All integrations

Fillout

MARKETING · MARKETING

Forms, their questions, submissions, and webhooks in the account they connected.

Connecting Fillout in practice

Fillout allows no more than 5 calls per second per account and API key, and submissions page at 150 at most against a default of 50, so pulling a form with 50,000 responses is well over 300 requests that all have to fit inside that one budget. A submission can carry scheduling, payment, quiz and login data alongside the answers, so "read one form" is broader than it sounds.

Scopes that draw scrutiny

  • Authorization: Bearer <API key> A single account-wide key from the Developer settings tab, with no scopes. It lists every form and reads every submission, including the payment and login fields a response may contain.

Rate limits

  • No more than 5 requests per second, per account and API key.
  • Get all submissions: `limit` defaults to 50 with a maximum of 150; `offset` defaults to 0.

Worth knowing

  • The API key is one per account and can be revoked or regenerated at any time in Developer settings, which invalidates it for every integration at once.
  • The base URL is https://api.fillout.com for ordinary accounts but differs for self-hosted and EU instances, so hardcoding the host breaks exactly the customers with data-residency requirements.
  • Responses come back with `totalResponses` and `pageCount` alongside the rows, so paging correctly means reading the envelope rather than counting until empty.
  • Filters are `afterDate`/`beforeDate` in ISO 8601 plus a `status` of finished or in_progress — an unfiltered pull includes partially completed submissions.

Checked against Fillout REST API (2026-09-29), Get all submissions (2026-09-29)

Acts as the person, not as itself

Each user connects their own account. Every call carries both identities — the agent and the person it is acting for — so the agent can never reach past what that individual can already do.

Credentials never touch the agent

Tokens live in the vault and attach server-side at call time. The agent holds a session, not a secret, and revoking access does not mean rotating a key.

Every call on the record

Who asked, which agent acted, which action ran, and the verdict that let it through — one audit trail across every integration, not one per vendor.

What an agent can do

Each action is granted on its own. An agent allowed to read is not thereby allowed to write, and the scope beside each row is what the acting user must have connected for it to run at all.

fillout_delete_forms_by_formid_submissions_by_submissionidWRITE

Delete submission by ID via DELETE /forms/{formId}/submissions/{submissionId}. Deletes a submission by its ID. Permanent; Fillout answers 200 with no body when the submission is gone.

api
fillout_get_formsREAD

Get all forms via GET /forms. Returns a list of all your forms. Returns the public formId and name of every form in the account; formId is what every other tool takes.

api
fillout_get_forms_by_formidREAD

Get form metadata via GET /forms/{formId}. Given the formId, returns all the questions in that form and other metadata. The metadata carries every question with its id, name and type, plus calculations, URL parameters, scheduling and payment fields and the quiz configuration where enabled -- the question ids are what `fillout_post_forms_by_formid_submissions` answers against.

api
fillout_get_forms_by_formid_submissionsREAD

Get all submissions via GET /forms/{formId}/submissions. Returns a list of all submissions for a given form. Paginated: `limit` is 1-150 (default 50) and `offset` is the starting position; the response carries `responses`, `totalResponses` and `pageCount`. Only finished submissions come back unless `status=in_progress`.

api
fillout_get_forms_by_formid_submissions_by_submissionidREAD

Get submission by ID via GET /forms/{formId}/submissions/{submissionId}. Returns a single submission by its ID.

api
fillout_post_forms_by_formid_submissionsWRITE

Create submissions via POST /forms/{formId}/submissions. Create new submissions for a form. Up to 10 submissions per call. Each submission needs `questions` (a list of {id, value} keyed by the question ids from the form metadata) and may carry urlParameters, scheduling, payments, login, submissionTime and lastUpdatedAt.

api
fillout_post_webhook_createWRITE

Create a webhook via POST /webhook/create. Creates a webhook for a given form. Fillout POSTs each new submission of the form to `url`; the response carries the numeric webhook `id` needed to remove it.

api
fillout_post_webhook_deleteWRITE

Remove a webhook via POST /webhook/delete. Removes a webhook. Destroys the webhook: pass the `id` returned when it was created (as a string). This is a POST on the wire, but its effect is a delete.

api

Put Fillout behind one governed endpoint.

Same permissions, same audit trail, whatever else you connect next.