/api/v1/passports/{id}/qrRender the passport QR
Returns a freshly-rendered QR code for the passport, encoding its effective identifier URI. For GS1 passports this is the GS1 Digital Link URI (`/01/<gtin>/21/<serial>`); for ISO 15459 it is the resolver path on the configured host; for iec61406, did, and doi passports it is the `/x/<scheme>/<encodedValue>` resolver path (e.g. `https://id.tracepass.eu/x/did/<encodedDid>`). All five EN 18219 schemes resolve to the same public viewer. Use this when you want our renderer (consistent quiet zone, error correction, optional branding) instead of encoding the URI yourself. Defaults to `image/svg+xml`; `?format=png` returns a PNG and `?format=json` returns a `{ result: "<svg>" }` wrapper for embedding.
By default the QR is black on a transparent background. Set `?useCompanyBranding=true` to use the company's brand colour, or pass `?color=FF6600` (6-char hex, no `#`) for an explicit foreground — an explicit `color` wins over branding. `?backgroundColor=FFFFFF` adds a solid backing (8-char hex = RGBA for partial transparency).
Alternate addressing: `GET /api/v1/passports/by-serial/{serial}/qr` takes the same query params and accepts the `?gtin=` disambiguator when a serial isn't unique across your GTINs. Each call counts as one passport read against the daily cap.
Path parameters
- idrequired
string (24 hex chars)
Passport ID.
Query parameters
- format
string
`svg` (default), `png`, or `json`.
e.g. png
- symbology
string
`qr` (default) or `datamatrix` (ISO/IEC 16022). EN 18220 permits either; both encode the same passport URL. Data Matrix suits small parts and direct part marking.
e.g. datamatrix
- useCompanyBranding
boolean
Render the QR in the company's brand colour instead of black.
- color
string (hex, no #)
Explicit 6-char hex foreground — overrides company branding.
e.g. FF6600
- backgroundColor
string (hex, no #)
Solid backing colour, 6- or 8-char hex (8 = RGBA).
e.g. FFFFFF
Headers
- Authorizationrequired
string
`Bearer <token>` — either a `tp_` API key (Developer → API Keys; simplest, for server-to-server) or an OAuth 2.0 access token (Developer → OAuth Apps; for user-authorized apps, scoped + revocable). The Authentication page has the full OAuth flow and scope list.
e.g. Bearer tp_REDACTED_xxxxxxxxxxxx
Request
# SVG (default)
curl -sS https://app.tracepass.eu/api/v1/passports/6650b2c3d4e5f6a7b8c9d0e1/qr \
-H "Authorization: Bearer tp_REDACTED_xxxxxxxxxxxx" -o passport-qr.svg
# Branded PNG
curl -sS \
"https://app.tracepass.eu/api/v1/passports/6650b2c3d4e5f6a7b8c9d0e1/qr?format=png&color=FF6600" \
-H "Authorization: Bearer tp_REDACTED_xxxxxxxxxxxx" -o passport-qr.png
# Data Matrix instead of QR (EN 18220 permits both)
curl -sS "https://app.tracepass.eu/api/v1/passports/6650b2c3d4e5f6a7b8c9d0e1/qr?format=png&symbology=datamatrix" -H "Authorization: Bearer tp_REDACTED_xxxxxxxxxxxx" -o passport-datamatrix.pngResponse
<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 29 29">
<!-- QR modules encoding the GS1 Digital Link URI -->
</svg>