Paperform
Manage Paperform forms, fields, submissions and webhooks over the Paperform API v1.
About
Paperform ships in the w6w first-party pack. It declares 25 actions, 2 health checks, and the host runs its code in a sandbox that never sees the credential.
- App id
io.w6w.paperform- Version
- 0.1.0
- Author
- w6w
- Licence
- MIT
- Categories
- Forms & Surveys
Overview
Paperform is a document-style form and survey builder — payments, e-signature requests, quizzes and multi-step workflows presented as one continuous page rather than a grid of boxes. This app covers the Paperform API v1’s form/submission lifecycle: list and read forms, read and update their fields, list, read and delete full and partial (in-progress, not-yet-submitted) submissions, manage per-form webhooks, and read spaces (the folders forms are organised into).
A form’s fields and a submission’s answers are both free-form — Paperform’s own field catalog spans two dozen types (text, choices, products, signature, calculations, matrix, and more), each with a different options shape — so this app exposes a field update and a submission’s answer data as JSON matching Paperform’s own wire shape, rather than a generated per-type form that would drift out of sync with it.
Separately, Paperform also sells Papersign, a standalone e-signature product with its own section of this same API (/papersign/*). It is not covered here — see the README for why.
Build with Paperform
Three routes to the same 25 actions. The Workflow tab is generated from Paperform's own manifest and carries its real ids, so it is copy-pasteable; the Code and CLI examples are the same call for any action on any app, so every app-specific value in them is a blank you fill in.
Create Form Webhook
create-form-webhook Create a webhook on a form, firing on submission and/or partial-submission events. Requires the Business plan.
Delete Form Partial Submission
delete-form-partial-submission Delete a partial (in-progress, not yet submitted) submission, scoped to a form.
Delete Partial Submission
delete-partial-submission Delete a partial (in-progress, not yet submitted) submission by ID, without needing the parent form's slug or ID.
Delete Submission
delete-submission Delete a submission by ID, without needing the parent form's slug or ID.
Get File URLs
get-file-urls Get a signed URL and a direct access URL for a Paperform-hosted file (from a submission's file/image/signature answer).
Get Form Partial Submission
get-form-partial-submission Get a specific partial (in-progress, not yet submitted) submission by ID, scoped to a form.
Get Partial Submission
get-partial-submission Get a specific partial (in-progress, not yet submitted) submission by ID, without needing the parent form's slug or ID.
Get Submission
get-submission Get a specific submission by ID, without needing the parent form's slug or ID.
List Form Fields
list-form-fields List the fields on a specific form, optionally filtered by name search.
List Form Partial Submissions
list-form-partial-submissions List partial (in-progress, not yet submitted) submissions for a form.
List Form Webhooks
list-form-webhooks List webhooks configured on a form. Requires the Business plan.
List Forms
list-forms List all forms accessible to the authorized user, optionally filtered by title/slug search.
Update Form
update-form Update a form's title, description, disabled state, custom slug, space, or translation. Requires the Business plan.
Update Form Field
update-form-field Update a field's standard properties and/or its type-specific options (e.g. dropdown/choices/scale/rank options, a calculation, product list).
Update Form Webhook
update-form-webhook Update a webhook's target URL and/or triggers. Requires the Business plan.
A workflow step names the app and the action, and the editor fills in the
connection when you pick one. This is the Step shape from the
workflow spec, carrying Paperform's real ids.
{
"manifestVersion": "2",
"name": "paperform-example",
"steps": [
{
"id": "create-form-webhook",
"uses": {
"app": "io.w6w.paperform",
"action": "create-form-webhook",
"connection": "conn_YOUR_CONNECTION_ID"
},
"with": {
"slugOrId": "<slugOrId>",
"targetUrl": "<targetUrl>",
"triggers": "<triggers>"
}
}
]
}Here are some of the things you can do
-
Create Form Webhook
performcreate-form-webhook -
Get File URLs
readget-file-urls -
Get Form
readget-form -
Get Form Field
readget-form-field -
Get Form Partial Submission
readget-form-partial-submission
+20 more actions available
Every app-specific value here is a blank you have to fill in. An
app action is reached through the connection that authenticates it, so the
address is a connection id, not the app id — and connections belong to your account,
so a public page cannot know yours. Create one for Paperform, then fill in
the three blanks: conn_YOUR_CONNECTION_ID, the action key, and the
parameters that action declares. The call itself is real — the shape is transcribed
from the studio's own snippet builder, which prints the same kind of blanks — but
nothing in it is specific to Paperform. The Workflow tab is where this app's
real ids are.
npm install @w6w/sdkyarn add @w6w/sdkpnpm add @w6w/sdkdeno add npm:@w6w/sdkimport { W6wClient, isActionRun } from "@w6w/sdk";
// Reads W6W_BASE_URL and W6W_TOKEN from the environment when omitted.
const client = new W6wClient();
const envelope = await client.run({
urn: "conn_YOUR_CONNECTION_ID",
action: "create-form-webhook",
payload: {
slugOrId: "<value>",
targetUrl: "<value>",
triggers: "<value>",
},
});
if (isActionRun(envelope)) console.log(envelope.value);npm install -g @w6w/cliw6w run conn_YOUR_CONNECTION_ID --action create-form-webhook --payload '{"slugOrId":"<value>","targetUrl":"<value>","triggers":"<value>"}'Give an AI agent Paperform — without giving it Paperform's credentials. One MCP endpoint exposes every app, function and workflow the caller is entitled to, as tools it can discover and run. Access is granted per team while we onboard.
One tool call{
"name": "w6w_invoke",
"arguments": {
"ref": "app:io.w6w.paperform#create-form-webhook",
"input": {
"slugOrId": "<slugOrId>",
"targetUrl": "<targetUrl>",
"triggers": "<triggers>"
}
}
}
Every tool names its target with a single ref. The
app: form above doesn't name a connection at all — the
host resolves which of the caller's Paperform connections to sign
with, and refuses rather than guesses when the answer is ambiguous.
What the agent gets
Credentials it can't read
The token is attached host-side, at the moment of the call. It is never a tool argument, never in the model's context, and never in a transcript — so a prompt injection has nothing to exfiltrate.
A tool surface scoped to the caller
Tools are derived per end user from what that person has actually connected and is entitled to — not one shared bot identity carrying the union of everyone's access.
A durable workflow in one call
Multi-step work runs on the workflow engine and returns a run handle the agent can poll — retries, branching and state survive the conversation that started them.
Health-aware discovery
Paperform's declared health checks are on the surface too, so an agent can tell "the vendor is down" from "your credential expired" before it burns a retry on either.
The MCP surface is part of the hosted platform. Paperform itself is MIT, and the runtime that executes it is source-available (FSL).
Health checks
Paperform declares its own checks, so its health is a property of the app rather than something the host guesses at.
Paperform platform status
Atlassian Statuspage rollup for paperform.statuspage.io — API, Dashboard, Forms and submission processing components. Unauthenticated and unsigned.
API request-rate headroom
Paperform allows 60 requests per minute and reports the remaining count in X-RateLimit-* headers. Read from GET /v1/forms?limit=1 without parsing the body.