Read form submissions with the REST API

Create an API key in the dashboard, then call GET https://formward.eu/api/v1/forms/<formId>/submissions with the key in the Authorization header. You get the newest submissions first as JSON, with a cursor for older pages and filters for status and time.

The API needs the Professional plan. Use it when you want to pull data on your own schedule; if you want each submission pushed the moment it arrives, a webhook fits better.

PlanProfessional and aboveDestinationYour choice

Set it up

In the dashboard, open API keys.
Enter a Key name, tick only the Scopes the integration needs (forms:read and submissions:read are ticked by default) and click Create key.
Copy the key now. It starts with fwk_live_ and is shown once; Formward keeps only a hash.
Call GET /api/v1/forms to list the forms the key can see and find the form id.
Call GET /api/v1/forms/<formId>/submissions, and pass nextBefore from each response as before= to page backwards.

A request and its response

Processed submissions since the start of October:

bash

curl "https://formward.eu/api/v1/forms/<formId>/submissions?status=processed&since=2026-10-01" \
  -H "Authorization: Bearer fwk_live_<your-key>"

{
  "data": [
    {
      "id": "<submissionId>",
      "payload": { "email": "ada@example.com", "message": "Do you ship to Norway?" },
      "status": "processed",
      "createdAt": "2026-10-07T09:30:00.000Z",
      "spamScore": 3,
      "aiSummary": "Shipping question about Norway"
    }
  ],
  "nextBefore": "2026-10-07T09:30:00.000Z"
}

limit takes 1 to 100 (default 50); status takes received, processed, spam, held or failed. The X-Api-Key header works as an alternative to Authorization.

The full endpoint list, including form management and triage, is in the OpenAPI document at /api/v1/openapi.json.

Plan and limits

Available on the Professional plan and above. A key on a lower plan gets 403.
120 requests per minute per key. Every response has X-RateLimit-Limit, X-RateLimit-Remaining and X-RateLimit-Reset; over the limit you get 429 with Retry-After.
A key reaches every form in every organization its user belongs to, limited by the scopes you granted. Give each integration its own key so you can revoke one without breaking the rest.

Where the data goes

The API is served from Formward's EU infrastructure. Once your code fetches the data, it is wherever that code runs and stores it.

Your data-flow page lists every destination each of your forms uses right now.

Troubleshooting

401 on every call: The key is missing, mistyped or revoked. Send it as Authorization: Bearer <key> or X-Api-Key: <key>, without quotes.
403 with insufficient_scope: The plan is fine but the key lacks the scope the route needs; the error body names it. Create a new key with that scope.
404 for a form you can see in the dashboard: The key belongs to a user who is not a member of that form's organization. Create the key from an account in that organization.
429 during a backfill: Wait the number of seconds in Retry-After, then continue from the last nextBefore. At 100 rows per page, 120 requests a minute reads 12,000 submissions a minute.

Other integrations

Slack Discord Microsoft Teams Google Sheets Baserow n8n Outbound webhooks Email notifications

Connect REST API to your first form

Create a form, point your HTML at it and set up REST API in a few minutes. Submissions are stored and processed in the EU.

Start free See plans