The Formidable API Add-On 2.0 registers Formidable Forms operations with the WordPress Abilities API. You can discover an operation, inspect its schema, and run it through WordPress REST API requests or a Model Context Protocol (MCP) client.

Requirements

• Formidable Forms Pro and Formidable API Add-On 2.0 installed and activated.
• WordPress 6.9 or later.
• MCP Server turned on under Formidable → Global Settings → API. This setting also controls Formidable ability registration.
• A WordPress user whose role has the permission required by each operation.
• Formidable Views for View and View-layout abilities.
• HTTPS and a WordPress Application Password for external REST requests.

The Formidable API Add-On requires a Formidable Business license or higher.

Understand how abilities work

An ability is one defined operation. Each ability has:

• A stable name such as formidable-forms/list-forms.
• An input schema.
• An output schema.
• An execution callback.
• A permission callback.
• Annotations that identify read-only, destructive, and idempotent behavior.

WordPress validates the input and output against the schemas. It also checks the authenticated user's permission each time the ability runs.

The add-on registers the formidable-forms category. When Formidable Forms Pro and Formidable Views are active, it exposes 43 abilities in this category to the WordPress REST API and the bundled Formidable MCP server.

Install the API Add-On and enable the abilities

1. Install and activate Formidable Forms Pro.
2. Go to Formidable → Add-Ons.
3. Find Formidable API, then install and activate it.
4. Go to Formidable → Global Settings → API.
5. Turn on MCP Server.
6. Click Update.

• When MCP Server is on, Formidable registers its abilities and MCP server.
• When MCP Server is off, Formidable does not register its abilities for the WordPress Abilities API or any MCP server.
• An expired Formidable license outside its grace period also makes the Formidable ability surface unavailable.

There is no separate Abilities API switch. The REST API setting controls /frm/v2 and /frm/v3. It does not control /wp-abilities/v1.

Discover abilities with the WordPress REST API

Use the dedicated user's WordPress username and Application Password. Sign in as that user, then create the password under Users → Profile → Application Passwords. Do not use the API Key shown under Formidable → Global Settings → API. That key is for legacy Formidable API authentication.

List the Formidable abilities:

curl --silent --show-error \
  --user "YOUR_USERNAME:YOUR_APPLICATION_PASSWORD" \
  "https://example.com/wp-json/wp-abilities/v1/abilities?category=formidable-forms&per_page=100"

Inspect one ability before you execute it:

curl --silent --show-error \
  --user "YOUR_USERNAME:YOUR_APPLICATION_PASSWORD" \
  "https://example.com/wp-json/wp-abilities/v1/formidable-forms/create-entry"

The route for one ability does not include an extra /abilities/ segment.

Choose the correct HTTP method

WordPress selects the method from the ability annotations:

The execution route is:

/wp-json/wp-abilities/v1/formidable-forms/ABILITY-NAME/run

Run a read-only ability

The list-forms ability accepts optional input, so you can run it without an input object:

curl --silent --show-error \
  --user "YOUR_USERNAME:YOUR_APPLICATION_PASSWORD" \
  "https://example.com/wp-json/wp-abilities/v1/formidable-forms/list-forms/run"

The user must have View Forms List. This is a role-level permission. It does not filter the result for individual forms.

Run an ability that changes data

Use POST and put the ability input inside the input property. This example creates an entry. Replace the form key and field key with values from your site.

curl --silent --show-error \
  --request POST \
  --user "YOUR_USERNAME:YOUR_APPLICATION_PASSWORD" \
  --header "Content-Type: application/json" \
  --data '{
    "input": {
      "form_id": "contact-form",
      "item_meta": {
        "email-address": "person@example.com"
      }
    }
  }' \
  "https://example.com/wp-json/wp-abilities/v1/formidable-forms/create-entry/run"

form_id accepts a numeric form ID or the form key returned by list-forms. Each property in item_meta must use a numeric field ID or a field key returned by list-fields. Do not use the visible form name or field label.

Available abilities

The complete ability catalog contains 43 abilities when Formidable Forms Pro and Formidable Views are active.

The Ability and Required input columns contain API identifiers. They are not WordPress admin labels. Use list or get abilities to retrieve IDs and keys before you run a change.

Forms

Entries

The create-entry permission can also be extended with the frm_api_allow_create_entry hook. This hook is a PHP customization for developers. It is not an option on the Permissions screen.

Fields

For a complex field, call list-fields after creation. Reuse the returned field_options API structure when you make later changes. The WordPress field settings panel does not show this structure as an object.

Statistics

Styles and style assignment

Use the numeric style ID or the post_name value returned by list-styles. post_name is the style's internal CSS scope slug. It is not the style name shown under Formidable → Styles.

Form actions

Form action input uses API values. These values do not always match the labels under Formidable → Forms → [form] → Settings → Actions & Notifications. For example, the API type api appears as Send API Data. The post_status value publish turns an action on. The value draft turns it off. Inspect an existing action of the same type before you create or update one, then read the action back after the change.

Applications

A Formidable Application is a collection of forms, Views, and pages shown under Formidable → Applications. It is not a WordPress Application Password.

Set the item_type API value to form, view, or page. Use list-application-items after a relationship change.

Views

Use all for the Classic View type in API input.

New Views are private by default. Use private for an unpublished View and publish for a public View. The schema accepts draft for compatibility with older data.

View layouts

View layout abilities manage the row structure behind the Listing Page and Detail Page areas in the View editor. They do not represent a separate View Layouts screen. The API value listing maps to Listing Page. The value detail maps to Detail Page.

Apply the least privilege needed

Use a dedicated WordPress user for each integration. Go to Formidable → Global Settings → Permissions. Under each required permission, select the dedicated user's WordPress role, then click Update. Each selection affects all users with that role. If the integration needs a unique permission set, create a custom role with a role-management plugin or custom code. Formidable does not create WordPress roles.

Administrators can run the registered operations. A dedicated non-administrator can also run them when its role has the required capabilities.

Use the same abilities through MCP

The Formidable MCP server exposes the abilities through three generic MCP tools. Use MCP when an AI client needs discovery, schema inspection, and execution through one standard connection.

Before a change, ask the client to inspect the target ability. After a change, ask it to use a separate get or list ability to verify the stored result.

See Connect Formidable Forms to Your AI Agent with MCP for installation, connection, and safe prompt examples.

Limitations

• The full 43-ability catalog requires the matching Formidable Pro and Formidable Views products.
• Turning off MCP Server also removes the Formidable abilities from the WordPress Abilities API.
• An expired license outside the grace period makes the Formidable ability surface unavailable.
• View schemas accept draft for compatibility. Use private or publish for normal View workflows.
• Form action payloads vary by action type and installed add-on. Inspect and verify the stored action.
• Creates are generally not idempotent. If a client loses a response, list existing objects before it retries the create.
• Delete abilities use DELETE through the WordPress Abilities REST API. Their input must be a URL-encoded input query parameter.
• Schema discovery describes the interface. It does not replace an independent read-back after a mutation.

Related articles

• Connect Formidable Forms to Your AI Agent with MCP
• Formidable REST API endpoint reference
• Formidable Form Webhooks API
• Using Application Passwords for API authentication
• WordPress Abilities API REST endpoints
• Register an ability with wp_register_ability()