MOSAQO API
Public API and webhooks for QR automation
Mosaqo Public API uses workspace-scoped keys. Start with the minimum scope, use Idempotency-Key for writes and respect Retry-After when rate limited.
QUICK OVERVIEW
What this changes in practice
01
Authentication and scopes
Send the secret in X-Mosaqo-API-Key. Available scopes include qr:read, qr:write, exports:read and analytics:read. Keys can expire, be revoked or use an IP allow-list.
- Never place a secret in client JavaScript
- Use one key per integration
- Rotate after suspected exposure
02
Safe write retries
Create and publish requests require an Idempotency-Key between 1 and 128 characters. Reuse the key only to retry the identical payload within 24 hours.
03
Rate limits and errors
On HTTP 429, read Retry-After and retry with backoff. A 401 usually indicates a missing, revoked, expired, restricted or insufficiently scoped key.
04
Webhooks
Subscribe only to needed events, accept them on HTTPS and respond quickly. Mosaqo records delivery status and supports replay from the workspace.
FAQ
Frequently asked questions
Where is the complete API contract?
The OpenAPI 3.1 contract is versioned with the Mosaqo API. Create a key in the web workspace and use the published contract for endpoint details.
NEXT STEP