A reference guide for building AI agents: every method, how to authenticate, and the permissions each one needs.
The Jotform API is how an app or AI agent works with a Jotform account: listing forms, reading the submissions a form has collected, creating or cloning a form, and adding a webhook so new submissions are pushed out. Access is granted through an API key that belongs to one account, and the key is set to read-only or full access, which is the only permission boundary on it. The API is not versioned, so an integration always calls a single continuously updated API.
How an app or AI agent connects to Jotform determines what it can reach. There is a route for making calls with an API key, a hosted server that exposes Jotform tools to agents, and per-form webhooks that push new submissions, each governed by the credential behind it.
The REST API answers at https://api.jotform.com, with a separate https://eu-api.jotform.com host for accounts on the European data region. Every response is a JSON envelope carrying responseCode, message, and content.
Jotform's hosted MCP server at https://mcp.jotform.com lets an agent work with forms and submissions through the Model Context Protocol. It exposes tools to list forms, create and edit a form, create a submission, and get submissions. Connection is through OAuth 2.0; a plain API key is not accepted.
A webhook registered on a form posts that form's submission data to a chosen address each time the form is submitted. The data arrives as form-encoded fields, with the answers held in a rawRequest field.
An API key is created in the account's API settings and sent with each request. At creation the key is set to read-only or full access, and that level can be changed later. A read-only key can read forms and submissions but cannot create, edit, or delete anything.
The hosted MCP server uses OAuth 2.0 rather than an API key. Each user authorizes the connection once through a Jotform app, and the granted access is used for the MCP tools.
The Jotform API is split into areas an agent can act on, like forms, the questions inside a form, submissions, reports, and folders. Each area has its own methods, and what an agent can change depends on whether its API key is read-only or full access.
List an account's forms, read a single form, create a form, clone a form, and delete a form.
List the questions on a form, read a single question, read a form's properties, add a question, and delete a question.
List submissions across an account or for one form, read a single submission, create a submission, edit a submission, and delete a submission.
List an account's reports, list a form's reports, and read a single report.
List an account's folders, read a single folder, and create a folder.
Read the account's profile, its daily usage, its settings, and its sub-users.
List a form's webhooks, add a webhook to a form, and delete a webhook from a form.
Filter by method, access, or permission, or search any path. Select a row for version detail, rate limits, the related webhook event, and the source.
| Method | Endpoint | What it does | Access | Permission | Version | |
|---|---|---|---|---|---|---|
FormsList an account's forms, read a single form, create a form, clone a form, and delete a form.5 | ||||||
| GET | /user/forms | List the forms in the account, with their status, submission count, and metadata. | read | Read | Current | |
Returns every form the API key's account can reach. A read-only key can call this; the key carries no per-form scoping. Acts onform Permission (capability) ReadVersionAvailable since the API’s base version Webhook eventNone Rate limitStandard limits apply SourceOfficial documentation ↗ | ||||||
| GET | /form/{formID} | Get a single form's details, including its title, status, and counts. | read | Read | Current | |
Readable with a read-only or full-access key. Acts onform Permission (capability) ReadVersionAvailable since the API’s base version Webhook eventNone Rate limitStandard limits apply SourceOfficial documentation ↗ | ||||||
| POST | /user/forms | Create a new form, defining its questions, properties, and emails. | write | Full Access | Current | |
Requires a full-access API key. A read-only key is rejected with a 401. Acts onform Permission (capability) Full AccessVersionAvailable since the API’s base version Webhook eventNone Rate limitStandard limits apply SourceOfficial documentation ↗ | ||||||
| POST | /form/{formID}/clone | Clone a form, creating a copy of it in the account. | write | Full Access | Current | |
Requires a full-access API key. Acts onform Permission (capability) Full AccessVersionAvailable since the API’s base version Webhook eventNone Rate limitStandard limits apply SourceOfficial documentation ↗ | ||||||
| DELETE | /form/{formID} | Delete a form. The form is moved to trash rather than permanently removed. | write | Full Access | Current | |
Requires a full-access API key. Acts onform Permission (capability) Full AccessVersionAvailable since the API’s base version Webhook eventNone Rate limitStandard limits apply SourceOfficial documentation ↗ | ||||||
Form questionsList the questions on a form, read a single question, read a form's properties, add a question, and delete a question.5 | ||||||
| GET | /form/{formID}/questions | List the questions on a form, with each question's type and properties. | read | Read | Current | |
Readable with a read-only or full-access key. Acts onquestion Permission (capability) ReadVersionAvailable since the API’s base version Webhook eventNone Rate limitStandard limits apply SourceOfficial documentation ↗ | ||||||
| GET | /form/{formID}/question/{qid} | Get a single question on a form by its question id. | read | Read | Current | |
Readable with a read-only or full-access key. Acts onquestion Permission (capability) ReadVersionAvailable since the API’s base version Webhook eventNone Rate limitStandard limits apply SourceOfficial documentation ↗ | ||||||
| GET | /form/{formID}/properties | Get a form's properties, like its theme, language, and submission settings. | read | Read | Current | |
A single property is read at /form/{formID}/properties/{key}. Readable with a read-only key. Acts onform property Permission (capability) ReadVersionAvailable since the API’s base version Webhook eventNone Rate limitStandard limits apply SourceOfficial documentation ↗ | ||||||
| POST | /form/{formID}/questions | Add one or more questions to a form. | write | Full Access | Current | |
Requires a full-access API key. Acts onquestion Permission (capability) Full AccessVersionAvailable since the API’s base version Webhook eventNone Rate limitStandard limits apply SourceOfficial documentation ↗ | ||||||
| DELETE | /form/{formID}/question/{qid} | Delete a single question from a form. | write | Full Access | Current | |
Requires a full-access API key. Removing a question removes the field from the form. Acts onquestion Permission (capability) Full AccessVersionAvailable since the API’s base version Webhook eventNone Rate limitStandard limits apply SourceOfficial documentation ↗ | ||||||
SubmissionsList submissions across an account or for one form, read a single submission, create a submission, edit a submission, and delete a submission.6 | ||||||
| GET | /user/submissions | List submissions across all of the account's forms. | read | Read | Current | |
Returns response data people entered into forms. Readable with a read-only key. Acts onsubmission Permission (capability) ReadVersionAvailable since the API’s base version Webhook eventNone Rate limitStandard limits apply SourceOfficial documentation ↗ | ||||||
| GET | /form/{formID}/submissions | List the submissions for a single form, with filtering and ordering. | read | Read | Current | |
Returns the answers submitted to that form. Readable with a read-only key. Acts onsubmission Permission (capability) ReadVersionAvailable since the API’s base version Webhook eventNone Rate limitStandard limits apply SourceOfficial documentation ↗ | ||||||
| GET | /submission/{sid} | Get a single submission by its id, with each answer. | read | Read | Current | |
Readable with a read-only key. Acts onsubmission Permission (capability) ReadVersionAvailable since the API’s base version Webhook eventNone Rate limitStandard limits apply SourceOfficial documentation ↗ | ||||||
| POST | /form/{formID}/submissions | Create a submission on a form by supplying answers for its questions. | write | Full Access | Current | |
Requires a full-access API key. A submission added through the API does not trigger the form's webhooks or integrations. Acts onsubmission Permission (capability) Full AccessVersionAvailable since the API’s base version Webhook eventNone Rate limitStandard limits apply SourceOfficial documentation ↗ | ||||||
| POST | /submission/{sid} | Edit an existing submission, changing one or more of its answers. | write | Full Access | Current | |
Requires a full-access API key. Acts onsubmission Permission (capability) Full AccessVersionAvailable since the API’s base version Webhook eventNone Rate limitStandard limits apply SourceOfficial documentation ↗ | ||||||
| DELETE | /submission/{sid} | Delete a single submission. | write | Full Access | Current | |
Requires a full-access API key. The submission is removed permanently. Acts onsubmission Permission (capability) Full AccessVersionAvailable since the API’s base version Webhook eventNone Rate limitStandard limits apply SourceOfficial documentation ↗ | ||||||
ReportsList an account's reports, list a form's reports, and read a single report.3 | ||||||
| GET | /user/reports | List the reports created across the account. | read | Read | Current | |
Readable with a read-only key. Acts onreport Permission (capability) ReadVersionAvailable since the API’s base version Webhook eventNone Rate limitStandard limits apply SourceOfficial documentation ↗ | ||||||
| GET | /form/{formID}/reports | List the reports built on a single form. | read | Read | Current | |
Readable with a read-only key. Acts onreport Permission (capability) ReadVersionAvailable since the API’s base version Webhook eventNone Rate limitStandard limits apply SourceOfficial documentation ↗ | ||||||
| GET | /report/{reportID} | Get a single report by its id, including its type and settings. | read | Read | Current | |
A report can carry a public URL that exposes submission data without the API key. Readable with a read-only key. Acts onreport Permission (capability) ReadVersionAvailable since the API’s base version Webhook eventNone Rate limitStandard limits apply SourceOfficial documentation ↗ | ||||||
FoldersList an account's folders, read a single folder, and create a folder.3 | ||||||
| GET | /user/folders | List the account's folders and the forms inside them. | read | Read | Current | |
Readable with a read-only key. Acts onfolder Permission (capability) ReadVersionAvailable since the API’s base version Webhook eventNone Rate limitStandard limits apply SourceOfficial documentation ↗ | ||||||
| GET | /folder/{folderID} | Get a single folder and its contents. | read | Read | Current | |
Readable with a read-only key. Acts onfolder Permission (capability) ReadVersionAvailable since the API’s base version Webhook eventNone Rate limitStandard limits apply SourceOfficial documentation ↗ | ||||||
| POST | /folder | Create a folder to organize forms. | write | Full Access | Current | |
Requires a full-access API key. Acts onfolder Permission (capability) Full AccessVersionAvailable since the API’s base version Webhook eventNone Rate limitStandard limits apply SourceOfficial documentation ↗ | ||||||
User & accountRead the account's profile, its daily usage, its settings, and its sub-users.4 | ||||||
| GET | /user | Get the account's profile, including name, email, plan, and account type. | read | Read | Current | |
Returns the account holder's email and plan. Readable with a read-only key. Acts onuser Permission (capability) ReadVersionAvailable since the API’s base version Webhook eventNone Rate limitStandard limits apply SourceOfficial documentation ↗ | ||||||
| GET | /user/usage | Get the account's monthly usage, like submissions, payments, and uploads against plan limits. | read | Read | Current | |
Readable with a read-only key. Acts onusage Permission (capability) ReadVersionAvailable since the API’s base version Webhook eventNone Rate limitStandard limits apply SourceOfficial documentation ↗ | ||||||
| GET | /user/settings | Get the account's settings, like time zone, language, and security options. | read | Read | Current | |
Updated with a POST to the same path, which requires a full-access key. Reading is allowed with a read-only key. Acts onsettings Permission (capability) ReadVersionAvailable since the API’s base version Webhook eventNone Rate limitStandard limits apply SourceOfficial documentation ↗ | ||||||
| GET | /user/subusers | List the sub-users that share the account, with their access levels. | read | Read | Current | |
Readable with a read-only key. Acts onsub-user Permission (capability) ReadVersionAvailable since the API’s base version Webhook eventNone Rate limitStandard limits apply SourceOfficial documentation ↗ | ||||||
WebhooksList a form's webhooks, add a webhook to a form, and delete a webhook from a form.3 | ||||||
| GET | /form/{formID}/webhooks | List the webhooks registered on a form. | read | Read | Current | |
Readable with a read-only key. Acts onwebhook Permission (capability) ReadVersionAvailable since the API’s base version Webhook eventNone Rate limitStandard limits apply SourceOfficial documentation ↗ | ||||||
| POST | /form/{formID}/webhooks | Add a webhook to a form, so Jotform posts each new submission to a chosen address. | write | Full Access | Current | |
Requires a full-access API key. The webhook URL receives the submission data on each new submission. Acts onwebhook Permission (capability) Full AccessVersionAvailable since the API’s base version Webhook event submissionRate limitStandard limits apply SourceOfficial documentation ↗ | ||||||
| DELETE | /form/{formID}/webhooks/{webhookID} | Delete a webhook from a form by its index. | write | Full Access | Current | |
Requires a full-access API key. Acts onwebhook Permission (capability) Full AccessVersionAvailable since the API’s base version Webhook eventNone Rate limitStandard limits apply SourceOfficial documentation ↗ | ||||||
Jotform can notify an app or AI agent when a form receives a new submission, instead of the app repeatedly asking. A webhook is registered on a single form, and Jotform posts the submission data to that address each time the form is submitted.
| Event | What it signals | Triggered by |
|---|---|---|
New submission | Fires when a form is submitted through its submit button, posting the submission data to each webhook registered on that form. A submission created through the API does not fire this. | /form/{formID}/webhooks |
Jotform limits how much an app or AI agent can call through a daily request quota that depends on the account plan, and each response reports how many calls are left for the day.
Jotform limits calls by a daily quota tied to the account plan rather than a per-second rate. A starter account gets 1,000 API calls per day, bronze 10,000, silver 50,000, and gold 100,000; Enterprise accounts have no call limit. The daily count resets at midnight Eastern time, and every response carries a limit-left field showing how many calls remain for the day. Once the quota is used up, further calls fail with an API-Limit exceeded message until the reset.
List endpoints take offset and limit query parameters, where limit defaults to 20 and can be raised, and accept filter and orderby parameters to narrow and sort results. There is no cursor; pages are stepped through by increasing offset.
Responses are JSON wrapped in the responseCode, message, and content envelope. Uploaded files attached to submissions are subject to the account plan's upload and storage limits rather than an API payload cap.
The status codes an agent should handle, and what to do about each.
| Status | Code | Meaning | What to do |
|---|---|---|---|
| 200 | success | The request succeeded. The body holds responseCode 200, message 'success', the content payload, and a limit-left field with the calls remaining today. | Read the content field. Watch limit-left to stay inside the daily quota. |
| 401 | Unauthorized | The API key is missing, invalid, or lacks the access for the call. A read-only key calling a write endpoint returns 401 with a not-authorized message naming the endpoint. | Send a valid API key in the APIKEY header, and use a full-access key for writes. |
| 403 | Forbidden | The key is recognized but not permitted to act on the requested resource. | Confirm the account owns the form or submission and the key has full access. |
| 404 | Not Found | The form, submission, report, or folder id does not exist or is not reachable by this account. | Check the id is correct and belongs to the account behind the key. |
Jotform exposes one continuously updated API. There is no dated version to pin, so an integration always calls the current API and reads new fields as they appear.
Jotform exposes one API reached through its path, with no dated versions and no version header to pin. New fields and endpoints are added to the same API over time, so an integration always calls the current version and reads new fields as they appear. The hosted MCP server is the newer access route and gains tools over time.
There is no version header to set; the API path itself is the only version marker.
Jotform developer hub ↗Bollard AI sits between a team's AI agents and Jotform. Grant each agent exactly the access it needs, read or write, resource by resource, and every call is checked and logged.