canonical: https://jentic.com/apis/c19qrserver.local/c19qrserver # C19qrserver API for the COVID-19 Tracking QR Code Signin Server The COVID-19 QR Code Signin Server API powers a contact-tracing system where attendees check in at venues by scanning a QR code, and team members manage the resulting signin records. It exposes 14 operations covering authentication (login, logout, password change and reset), attendee signin lifecycle (create, list, update, delete), and team member directory management. Authentication is via a token header issued by the login endpoint, and the server is intended to be self-hosted by venue operators rather than offered as a managed service. The spec describes a small open-source project, so endpoint counts and resources are stable but the deployed base URL will be specific to each operator. ## For AI agents Authenticate venue operators, record attendee QR-code signins, and manage team member accounts on a self-hosted COVID-19 contact-tracing server. ## Scope Does not handle vaccination records, exposure notifications, or national contact-tracing reporting - use for venue-level attendee QR signins and team account management only. ## Capabilities - Authenticate team members through /login and revoke sessions through /logout - Record QR-code attendee signins by POSTing to /signin - List, retrieve, update, and delete individual signin records by signinId - Manage team member accounts via the /user and /users endpoints - Run password reset flows using /requestPasswordReset, /verifyPasswordChange, and /changePassword - Authorize every request with a token issued at login and passed in the token header ## Use cases ### Venue Attendee Check-In When an attendee scans the venue QR code, the front-end posts the resulting signin payload to /signin and receives a signinId. The venue operator can later query /signins for a date range or fetch /signin/{signinId} for a specific record. This gives small venues a self-hosted contact-tracing log without depending on a national tracing app. Example prompt: POST a new signin to /signin with the scanned QR payload and store the returned signinId against the attendance log. ### Team Member Account Management Venue managers add front-of-house staff to the system through POST /user, list active accounts through GET /users, and remove staff who leave through DELETE /user/{userId}. Combined with the password reset endpoints this covers the full lifecycle of a team member account on the signin server. Example prompt: POST a new team member to /user with their email and role, then list /users to confirm the account was created. ### Password Reset Flow When a team member forgets their password, the agent calls /requestPasswordReset to send the reset token, then /verifyPasswordChange to confirm the user's chosen new password meets policy, and finally /changePassword to commit the new credential. This three-step flow keeps the password change auditable on the server. Example prompt: Call /requestPasswordReset for the user, then /verifyPasswordChange and /changePassword once the user has chosen a new password. ### Signin Record Audit and Cleanup Compliance staff retrieve the full list of signins via GET /signins, inspect specific entries with GET /signin/{signinId}, and remove records via DELETE /signin/{signinId} once the retention window has passed. PUT /signin/{signinId} supports correcting a record without deleting and re-creating it. Example prompt: GET /signins for the prior month, then DELETE each /signin/{signinId} that is older than the configured retention period. ### AI Agent Operator Console via Jentic Through Jentic, an operator-facing agent searches for an intent like 'log in' or 'list today's signins' and is returned the matching endpoint with its input schema. Because authentication uses a single token header issued by /login, the agent can hold an active session and call any other operation without exposing credentials. Wiring the agent up takes under an hour rather than several days of direct integration work. Example prompt: Use Jentic search for 'list attendee signins', load the GET /signins schema, and execute it with the active operator token. ## Key endpoints | Method | Path | Description | | --- | --- | --- | | POST | /login | Authenticate a team member and issue a token | | POST | /signin | Record a new attendee signin | | GET | /signins | List attendee signin records | | GET | /signin/{signinId} | Retrieve a specific signin record | | DELETE | /signin/{signinId} | Delete a signin record | | POST | /user | Create a new team member account | | GET | /users | List team member accounts | | POST | /changePassword | Commit a password change | ## Key resources - **Authentication** — Login, logout, and token issuance. - **Attendees signins** — Create, list, retrieve, update, and delete attendee signin records. - **Passwords** — Request, verify, and commit password resets and changes. - **Team Members** — Manage team member accounts and the user directory. ## Why Jentic - **Setup:** Wiring the COVID-19 QR Code Signin Server by hand means calling /login to get a token, carrying that token in the token header on every later request, and managing user and signin records yourself. Through Jentic you install once, import the signin server from the API Directory, store the credential once, and your agent calls it. - **Permission scoping:** This server puts the signin id in the URL path (/signin/{signinId}), so a rule can pin your agent to reading a specific signin. You choose the operations it may call, so a deletion on /signin/{signinId} or user creation on /user is not included unless you add it. - **Credential handling:** The token issued by /login is stored once, encrypted, by your own Jentic One instance and injected into the token header at execution time. It never enters the agent's prompt, logs, or context. - **Discovery method:** Agents search Jentic by intent such as 'record an attendee signin' or 'list venue signins', and Jentic returns the matching operation with its input schema so the agent calls the right endpoint without browsing the reference docs. ## Related APIs - **C-Me API** — C-Me handles full identity verification while the QR signin server handles lightweight venue check-in. - **Caller API** — Caller API enriches phone numbers, useful when the signin server records a phone-based attendee identifier. - **Call Control API** — Call Control offers phone-reputation data - not a true alternative to QR signin but shares the small, focused, token-based API pattern. ## FAQ ### What authentication does the COVID-19 QR Signin Server API use? The API uses an API key passed in the token HTTP header. The token is issued by POST /login and revoked by POST /logout. Through Jentic, the token can be stored in the credential vault so the agent never holds the raw value in its prompt or context. ### Can I record an attendee QR-code signin with this API? Yes. POST the scanned QR payload to /signin to create a new signin record. The response includes the signinId, which can be used later to retrieve, update, or delete the record via /signin/{signinId}. ### What are the rate limits for this API? The OpenAPI specification does not declare rate limits. Because this is a self-hosted contact-tracing server, the operator controls request throughput at their reverse proxy or application layer rather than the API enforcing fixed limits. ### How do I list all attendee signins through Jentic? Run a Jentic search for 'list attendee signins', load the GET /signins schema, and execute it with the active operator token. Install the SDK with pip install jentic and use the async search, load, and execute pattern. ### How does the password reset flow work? It is a three-step flow. Call POST /requestPasswordReset to send a reset token, POST /verifyPasswordChange to confirm the new password meets policy, and POST /changePassword to commit it. Each step has its own endpoint so the flow can be paused for user input between steps. ### Is this API free to use? The signin server is open source and self-hosted, so there is no per-call cost. Operators run their own instance of the server, which means infrastructure cost rather than API pricing applies. ### Can I limit what my agent is allowed to do with the COVID-19 QR Signin Server API? Yes. Because Jentic One is self-hosted, your own rules decide which of the server's operations the agent may call, so you can allow it to record and list signins via POST /signin and GET /signins while withholding destructive calls like DELETE /signin/{signinId} or account creation on POST /user. Since the signin id lives in the URL path (/signin/{signinId}), a rule can pin the agent to reading or updating a specific record rather than the whole log. The /login token is held by your own instance and injected at call time, so the agent only ever exercises the exact operations and credentials you have permitted.