---
title: Render the passport QR
description: "Render a passport's QR code as SVG, PNG, or JSON — optionally in the company brand colour or an explicit hex. Encodes the GS1 Digital Link URI."
canonical: "https://www.tracepass.eu/docs/passport-qr"
locale: en
source: "https://www.tracepass.eu/docs/passport-qr"
---

# Render the passport QR

> Render a passport's QR code as SVG, PNG, or JSON — optionally in the company brand colour or an explicit hex. Encodes the GS1 Digital Link URI.

```http
GET /api/v1/passports/{id}/qr
```

Returns a freshly-rendered QR code for the passport, encoding its `gs1.digitalLinkUri`. Use this when you want our renderer (consistent quiet zone, error correction, optional branding) instead of encoding the URI yourself. Defaults to `image/svg+xml`; `?format=png` returns a PNG and `?format=json` returns a `{ result: "<svg>" }` wrapper for embedding.

By default the QR is black on a transparent background. Set `?useCompanyBranding=true` to use the company's brand colour, or pass `?color=FF6600` (6-char hex, no `#`) for an explicit foreground — an explicit `color` wins over branding. `?backgroundColor=FFFFFF` adds a solid backing (8-char hex = RGBA for partial transparency).

Alternate addressing: `GET /api/v1/passports/by-serial/{serial}/qr` takes the same query params and accepts the `?gtin=` disambiguator when a serial isn't unique across your GTINs. Each call counts as one passport read against the daily cap.

## Parameters

| Name | In | Type | Required | Description |
| --- | --- | --- | --- | --- |
| `Authorization` | header | string | yes | `Bearer <token>` — either a `tp_` API key (Developer → API Keys; simplest, for server-to-server) or an OAuth 2.0 access token (Developer → OAuth Apps; for user-authorized apps, scoped + revocable). The Authentication page has the full OAuth flow and scope list. |
| `id` | path | ObjectId | yes | Passport ID. |
| `format` | query | string | no | `svg` (default), `png`, or `json`. |
| `useCompanyBranding` | query | boolean | no | Render the QR in the company's brand colour instead of black. |
| `color` | query | string (hex, no #) | no | Explicit 6-char hex foreground — overrides company branding. |
| `backgroundColor` | query | string (hex, no #) | no | Solid backing colour, 6- or 8-char hex (8 = RGBA). |

## Examples

```bash
# SVG (default)
curl -sS https://app.tracepass.eu/api/v1/passports/6650b2c3d4e5f6a7b8c9d0e1/qr \
  -H "Authorization: Bearer tp_REDACTED_xxxxxxxxxxxx" -o passport-qr.svg

# Branded PNG
curl -sS \
  "https://app.tracepass.eu/api/v1/passports/6650b2c3d4e5f6a7b8c9d0e1/qr?format=png&color=FF6600" \
  -H "Authorization: Bearer tp_REDACTED_xxxxxxxxxxxx" -o passport-qr.png
```

```typescript
const url = new URL(
  `https://app.tracepass.eu/api/v1/passports/${id}/qr`,
);
url.searchParams.set("format", "png");
url.searchParams.set("useCompanyBranding", "true");

const res = await fetch(url, {
  headers: { Authorization: `Bearer ${process.env.TRACEPASS_API_KEY}` },
});
const pngBytes = new Uint8Array(await res.arrayBuffer());
```

```python
import os, requests
res = requests.get(
    f"https://app.tracepass.eu/api/v1/passports/{passport_id}/qr",
    headers={"Authorization": f"Bearer {os.environ['TRACEPASS_API_KEY']}"},
    params={"format": "png", "useCompanyBranding": "true"},
)
res.raise_for_status()
open("passport-qr.png", "wb").write(res.content)
```

## Responses

### 200 — SVG

```json
<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 29 29">
  <!-- QR modules encoding the GS1 Digital Link URI -->
</svg>
```

### 200 — ?format=json

```json
{ "result": "<svg xmlns=\"http://www.w3.org/2000/svg\" ...></svg>" }
```

### 400 — Bad colour

```json
{ "error": "Invalid color (expect hex without '#', e.g. FF6600)" }
```

### 404 — Not found

```json
{ "error": "Passport not found" }
```

## Related

- [Get a single passport](https://www.tracepass.eu/docs/get-passport.md)
- [Create a passport](https://www.tracepass.eu/docs/create-passport.md)