Public, unauthenticated endpoint hit when an end customer scans a QR code. Resolves the unique_code to a QrCode (falling back to a QrCodeTemplate, then its parent QrCode), records a scan-history row (IP, user-agent, referer, optional geo/device fields), bumps last_scanned_at, and returns the destination URL.

Auth: Public — no authentication required. Registered outside the authenticated group, rate-limited to 30 requests per minute per IP. Anyone with the code may call it.

Rate limit: 30 requests/min.

Request

• Path: unique_code (string, required) — unique code of a QrCode or QrCodeTemplate. In the collection example this is the literal abc-unique-code.
• Body (untyped Request, all optional; The endpoint stores only included fields):

Response — { data. } envelope wrapping an array.

• data.data.destination_url (string) — resolved via getDestinationUrl.
• data.data.qr_code_name (string)
• data.data.scan_count (int) — total scan-history rows for the QR code.
• data.data.last_scanned_at (datetime, nullable)
• data.message (string) — "QR code scanned successfully".