---
name: postmyform-api
description: Manage PostMyForm forms for static websites with the public PostMyForm API.
---

# PostMyForm API

Use this skill to manage PostMyForm forms for static websites.

## Choose an interface

Use the [PostMyForm MCP documentation](https://postmyform.com/docs/mcp)
when a compatible AI agent or MCP client should manage forms.

Use the [PostMyForm CLI documentation](https://postmyform.com/docs/cli)
for local shell workflows, scripts, and CI automation.

Use the raw API when the task requires a custom HTTP integration or
client.

## Source of truth

Use the public OpenAPI contract as the source of truth.

OpenAPI JSON:

https://postmyform.com/openapi.json

OpenAPI YAML:

https://postmyform.com/openapi.yaml

API base URL:

https://postmyform.com/api/v1

Do not guess API operations or request fields.

## Authentication

Use a PostMyForm API credential.

Send the credential in the `Authorization` header as a bearer token.

Do not put API credentials in URLs.

Do not put API credentials in source code, logs, or committed files.

## Scopes

Use `forms:read` for read operations.

Use `forms:write` for write operations.

Request only the scopes that the task requires.

## Form workflow

Use `GET /forms` to find existing forms.

Use `POST /forms` to create a form when creation is required.

Use `GET /forms/{formId}` to read one form.

Use `PATCH /forms/{formId}` to update a form.

Use `GET /forms/{formId}/fields` to read form fields.

Use `PUT /forms/{formId}/fields` to replace form fields.

Use `GET /forms/{formId}/snippet` to get generated form HTML.

## Rate limits

Read operations allow 120 requests per minute for each credential and 120 requests per minute in aggregate for the organization.

Write operations allow 30 requests per minute for each credential and 30 requests per minute in aggregate for the organization.

PostMyForm also applies pre-authentication abuse protection.

If the API returns HTTP 429, wait for the number of seconds in `Retry-After`.

## Boundaries

Use only documented public routes under `/api/v1`.

Do not use private account, dashboard, operator, billing, or internal API routes.

Do not access the PostMyForm database directly.