Use the frm_api_allow_create_entry filter to allow a restricted entry-creation request when the current WordPress user does not already have permission to create entries. Formidable REST API and the formidable-forms/create-entry ability use this filter.

If the user's role should create entries without a custom exception, select the role under Add Entries from Admin Area on the Formidable Permissions screen.

Requirements

• Formidable Forms Pro and the Formidable API Add-On installed and activated.
• Formidable API Add-On 2.0 when you use the formidable-forms/create-entry ability through Abilities API or MCP.
• Access to add a PHP customization to the WordPress site.

Usage

add_filter( 'frm_api_allow_create_entry', 'frm_allow_limited_api_entry', 10, 2 );

Parameters

• $allowed (bool): Whether the request can create an entry. The default value is false when the current user does not have entry-creation permission.
• $request (WP_REST_Request|array): The REST request object for a Formidable REST API request, or the input array for an Abilities API or MCP create-entry operation.

Allow one user to create entries in one form

This example limits the exception to one authenticated WordPress user and one form. Replace 123 with the WordPress user ID. Replace 456 with the Formidable form ID.

add_filter( 'frm_api_allow_create_entry', 'frm_allow_limited_api_entry', 10, 2 );

function frm_allow_limited_api_entry( $allowed, $request ) {
    $allowed_user_id = 123;
    $allowed_form_id = 456;

    if ( get_current_user_id() !== $allowed_user_id ) {
        return false;
    }

    if ( $request instanceof WP_REST_Request ) {
        $form_id = $request->get_param( 'form_id' );
    } else {
        $form_id = isset( $request['form_id'] ) ? $request['form_id'] : 0;
    }

    return $allowed_form_id === (int) $form_id;
}

Limitations

• Formidable calls this filter only when the current user does not already have entry-creation permission.
• The filter grants an exception for entry creation. It does not grant permission to view, update, or delete entries.
• The second parameter has a different type for REST and Abilities API requests. Check the type before you read request data.

Related articles

• Formidable REST API endpoint reference
• Use the Formidable Abilities API
• Connect Formidable Forms to Your AI Agent with MCP