Admin API
Base URL: https://admin.forms.zone/admin. Every route requires a signed-in
session — log in at admin.forms.zone
first, then these endpoints work from the same browser session. There's no API key:
this is the API the dashboard itself uses.
Pagination everywhere: ?limit=&offset= → { items, total, limit, offset }.
Forms
| Route | Does |
|---|---|
POST /admin/forms | { slug, name } → creates a draft form. |
GET /admin/forms | Paginated list. |
GET /admin/forms/:id | One form, plus allowedOrigins. |
PUT /admin/forms/:id | Update name/status/limits/origins. Setting schema publishes a new, immutable version — history is never overwritten. |
GET /admin/forms/:id/versions | Every schema version ever published for this form. |
POST /admin/forms/:id/rollback | { version } → republishes an old schema as a brand-new version. |
Webhooks
| Route | Does |
|---|---|
POST /admin/forms/:id/webhooks | { url } → creates a destination. The response includes the signing secret once — copy it then, it's never shown again. |
GET /admin/forms/:id/webhooks | List destinations for a form (no secrets). |
PUT /admin/webhooks/:id | { url?, enabled? }. |
GET /admin/webhooks/:id/deliveries | Delivery history: status, response code, attempt, error. |
POST /admin/webhooks/:id/retry | Re-queues that destination's failed deliveries. |
Webhook URLs are checked and rejected if they point anywhere unsafe — see Security.
Submissions
| Route | Does |
|---|---|
GET /admin/submissions?formId=&status= | Paginated, filterable list. |
GET /admin/submissions/:id | Full submission, including attached files. |
PATCH /admin/submissions/:id | { data } → admin correction. Doesn't trigger a webhook (only respondent submissions/edits do). |