Public API: keys, endpoints and limits

1. In your account, open API keys and press Manage API keys.
2. Under Create a key, give it a Name, such as "Reporting script", and choose Read only or Read and write. Give write access only to code that needs to delete responses or manage webhooks.
3. Press Create key, then Copy key. You see it once: we store only a hash of it.

Keys start with pfc_live_. A key can read every form you can see and its responses. An account can hold 20 active keys; Revoke one under Your keys to make room, or if it may have leaked.

Send the key in the Authorization header of every request:

curl https://www.pulseformcreator.com/api/v1/forms/ \
  -H "Authorization: Bearer pfc_live_…"

A key acts as the person who made it, with the same access they have in the dashboard, including forms their team role lets them see.

Lists take limit (1 to 100, default 50) and cursor for the next page. Responses also take order (desc, newest first, or asc), since and until. Each response carries its answers with readable values, hidden fields and calculated values, and details of the submission; anonymous forms never return device data. A club might read each night's new membership applications with since and copy them into its member database.

Each key can make 100 requests a minute. Past that, the API answers 429 with a Retry-After header in seconds. Errors come back as JSON with a status, a code and a message:

• 401 unauthorized: the key is missing, mistyped or revoked.
• 403 insufficient_scope: a read-only key tried to write.
• 403 forbidden: the key cannot reach that form.
• 404 not_found: there is no such form or response.

To get responses the moment they arrive instead of polling, use a signed webhook.