Use the frm_api_allow_create_entry filter to allow a restricted entry-creation request when the current WordPress user doesn't already have permission to create entries. The Formidable REST API uses this filter.

To let a user's role create entries without a custom exception, select the role under Add Entries from Admin Area in Formidable → Global Settings → Permissions.

Requirements

• Formidable Forms Pro and the Formidable API add-on installed and activated.
• Access to add a PHP customization to the WordPress site.

Usage

add_filter( 'frm_api_allow_create_entry', 'frm_allow_limited_api_entry', 10, 2 );

Parameters

• $allowed (bool): Whether the request can create an entry. The default value is false when the current user doesn't have entry-creation permission.
• $request (WP_REST_Request|array): The REST request object for a Formidable REST API request. On a site where Formidable API add-on 2.0.1 or older registers the abilities, it's the input array for an Abilities API or MCP create-entry operation.

Examples

Allow one user to create entries in one form

The filter runs on a REST API create-entry request, such as POST /wp-json/frm/v2/forms/<form ID>/entries or POST /wp-json/frm/v2/entries with form_id in the body. The request is sent as the WordPress user, for example with an application password.

This example limits the exception to one authenticated WordPress user and one form. Replace 123 with the WordPress user ID. Replace 456 with the Formidable form ID.

add_filter( 'frm_api_allow_create_entry', 'frm_allow_limited_api_entry', 10, 2 );

function frm_allow_limited_api_entry( $allowed, $request ) {
    $allowed_user_id = 123;
    $allowed_form_id = 456;

    if ( get_current_user_id() !== $allowed_user_id ) {
        return false;
    }

    if ( $request instanceof WP_REST_Request ) {
        $form_id = $request->get_param( 'form_id' );
    } else {
        $form_id = isset( $request['form_id'] ) ? $request['form_id'] : 0;
    }

    return $allowed_form_id === (int) $form_id;
}

Limitations

• Formidable calls this filter only when the current user doesn't already have entry-creation permission.
• The filter grants an exception for entry creation. It doesn't grant permission to view, update, or delete entries.
• In Formidable Forms 7.0 and newer, the formidable-forms/create-entry ability doesn't use this filter, unless Formidable API add-on 2.0.1 or older is active.
• The second parameter can have a different type for REST and Abilities API requests. Check the type before you read request data.

Related articles

• Formidable REST API endpoint reference
• Use the Formidable Abilities API
• Connect Formidable Forms to Your AI Agent with MCP