Gravity Forms
Read forms, search and manage entries, and run real form submissions on a self-hosted Gravity Forms site via the WordPress REST API.
About
Gravity Forms ships in the w6w first-party pack. It declares 12 actions, 3 health checks, and the host runs its code in a sandbox that never sees the credential.
- App id
io.w6w.gravityforms- Version
- 0.1.2
- Author
- w6w
- Licence
- MIT
- Categories
- Forms & Surveys · Productivity
Overview
Gravity Forms is the WordPress plugin behind a huge share of self-hosted form-driven sites, and this app talks to a site’s own Gravity Forms REST API: read form definitions, search and manage entries, and submit a form the same way a visitor filling it in would.
Because every call goes to the customer’s own WordPress install rather than a shared vendor host, this app connects per site rather than per account. Submitting a form runs the complete pipeline a real visitor triggers — validation, spam checks, connected add-ons, notifications — while creating an entry directly writes a database row without any of that, which is the right choice for imports and backfills that shouldn’t refire a payment or send a customer email.
Entry reads and writes cover the common lifecycle: search and fetch entries, create, update, and delete them, and resend an entry’s notifications on demand. Form authoring and add-on-feed configuration are left to the WordPress admin; this app works with forms and entries that already exist rather than building the forms themselves.
Build with Gravity Forms
Three routes to the same 12 actions. The Workflow tab is generated from Gravity Forms's own manifest and carries its real ids, so it is copy-pasteable; the Code and CLI examples are the same call for any action on any app, so every app-specific value in them is a blank you fill in.
Create Entry
entry-create Write an entry directly, skipping validation, feeds, notifications and confirmations. Use Submit Form when those should run.
Get Many Entries
entry-get-many Search entries across the site or within one form, with filtering, sorting and paging.
Send Entry Notifications
entry-notifications-send Process an entry's notifications, optionally restricted to specific notification IDs.
Update Entry
entry-update Replace an entry with a full Entry Object. Anything omitted is blanked out — fetch the entry first, edit it, then send it back.
Get Form Field Filters
form-field-filters-get Fetch the searchable field filters for a form — the keys and operators its entry search accepts.
Get Many Forms
form-get-many List the forms on this site, keyed by form ID. Supply form IDs to get the full form objects.
Get Form Results
form-results-get Fetch aggregated results for a Quiz, Poll or Survey form — entry counts and per-field aggregates.
Submit Form
form-submit Submit a form through the full submission pipeline — validation, anti-spam, add-on feeds, notifications and confirmations.
Validate Form Submission
form-validate Validate values against a form's rules without creating an entry, running feeds or sending notifications.
A workflow step names the app and the action, and the editor fills in the
connection when you pick one. This is the Step shape from the
workflow spec, carrying Gravity Forms's real ids.
{
"manifestVersion": "2",
"name": "gravityforms-example",
"steps": [
{
"id": "entry-create",
"uses": {
"app": "io.w6w.gravityforms",
"action": "entry-create",
"connection": "conn_YOUR_CONNECTION_ID"
},
"with": {
"formId": "<formId>",
"fieldValues": "<fieldValues>"
}
}
]
}Here are some of the things you can do
-
Create Entry
performentry-create -
Get Entry
readentry-get -
Get Many Entries
searchentry-get-many -
Send Entry Notifications
performentry-notifications-send -
Update Entry
performentry-update
+7 more actions available
Every app-specific value here is a blank you have to fill in. An
app action is reached through the connection that authenticates it, so the
address is a connection id, not the app id — and connections belong to your account,
so a public page cannot know yours. Create one for Gravity Forms, then fill in
the three blanks: conn_YOUR_CONNECTION_ID, the action key, and the
parameters that action declares. The call itself is real — the shape is transcribed
from the studio's own snippet builder, which prints the same kind of blanks — but
nothing in it is specific to Gravity Forms. The Workflow tab is where this app's
real ids are.
npm install @w6w/sdkyarn add @w6w/sdkpnpm add @w6w/sdkdeno add npm:@w6w/sdkimport { W6wClient, isActionRun } from "@w6w/sdk";
// Reads W6W_BASE_URL and W6W_TOKEN from the environment when omitted.
const client = new W6wClient();
const envelope = await client.run({
urn: "conn_YOUR_CONNECTION_ID",
action: "form-submit",
payload: {
formId: "<value>",
inputValues: "<value>",
// fieldValues: "<value>",
// sourcePage: "<value>",
// targetPage: "<value>",
},
});
if (isActionRun(envelope)) console.log(envelope.value);npm install -g @w6w/cliw6w run conn_YOUR_CONNECTION_ID --action form-submit --payload '{"formId":"<value>","inputValues":"<value>"}'Give an AI agent Gravity Forms — without giving it Gravity Forms's credentials. One MCP endpoint exposes every app, function and workflow the caller is entitled to, as tools it can discover and run. Access is granted per team while we onboard.
One tool call{
"name": "w6w_invoke",
"arguments": {
"ref": "app:io.w6w.gravityforms#entry-create",
"input": {
"formId": "<formId>",
"fieldValues": "<fieldValues>"
}
}
}
Every tool names its target with a single ref. The
app: form above doesn't name a connection at all — the
host resolves which of the caller's Gravity Forms connections to sign
with, and refuses rather than guesses when the answer is ambiguous.
What the agent gets
Credentials it can't read
The token is attached host-side, at the moment of the call. It is never a tool argument, never in the model's context, and never in a transcript — so a prompt injection has nothing to exfiltrate.
A tool surface scoped to the caller
Tools are derived per end user from what that person has actually connected and is entitled to — not one shared bot identity carrying the union of everyone's access.
A durable workflow in one call
Multi-step work runs on the workflow engine and returns a run handle the agent can poll — retries, branching and state survive the conversation that started them.
Health-aware discovery
Gravity Forms's declared health checks are on the surface too, so an agent can tell "the vendor is down" from "your credential expired" before it burns a retry on either.
The MCP surface is part of the hosted platform. Gravity Forms itself is MIT, and the runtime that executes it is source-available (FSL).
Health checks
Gravity Forms declares its own checks, so its health is a property of the app rather than something the host guesses at.
Gravity Forms platform status
API quota headroom
Site reachable
Unauthenticated `GET /wp-json/` against this connection's site — proves the host resolves, the WordPress REST API is enabled, and the `gf/v2` namespace is registered.