Public API and API keys

The public API lets your own code, Zapier and Make read forms and responses. It’s available on Pro and above.

Create an API key

1. Go to Organization in the sidebar (owners and admins) and find API keys.

2. Select New API key, give it a Name (such as Zapier), and choose what it’s Allowed to do:

   Permission	Allows
   forms:read	Listing forms and their questions
   responses:read	Reading responses, only on forms whose privacy allows export
   webhooks:write	Subscribing to new responses

3. “Copy this key now — it won’t be shown again.” KyraForm keeps only a hash. Select I’ve saved it.

Revoke a key to stop it working immediately.

Authenticate

The API’s base address is shown on the API keys card. Send the key with every request:

Authorization: Bearer efk_…

Requests are limited to 120 a minute per key.

Endpoints

Method and path	Permission	Returns
GET /me	any	{ organization: { id, name, slug }, scopes }. Use it to test a key.
GET /forms	forms:read	{ forms: [{ id, name, slug, published, responses_available, created_at, updated_at }] }
GET /forms/:id/fields	forms:read	{ fields: [{ key, field_id, label, type }] }
GET /forms/:id/responses?limit=25&before=<ISO time>	responses:read	{ responses: [...], next_before }, newest first
POST /hooks	webhooks:write	Subscribe: { form_id, target_url, event?, source? } → { id, … }
DELETE /hooks/:id	webhooks:write	Unsubscribe → 204

• Each response has the same shape as submission in a webhook body.
• To page through responses, pass the next_before value as before on the next request.
• responses_available is false for forms whose privacy (Anonymous or Blind review) keeps responses inside KyraForm. Reading or subscribing is refused for those forms.
• A subscription made with POST /hooks is an ordinary webhook. It’s signed, retried and listed in the form’s delivery log.

Errors

Errors look like { "error": "…" } with one of these statuses:

Status	Meaning
400	The request is malformed
401	Missing or revoked key
403	The key lacks the permission, or the form’s privacy forbids it
404	No such form or hook
429	Over 120 requests a minute. Wait and retry.

Example

curl -H "Authorization: Bearer $KYRA_KEY" "$KYRA_API/forms"