Using the REST API

Use the REST API to create a form per client, update questions and conditional logic, or pull responses into your own system. The full API reference at /api includes copyable examples, request properties and an OpenAPI schema.

The base URL is https://app.formformform.com/api/v1. Create a named key in Settings → API Keys and send it as Authorization: Bearer <key>, with Accept: application/json.

Open Settings → API Keys. Read-only keys can read and export; read and write keys can also create, edit and delete forms, fields and responses. Keys apply to your account’s forms and responses; they cannot change account settings, passwords or billing.

Under /api/v1, with your token: forms (list, create, read, update, delete, plus /duplicate and /toggle-active), a form's fields (create, update, delete, reorder), submissions (list, read, delete, export), and /api/v1/templates. Under /api/v1/public, with no token: read an active form and post an answer to it.

Which identifier goes where is what trips people up. A form is addressed by its uuid, already in the editor's address bar at /form-builder/<uuid>/edit, and a submission by its own uuid. Fields are the exception, taking the integer id the API hands back. Public routes use a third value, the short public_id from the share link.

Create with is_active: false, then edit the seeded fields and add new ones before the submit button. v1 ignores an inline fields array on form creation. Read back the form and PATCH is_active: true when it is ready. Field logic uses field UUIDs even though owner edit routes use numeric field IDs.

GET /api/v1/forms/<uuid>/submissions returns newest first, 25 to a page, per_page adjustable up to 100, with today_count alongside. Each row holds uuid, created_at, ip_address, user_agent and a values array — one entry per answered field, giving field_uuid, field_type, field_label and value. Fields left blank or hidden by conditional logic are absent rather than null, so read by field_uuid, never by position.

Fetching one submission adds prev and next uuids for walking the list, plus the armoured encrypted_payload on an encrypted form. /submissions/export streams the same CSV as the Submissions tab: a column per input field, then Submitted At, IP Address, Filled At and Was Offline.

GET /api/f/<public_id> returns an active form with public_url, encryption metadata and its fields. Public field id values are UUID strings; use those UUIDs as keys in the fields object when posting answers. The owner API still uses numeric field IDs for field edits. POST /api/f/<public_id> accepts answers and is limited to 30 posts per minute per IP.

For uploads, POST multipart to /f/<public_id>/uploads with file and form_field_id set to the upload field’s UUID. Read the returned upload UUID, put it in the field’s answer and include it in upload_uuids. Both /api/f/<public_id> and /api/v1/public/forms/<public_id>/submissions attach those files. Encrypted forms require the client-side encryption flow and encrypted_payload instead of plaintext fields.