forms.app API (1.0.0)
The forms.app API gives you programmatic, read-only access to your forms and their submissions. You can list all the forms in your account, fetch a specific form's complete structure (questions, design settings, submission behaviour, thank-you pages), and page through the answers your respondents have submitted.
Every request must be authenticated with exactly one of the two methods below. Providing both in the same request is not allowed and will return 401 Unauthorized.
Obtain a JWT via the forms.app OAuth 2.0 flow and pass it in the Authorization header:
Authorization: Bearer <your_token>- Log in to forms.app.
- Click your avatar in the top-right corner and open Account Settings.
- Go to the API Keys tab.
- Click Create API Key, enter a descriptive name, and confirm.
- Copy the generated key immediately — it is shown only once.
- Store it securely (e.g. in an environment variable or secret manager).
You can create multiple keys (one per integration), and revoke any of them at any time from the same API Keys settings page.
Newly created or re-activated keys: for up to ~30 seconds, a key whose validation recently failed may keep returning
401 Unauthorizedfrom a short-lived cache. If a key you just created or re-activated is rejected, wait ~30 seconds and retry.
All endpoints return a consistent JSON envelope:
Success (2xx)
{
"success": true,
"data": { },
"errors": []
}Error (4xx / 5xx)
{
"success": false,
"data": null,
"errors": [
{ "errorCode": 1001, "errorMessage": "Unauthorized" }
]
}Requests are rate-limited per API key / token (falling back to client IP when neither is present). You may send up to 300 requests per 60-second window. When the limit is exceeded the API returns 429 Too Many Requests with a Retry-After header indicating how many seconds to wait before the window resets. Wait for that period and retry — do not spam the endpoint in a tight loop.
A short-term burst limit also applies per endpoint (about 50 requests per second, with a burst allowance up to 100). Spread requests out rather than firing them in a tight burst to avoid transient 429 responses.