API versioning and limits
Use this page to check which REST API version you are calling and how to page through forms and submissions. It also summarizes published plan limits and API areas that have no REST endpoints.
API version
The current REST API version is 2026-03-01. The version is not part of the URL. Every API route response reports it in the makeform-version header, alongside an X-Request-Id header.
You can check the root endpoint:
curl https://api.makeform.ai/It returns:
{
"name": "Makeform API",
"version": "2026-03-01",
"docs": "https://makeform.ai/docs/api"
}Pagination
Forms
GET /forms uses the integer parameters limit and offset. The default limit is 10, and it is clamped to 1–100. The default offset is 0; the minimum is 0. Forms are ordered by updated_at descending. The response includes has_more and total.
Submissions
GET /forms/{id}/submissions uses the integer parameters page and limit, or the afterId cursor. The default page is 1 and the default limit is 50; limit is clamped to 1–500. Non-numeric page or limit values return 422 validation_error. page=0 is treated as 1. Invalid status or startDate values also return 422 validation_error. afterId is a submission ID and overrides page. When you use afterId, the response reports page as 0. Submissions are ordered by submittedAt descending, then id descending. The response includes has_more, total, page, and limit.
Draft writes and request limits
The REST API does not support the Idempotency-Key header.
When replacing a form draft, include the current draft_hash in the request body or use the If-Match header. A missing hash returns 428 precondition_required; a stale hash returns 409 conflict. Publishing normalizes the draft and changes its draft_hash, so re-read the form before the next draft write. Field changes require replacing the draft config.
Requests can be rate limited. A limited REST request returns 429; wait for the time in the Retry-After header before retrying.
Published limits
You do not need a paid plan to create an API key or call REST. Feature gates follow the form owner’s plan, or the team owner’s plan for a team form. For paid settings, disabling a value, clearing it, or sending it back unchanged works.
| Limit | Result |
|---|---|
| Pro-only settings on a Free form | 403 upgrade_required when a paid value is turned on or changed |
| Respondent auto-reply requires a paid plan | 403 upgrade_required |
open_graph_image, favicon, and qr_logo image targets require a paid form | 403 |
| Email verification is Business-only | 403 when the draft is saved |
| Version history on Pro | 3 versions kept |
| Headless on Free | 1 enabled endpoint and 50 submissions a month |
| Headless on Pro and Business | Unlimited enabled endpoints and monthly submissions |
Enabling a second Headless endpoint on Free returns 403.
REST areas without endpoints
The REST API has no workspace, team, or member endpoints. It also has no webhook endpoints; manage webhooks in the dashboard or through MCP. Submission export, form stats and analytics, Headless endpoint management, translation, and duplication are available through MCP, not REST. There is no field write endpoint; change fields by replacing the draft config.