The API

BootForm has three separate hosts, each its own service with its own auth model - not one API behind one base URL.

Host	Purpose	Auth
f.bootform.com	Public submission endpoint + content feed	None
api.bootform.com	Dashboard/account operations (forms, submissions, destinations, workspaces, billing, etc.)	API key or session token
mcp.bootform.com	MCP server for AI agents	API key

f.bootform.com is deliberately open - it's the one part of BootForm meant to be hit directly by a visitor's browser, with no credentials involved. Everything else requires authentication.

Authentication

Programmatic access to api.bootform.com and mcp.bootform.com uses an API key:

Authorization: Bearer {api_key}

Create one from the dashboard (Account → API Keys) or via the MCP server itself. The full key is shown exactly once at creation time - store it securely, since it can't be retrieved again (only its prefix and label are ever shown afterward). Revoking a key takes effect immediately.

The dashboard UI itself authenticates differently - a session/JWT token issued at login, not an API key - since it also carries things an API key doesn't need, like which team account you're currently acting as. If you're calling the API from a script or an integration, an API key is what you want; the session-token flow is for the dashboard's own use.

Requests and responses

All request and response bodies are JSON (except the submission endpoint, which also accepts application/x-www-form-urlencoded and multipart/form-data - see Building your form). Every successful response includes "ok": true; every error follows the same shape:

{ "ok": false, "error": "human-readable message", "code": "MACHINE_CODE" }

Pagination uses page (1-based) and per_page (default 50, max 200) query params. Timestamps are ISO 8601 UTC strings.

Common error codes

Code	HTTP status	Meaning
UNAUTHORIZED	401	Missing or invalid API key
FORBIDDEN	403	Key valid but lacks permission for this action
NOT_FOUND	404	Resource does not exist
VALIDATION_ERROR	422	Request body failed validation
PLAN_LIMIT	403	This feature isn't included on the account's current plan
QUOTA_EXCEEDED	429	Monthly submission quota reached
RATE_LIMITED	429	Too many requests - see Rate limits below
INTERNAL_ERROR	500	Unexpected server error

Many endpoints have their own specific error codes beyond this list (e.g. field-validation codes on the submission endpoint) - the full set is in the OpenAPI schema.

Rate limits

Every authenticated api.bootform.com request counts against a per-minute limit based on your plan:

Plan	Requests per minute
Free	60
Starter	300
Pro	1,000
Business	5,000

Every response includes rate-limit headers so you can track your usage without guessing:

X-RateLimit-Limit: 300
X-RateLimit-Remaining: 287
X-RateLimit-Reset: 1751457600

Full schema

This page covers the shape of the API; for the exhaustive, always-current schema (every endpoint, every request/response field), see the generated OpenAPI spec: openapi.json / openapi.yaml.