---
title: The Forms API & API keys
description: Access ChatWisp's full form-building power programmatically with the Forms API and securely managed API keys.
canonical: https://chatwisp.ai/knowledge-base/integrations/forms-api
updated: 2026-09-30
---

# The Forms API & API keys

# The Forms API & API keys

For developers and power users, ChatWisp's Forms API opens its complete form-building studio to the outside world. Build forms programmatically, integrate with your own apps, and automate form generation at scale.

## What the API lets you do

- List, create, read, update, and archive forms.
- Generate a complete form from a one-line brief.
- Add, edit, reorder, and remove any of the 14 question types.
- Set conditional branching logic.
- Apply a persona, voice, and speaking model in a single call.
- Validate a form, then [publish](/knowledge-base/building-forms/publishing-lifecycle) it and get the share link.
- Pull a summary of responses.

A **discovery endpoint** documents every capability, so external tools always know exactly what is possible.

## Creating and managing API keys

API keys are created in your **dashboard settings**. Each key has a clear **name**, a **permission level** (read-only, write, or publish), and an optional **[expiry](/knowledge-base/sharing/response-limits) date**. You can **revoke any key instantly**, which stops it working immediately.

## Permission levels

- **Read-only** — list and read forms and responses; no changes.
- **Write** — create and edit forms; get share links.
- **Publish** — full access, including publication and archival.

Start with the lowest permission level you need. Treat keys like passwords — never share them, and revoke any key you suspect has leaked.

The value: ChatWisp meets you where you work. Whether you click in the studio, chat with an AI, or wire forms into your own software, the same powerful, validated form-building is available.

## Common questions

### How do I authenticate?
With a workspace API key, created by an Account Owner in settings and sent as a bearer token. Keys are stored hashed, can carry read, write or publish scopes, and can be given an expiry.

### What happens if a key leaks?
Revoke it in settings and it stops working immediately. Because keys are scoped, a read-only key cannot be used to change or publish anything even before you notice.

### Are there rate limits?
Yes, per key and per IP, so one noisy integration cannot affect anyone else. Creation endpoints also accept an idempotency key so a retry does not create a duplicate form.

### Can I generate a whole form from a description?
Yes. One call takes a brief and returns a validated draft, which you can then edit question by question through the same API.

### Is every API write recorded?
Yes. Writes are audited, so you can see what an integration changed.

## Related

[Build forms from Claude or ChatGPT](/knowledge-base/integrations/connect-ai-assistant)