/generate')
    req = Net::HTTP::Get.new(uri)
    req['X-API-Key'] = ENV['ORBIT_API_KEY']


    res = Net::HTTP.start(uri.host, uri.port, use_ssl: true) { |h| h.request(req) }
    puts res.body
    ```

    ```php PHP theme={null}
    <?php
    $ch = curl_init('https://api.orbit.devotel.io/api/v1/qr/generate');
    curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
    curl_setopt($ch, CURLOPT_CUSTOMREQUEST, 'GET');
    curl_setopt($ch, CURLOPT_HTTPHEADER, [
      'X-API-Key: ' . getenv('ORBIT_API_KEY'),

    ]);

    echo curl_exec($ch);
    ```
  </CodeGroup>
</RequestExample>

<ResponseExample>
  ```json 200 theme={null}
  {
    "data": {},
    "meta": {
      "request_id": "req_01HZQX4E7JQ4M2E2H2DM9XE5FJ",
      "timestamp": "2026-08-26T12:00:00.000Z"
    }
  }
  ```
</ResponseExample>

***

### Generate an SMS deep-link QR code

<Note>
  `GET /api/v1/qr/sms`
</Note>

Render a QR code that encodes an `sms:&lt;phone&gt;?body=…` deep link: scanning it opens the device's native SMS composer addressed to the given number with an optional pre-filled body. The phone number is validated and normalised to E.164 before encoding. Returns `image/png` bytes by default, or a base64 data URL in the standard envelope when `format=json`.

<ParamField query="phone" type="string" required>
  Destination phone number in international format (e.g. `+15551234567`). Rejected with 400 when it is not a dialable international number.
</ParamField>

<ParamField query="message" type="string">
  Optional pre-filled message body for the deep link (max 1024 chars). URL-encoded into the encoded `wa.me` / `sms:` payload.
</ParamField>

<ParamField query="size" type="integer">
  Image edge length in pixels (50–1024, default 300). The output PNG is always square.
</ParamField>

<ParamField query="format" type="string (enum: png|json)">
  `png` (default) returns raw `image/png` bytes; `json` returns the standard envelope with `data.qr_data_url` as a base64 data URL.
</ParamField>

<ParamField header="X-Test-Mode" type="string (enum: true|false)">
  Sandbox opt-in for Clerk-session-authenticated requests. Set to `true` to route the call through the test-mode pipeline: no real provider delivery, no credits deducted, response `meta.test_mode: true`. **Ignored for live API keys (`dv_live_sk_*`)** — server-to-server clients must use a test-prefixed key (`dv_test_sk_*`) to exercise sandbox. Test-prefixed keys unconditionally enable sandbox regardless of this header.
</ParamField>

<RequestExample>
  <CodeGroup>
    ```bash cURL theme={null}
    curl -X GET "https://api.orbit.devotel.io/api/v1/qr/sms" \
      -H "X-API-Key: dv_live_sk_your_key_here" 
    ```

    ```typescript Node.js theme={null}
    import { Orbit } from '@devotel-orbit/node'

    const orbit = new Orbit({
      apiKey: process.env.ORBIT_API_KEY!,
    })

    const res = await fetch('https://api.orbit.devotel.io/api/v1/qr/sms', {
      method: 'GET',
      headers: {
        'X-API-Key': process.env.ORBIT_API_KEY!,
      },
    })
    console.log(await res.json())


    ```

    ```python Python theme={null}
    import os, requests

    headers = {"X-API-Key": os.environ["ORBIT_API_KEY"]}
    r = requests.get("https://api.orbit.devotel.io/api/v1/qr/sms", headers=headers)
    print(r.json())
    ```

    ```go Go theme={null}
    package main

    import (
    	"bytes"
    	"net/http"
    	"os"
    )

    func main() {
    	req, _ := http.NewRequest("GET", "https://api.orbit.devotel.io/api/v1/qr/sms", nil)
    	req.Header.Set("X-API-Key", os.Getenv("ORBIT_API_KEY"))

    	http.DefaultClient.Do(req)
    }
    ```

    ```ruby Ruby theme={null}
    require 'net/http'
    require 'json'

    uri = URI('https://api.orbit.devotel.io/api/v1/qr/sms')
    req = Net::HTTP::Get.new(uri)
    req['X-API-Key'] = ENV['ORBIT_API_KEY']


    res = Net::HTTP.start(uri.host, uri.port, use_ssl: true) { |h| h.request(req) }
    puts res.body
    ```

    ```php PHP theme={null}
    <?php
    $ch = curl_init('https://api.orbit.devotel.io/api/v1/qr/sms');
    curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
    curl_setopt($ch, CURLOPT_CUSTOMREQUEST, 'GET');
    curl_setopt($ch, CURLOPT_HTTPHEADER, [
      'X-API-Key: ' . getenv('ORBIT_API_KEY'),

    ]);

    echo curl_exec($ch);
    ```
  </CodeGroup>
</RequestExample>

<ResponseExample>
  ```json 200 theme={null}
  {
    "data": {},
    "meta": {
      "request_id": "req_01HZQX4E7JQ4M2E2H2DM9XE5FJ",
      "timestamp": "2026-08-26T12:00:00.000Z"
    }
  }
  ```
</ResponseExample>

***

### Generate a WhatsApp click-to-chat QR code

<Note>
  `GET /api/v1/qr/whatsapp`
</Note>

Render a QR code that encodes a `https://wa.me/&lt;phone&gt;?text=…` click-to-chat deep link: scanning it opens a WhatsApp chat with the given number and an optional pre-filled message. The phone number is validated as a dialable international number before encoding. Returns `image/png` bytes by default, or a base64 data URL in the standard envelope when `format=json`.

<ParamField query="phone" type="string" required>
  Destination phone number in international format (e.g. `+15551234567`). Rejected with 400 when it is not a dialable international number.
</ParamField>

<ParamField query="message" type="string">
  Optional pre-filled message body for the deep link (max 1024 chars). URL-encoded into the encoded `wa.me` / `sms:` payload.
</ParamField>

<ParamField query="size" type="integer">
  Image edge length in pixels (50–1024, default 300). The output PNG is always square.
</ParamField>

<ParamField query="format" type="string (enum: png|json)">
  `png` (default) returns raw `image/png` bytes; `json` returns the standard envelope with `data.qr_data_url` as a base64 data URL.
</ParamField>

<ParamField header="X-Test-Mode" type="string (enum: true|false)">
  Sandbox opt-in for Clerk-session-authenticated requests. Set to `true` to route the call through the test-mode pipeline: no real provider delivery, no credits deducted, response `meta.test_mode: true`. **Ignored for live API keys (`dv_live_sk_*`)** — server-to-server clients must use a test-prefixed key (`dv_test_sk_*`) to exercise sandbox. Test-prefixed keys unconditionally enable sandbox regardless of this header.
</ParamField>

<RequestExample>
  <CodeGroup>
    ```bash cURL theme={null}
    curl -X GET "https://api.orbit.devotel.io/api/v1/qr/whatsapp" \
      -H "X-API-Key: dv_live_sk_your_key_here" 
    ```

    ```typescript Node.js theme={null}
    import { Orbit } from '@devotel-orbit/node'

    const orbit = new Orbit({
      apiKey: process.env.ORBIT_API_KEY!,
    })

    const res = await fetch('https://api.orbit.devotel.io/api/v1/qr/whatsapp', {
      method: 'GET',
      headers: {
        'X-API-Key': process.env.ORBIT_API_KEY!,
      },
    })
    console.log(await res.json())


    ```

    ```python Python theme={null}
    import os, requests

    headers = {"X-API-Key": os.environ["ORBIT_API_KEY"]}
    r = requests.get("https://api.orbit.devotel.io/api/v1/qr/whatsapp", headers=headers)
    print(r.json())
    ```

    ```go Go theme={null}
    package main

    import (
    	"bytes"
    	"net/http"
    	"os"
    )

    func main() {
    	req, _ := http.NewRequest("GET", "https://api.orbit.devotel.io/api/v1/qr/whatsapp", nil)
    	req.Header.Set("X-API-Key", os.Getenv("ORBIT_API_KEY"))

    	http.DefaultClient.Do(req)
    }
    ```

    ```ruby Ruby theme={null}
    require 'net/http'
    require 'json'

    uri = URI('https://api.orbit.devotel.io/api/v1/qr/whatsapp')
    req = Net::HTTP::Get.new(uri)
    req['X-API-Key'] = ENV['ORBIT_API_KEY']


    res = Net::HTTP.start(uri.host, uri.port, use_ssl: true) { |h| h.request(req) }
    puts res.body
    ```

    ```php PHP theme={null}
    <?php
    $ch = curl_init('https://api.orbit.devotel.io/api/v1/qr/whatsapp');
    curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
    curl_setopt($ch, CURLOPT_CUSTOMREQUEST, 'GET');
    curl_setopt($ch, CURLOPT_HTTPHEADER, [
      'X-API-Key: ' . getenv('ORBIT_API_KEY'),

    ]);

    echo curl_exec($ch);
    ```
  </CodeGroup>
</RequestExample>

<ResponseExample>
  ```json 200 theme={null}
  {
    "data": {},
    "meta": {
      "request_id": "req_01HZQX4E7JQ4M2E2H2DM9XE5FJ",
      "timestamp": "2026-08-26T12:00:00.000Z"
    }
  }
  ```
</ResponseExample>

***