Leads

Read lead form submissions with their consent record, code and location.

Plan: Pro and up (lead capture).

GET /api/v1/leads

Returns submissions newest first, 100 per page.

Query parameter	Notes
`codeId`	Only leads from this code (UUID)
`formId`	Only leads from this form (UUID)
`from`	Received at or after, ISO 8601 with offset, e.g. `2026-11-01T00:00:00Z`
`to`	Received before, same format
`page`	Page number, from 1. See Pagination

curl "https://dynaqr.app/api/v1/leads?from=2026-11-01T00:00:00Z" \
  -H "Authorization: Bearer qrm_live_your_key"

Response

{
  "data": [
    {
      "id": "5a7c9e1b-2d4f-4a6b-8c0d-e1f2a3b4c5d6",
      "createdAt": "2026-11-13T18:22:05.000Z",
      "locked": false,
      "values": {
        "firstName": "Ana",
        "lastName": "Silva",
        "email": "[email protected]",
        "phone": "+447700900123"
      },
      "consent": {
        "terms": { "shown": true, "text": "I agree to the terms of Corner Cafe.", "checked": true, "url": "https://example.com/terms" },
        "marketing": { "shown": true, "text": "Send me offers from Corner Cafe.", "checked": false },
        "at": "2026-11-13T18:22:05.000Z"
      },
      "form": "Loyalty sign-up",
      "formId": "9c8b7a6d-5e4f-4321-8abc-def012345678",
      "code": "Counter sticker",
      "codeId": "0b8f6c2e-3f7a-4d0e-9a61-2f4c7f1d9b10",
      "placement": "Till",
      "location": { "country": "GB", "region": "ENG", "city": "London" },
      "utm": { "source": "qr", "campaign": "loyalty" }
    }
  ],
  "page": 1,
  "total": 1
}

Field	Notes
`locked`	`true` when the lead came in after the plan's monthly lead limit was reached. `values` is then empty `{}` until the plan allows it, for example after an upgrade or at the start of the next month
`values`	What the visitor typed. Only the fields the form asks for are present: `firstName`, `lastName`, `email`, `phone`, `address` (an object with any of `line1`, `line2`, `city`, `district`, `state`, `postalCode`, `country`), and `message` (free text, up to 2,000 characters, as typed: escape it before showing it in HTML)
`consent`	Exactly what the visitor saw and ticked. `terms` and `marketing` are `null` when the form didn't show them
`form`, `code`	Names at the time you read them. `null` if the form or code was deleted
`placement`	The code's placement when the lead came in
`location`	From the visitor's IP address at submission; any part can be `null`
`utm`	UTM parameters on the page the form was submitted from, without the `utm_` prefix: any of `source`, `medium`, `campaign`, `term`, `content`

Leads are personal data. Store and use them in line with the consent recorded here.