API Reference

This page primarily covers the public form submission API. ChatGPT, Claude and compatible MCP agents connect to /mcp through Static Forms OAuth. Public submission keys do not authorize reads or management operations. Agent access requires paid Starter, Pro or Agency and excludes Free and trial workspaces.

OAuth authorizes one workspace, not one form. Consent never asks the user to select forms: the connection follows every form that user can currently access in the chosen workspace, including forms created after consent. Account-scoped members remain limited to their assigned forms. When the user asks for recent submissions across the workspace, the client calls staticforms_submissions_list once without formIds; it supplies formIds only for a user-named subset.

Staging preview: agent integration, workspace and team management are available for staging verification and are not available in production yet. Workspace and team results use explicit safe representations and never expose payment identifiers, provider credentials, invitation tokens, verification codes or raw database rows.

Integration MCP tools are staticforms_form_integrations_get, staticforms_form_integration_options_list, staticforms_form_integration_validate, staticforms_form_integration_update, staticforms_form_integration_action_prepare, staticforms_form_integration_action_commit and staticforms_form_integration_activity. Mutations require the current integration revision and a UUID idempotency key. Actions also require a short-lived confirmation token issued for the exact reviewed effect. An identical lost response can use the same retry key; a changed request needs a new key.

Workspace MCP tools include staticforms_workspaces_list, branding validation and update, verified-recipient read, validation, prepare and commit, and workspace activity. Team tools separately list the roster and activity, prepare and commit access grants, and prepare and commit access reductions. Tool discovery follows the granted OAuth scopes and the user's current role and plan, so a read-only connection cannot discover write tools.

Option listing and validation may contact a connected provider. Tests and resyncs create external effects; a Mailchimp test creates or updates a real subscribed contact. Treat an unknown test outcome as potentially delivered and do not retry it automatically. Connecting OAuth or entering a token, API key, bot token or webhook URL always uses the exact signed-in Delivery link returned by Static Forms. See the agent setup and management guide for the plan matrix and complete workflow.

Workspace and team mutations use opaque current revisions and UUID idempotency keys. Email-producing recipient and invitation actions also use a short-lived confirmation for the exact target and effect. An unknown email outcome may already have been delivered and must not be retried automatically. Billing, credits, DNS, account identity, recipient verification completion and invitation acceptance remain signed-in browser steps.

Safe results return exact signed-in links for steps that must stay in Static Forms, including payments, account identity, data residency, CSV export, attachment download, credentials, CAPTCHA or provider secrets, knowledge files, logo uploads, DNS proof, verification and Agent access. Opening a link grants no authority: Static Forms signs the user in, selects the intended workspace where applicable and checks current access again.

The native Zapier polling integration uses a separate account-wide Zapier token managed under Workspace → Zapier. That token covers the owner's forms and is never an MCP credential. Make and n8n remain per-form Delivery integrations. Static Forms never returns the Zapier token through workspace reads or agent tools.