# PollenForms > Organization-scoped forms, campaigns, responses, assets, library, bookings, and workflow automation. - [API reference](https://pollenforms-api-prod.apps.01.cf.eu01.onstackit.cloud/v1/api-docs) - [OpenAPI schema](https://pollenforms-api-prod.apps.01.cf.eu01.onstackit.cloud/v1/openapi.json) - [Complete API and MCP guide](https://pollenforms-api-prod.apps.01.cf.eu01.onstackit.cloud/v1/llms-full.txt) MCP: https://pollenforms-api-prod.apps.01.cf.eu01.onstackit.cloud/v1/mcp (stateless Streamable HTTP; authenticated POST). Never include secrets in prompts or tool arguments. # PollenForms public API and MCP guide The canonical reference is `/v1/api-docs`, backed by `/v1/openapi.json`. Both are public: no login or API key is needed to read documentation. The OpenAPI document inventories the running server's registered routes and includes input schemas, response schemas, examples, authentication, and required scopes. `/v1/llms.txt` is a compact index; `/v1/llms-full.txt` contains this guide and the operation inventory. API-hostname root aliases also exist, but use `/v1/…` on the shared product hostname because its existing Cloud Foundry route forwards `/v1` to the API. Examples below contain fictional IDs. Replace `BASE_URL` with your deployed public origin and obtain credentials through your organization's Settings → API page. Do not include `/v1` in `BASE_URL`. ## Authentication, scopes, and key lifecycle Send `Authorization: Bearer pfk_…` over HTTPS. Keys belong to one organization and their creating user; they do not grant another organization's data or a stronger role. Only approved, active, authorized owners can continue using their keys. Key creation, listing, and revocation under `/v1/api-keys` require an interactive human administrator. API keys cannot manage API keys, acquire browser edit locks, act as a superadministrator, or call private AuraFlow service integration routes. Store the full token when it is shown once after creation. Subsequent lists expose its prefix and metadata, not its secret. Use a secret manager or environment variable, never a repository, URL, prompt, browser bundle, or log. Set an expiry appropriate to the integration. Rotate by creating a replacement, updating the client, verifying a successful call, and revoking the old key in Settings. Revoked or expired keys return 401. Removing the owner's access also invalidates authorization; a key is not a permanent service account. Granular resource scopes are `forms:read/write`, `campaigns:read/write`, `responses:read/write`, `assets:read/write`, `library:read/write`, `bookings:read/write`, `connections:read/write`, `workflows:read/write`, and `branding:read/write` (each slash denotes two actual scopes, for example `forms:read` and `forms:write`). A group's write scope includes its read access. Legacy `read` grants eligible reads and legacy `write` grants eligible reads and writes. Neither legacy scope bypasses human/service-only restrictions. An operation with multiple `x-required-scopes` needs all of them; form data automations need both forms and connections access, and appointment reads also need response access. Form validation is nonmutating and uses `forms:read` even though its HTTP method is POST. Changing organization style defaults is a deliberate exception: `PUT /v1/style-defaults` requires an admin/user_admin-owned key with explicit `branding:write`; legacy `write` alone does not grant this capability. Production audience-user lookup requires an admin-owned key plus the independent AuraFlow authorization described below. ```sh export BASE_URL='https://forms.example.org' # Set POLLENFORMS_API_KEY privately through your shell or secret manager. curl --fail-with-body "$BASE_URL/v1/me" \ -H "Authorization: Bearer $POLLENFORMS_API_KEY" ``` ### Independent AuraFlow authorization A PollenForms key is never forwarded to AuraFlow. Calls that discover or create workflows, read workflow inputs, connect workflows, or use AuraFlow-managed secret sources may also need your independently authenticated AuraFlow session. Supply `X-AuraFlow-Authorization: Bearer ` and, where your login requires paired proof, `X-Zitadel-Id-Token: `. The server verifies that this is the same approved, non-viewer user and organization as the key owner; AuraFlow's process ACLs still decide access. It does not substitute a service token or elevate privileges. Missing auxiliary authorization returns 403 with code `auraflow_authorization_required`; a mismatched identity returns `auraflow_identity_mismatch`. Keep these credentials in HTTP transport configuration. For MCP, configure them as connection headers, never tool arguments. A PollenForms API key remains sufficient for ordinary local forms, campaigns, results, library, assets, and booking operations that do not invoke AuraFlow. A workflow mutation can still require independent authorization even when its path is under `/v1/campaigns`. ## Create a form, validate it, publish, and launch a campaign The smallest useful content has `schemaVersion: 2`, a locale, and one response element with a stable UUID and unique `submissionKey`. Elements include text, input, select, multiselect, checkbox, file, table, image, video, download, appointment, dividers, pages, and card layouts. Conditional visibility, dynamic options, file limits, numeric constraints, and presentation details are described in the form content schema. Use `GET /v1/schemas/form` for machine-readable draft and published structural schemas, then `POST /v1/forms/validate` to check publication constraints that JSON Schema alone cannot express, including duplicate field keys, references, and conditional rules. Keep `content.elements` flat and ordered. A `section` adds a heading and optional description; following questions stay at the same level. A `card` groups the consecutive elements immediately after it: set each member's `containerId` to the card's `id`. Cards need at least one member, cannot nest, and end at the next element without that `containerId`. Use `pageBreak` for a new page. `POST /v1/forms/validate` returns HTTP 200 with `{valid,issues}` even for invalid form content (`valid:false`). HTTP 422 indicates an invalid outer request envelope. The following commands use `jq` to retain returned identifiers; install it in your client environment if needed. ```sh cat > workshop-form.json <<'JSON' { "name": "Workshop registration", "description": "Register for the January community workshop.", "folderId": null, "tagIds": [], "content": { "schemaVersion": 2, "locale": "en", "elements": [{ "id": "017b67cb-a065-4f38-9ea3-bfe9b1f20191", "type": "input", "inputType": "text", "submissionKey": "full_name", "label": "Your full name", "required": true, "placeholder": "Alex Morgan" }] } } JSON FORM=$(curl --fail-with-body -X POST "$BASE_URL/v1/forms" \ -H "Authorization: Bearer $POLLENFORMS_API_KEY" \ -H 'Content-Type: application/json' --data-binary @workshop-form.json) FORM_ID=$(printf '%s' "$FORM" | jq -r .id) jq '{content}' workshop-form.json | \ curl --fail-with-body -X POST "$BASE_URL/v1/forms/validate" \ -H "Authorization: Bearer $POLLENFORMS_API_KEY" \ -H 'Content-Type: application/json' --data-binary @- VERSION=$(curl --fail-with-body -X POST "$BASE_URL/v1/forms/$FORM_ID/publish" \ -H "Authorization: Bearer $POLLENFORMS_API_KEY") VERSION_ID=$(printf '%s' "$VERSION" | jq -r .id) jq -n --arg template "$FORM_ID" --arg version "$VERSION_ID" \ '{name:"January workshop",formTemplateId:$template,formVersionId:$version, audience:{type:"public"},startActive:true, destinations:[{type:"email",address:"organizer@example.org"}]}' | \ curl --fail-with-body -X POST "$BASE_URL/v1/campaigns" \ -H "Authorization: Bearer $POLLENFORMS_API_KEY" \ -H 'Content-Type: application/json' --data-binary @- > workshop-campaign.json CAMPAIGN_ID=$(jq -r .id workshop-campaign.json) ``` Creating a form returns 201. API-key callers can send an optional `Idempotency-Key` (1–200 visible ASCII characters) to `POST /v1/forms` and `POST /v1/campaigns`: an identical committed command returns 200 with `Idempotency-Replayed: true`; reusing that key with different normalized input returns 409 `idempotency_conflict`. Deduplication is scoped to the same key, operation, and organization. Keep the original API key for retries; campaign replay does not repeat one-time destination secrets. Publishing returns `{id,number,publishedAt,alreadyPublished}` with optional `workflowSyncPending`; a new version returns 201, and an already current publication returns 200. Campaign creation returns its `id`, `state`, and `publicUrl` (and may include integration-specific fields). Share the returned public URL; do not construct or guess a signed campaign token. Public campaigns can use a stable public slug. Starting a campaign can fail if its draft has not been published or its destinations are incompatible. ## Drafts, versions, history, and concurrent editing Use `GET /v1/forms?limit=50&search=Workshop` to page through active templates; the returned `{items,nextCursor}` uses a UUID cursor in descending ID order. `folderId` filters one folder. `GET /v1/library` returns the folder/form/tag library with ordering information. `GET /v1/forms/:id` returns the current editable form, including `content`, `draftRevision`, publication state, attribution, and any managed-workflow relationship. Before saving, read the latest form and send its `draftRevision` as `baseRevision`: ```json { "baseRevision": 1, "name": "Workshop registration", "description": "Register for the January community workshop.", "content": { "schemaVersion": 2, "locale": "en", "elements": [ { "id": "017b67cb-a065-4f38-9ea3-bfe9b1f20191", "type": "input", "inputType": "text", "submissionKey": "full_name", "label": "Your full name", "required": true } ] } } ``` Send that object to `PUT /v1/forms/:id/draft`. A successful response includes `revision`, `valid`, `issues`, `publishedUpToDate`, and attribution. A stale `baseRevision` returns 409; reload and merge deliberately instead of overwriting another change. A valid edit to an already published form can update publication automatically; inspect the response. Invalid drafts can be stored but cannot be published. Managed response forms can prohibit ordinary template changes. A live interactive editing lease returns 423 to a conflicting write. API keys cannot acquire or take over browser leases. Wait for the editor to finish or the lease to expire. Do not synthesize `X-Pollen-Edit-Session` to bypass ownership. Interactive lease endpoints are separately documented as human-only. `GET /v1/forms/:id/versions?limit=50&before=4` lists immutable published versions with `{items,nextCursor}`; pass a numeric `nextCursor` as `before`. `GET /v1/forms/:id/versions/:versionId` reads one version. Edit history is separate: `GET /v1/forms/:id/history?before=12` returns history entries, undo/redo availability, and a numeric cursor. `GET /v1/forms/:id/history/:snapshotId` reads a safe history snapshot. `POST /v1/forms/:id/history/:operation` accepts `undo`, `redo`, or `restore`, always with the current `baseRevision`; `restore` additionally needs `snapshotId`. ## Campaign settings, audiences, state, and outputs Read `GET /v1/campaigns/:id` for campaign metadata and `GET /v1/campaigns/:id/settings` for configurable settings and their revision hash. Send changed settings to `PATCH /v1/campaigns/:id`, including `expectedRevision` from that settings read to detect concurrent changes. Audiences are `{type:"public"}`, `{type:"organization"}`, or `{type:"selected_users",userIds:[...]}`. Use `/v1/audience-users` for authorized audience lookup. Changing an audience never transfers response ownership. Availability settings include `deadline` (ISO timestamp or null), `maxSubmissions` (positive integer or null), `oncePerIp`, and `staticForm`. Static forms cannot also have a deadline, submission limit, or IP restriction. Ended campaigns restrict further edits. Workflow-managed response requests keep availability/audience under their waiting workflow; attempts to change protected settings return 409. `POST /v1/campaigns/:id/state` accepts `{state:"active"}`, `{state:"paused"}`, or `{state:"ended"}`. `/form-update`, `/use-latest-form`, `/ignore-form-version`, `/auto-update-form`, and `/form-update-policy` expose form-version assessment and update policy. Preserve immutable response schemas when updating a live campaign. `/v1/forms/:id/campaigns` shows form usage. `GET/POST /v1/campaigns/:id/outputs` and `PATCH/DELETE /v1/campaigns/:id/outputs/:outputId` manage HTTP outputs. Output configuration includes an HTTPS URL, method, payload format, and optional supported authentication. Creating an output returns its signing secret once; store it privately and verify webhook signatures at your receiver. Read endpoints redact credential values. `POST …/:outputId/test` sends a real sample request to the configured destination; treat it as an external side effect. Delivery history and retry routes expose delivery state and attempts; retrying can send a request again, so receivers must deduplicate. ## Read responses and download files ```sh curl --fail-with-body "$BASE_URL/v1/campaigns/$CAMPAIGN_ID/responses?limit=50" \ -H "Authorization: Bearer $POLLENFORMS_API_KEY" ``` The response is `{items:[…],nextCursor:null|string}`. Each item explicitly contains `id`, `campaignId`, `formVersionId`, `values`, `submittedByUserId`, `acceptedAt`, `createdAt`, `updatedAt`, `createdBy`, and `updatedBy`. `values` keys are the immutable form's submission keys; values can be strings, numbers, booleans, arrays, file descriptors, table rows, or appointment values according to the form schema. Results do not expose IP hashes or submission idempotency keys. The response cursor is opaque base64url JSON containing `{acceptedAt,id}`. Pass `nextCursor` unchanged and URL-encode it as a query parameter. Pages are ordered by accepted time and ID descending; page size is 1–100 (default 50). Continue until `nextCursor` is null. Clients needing a stable report should retain the first page's cutoff time and deduplicate IDs if new responses arrive during pagination. `GET /v1/campaigns/:id/responses/:responseId` adds immutable field definitions, sanitized delivery summaries, and `fileIds`. For each file use `GET /v1/campaigns/:id/responses/:responseId/files/:assetId` to obtain `{url}`. Download from that short-lived signed URL and keep it private. Its presence in one response is verified; an arbitrary asset ID is not sufficient. The campaign dashboard is also available but dedicated response endpoints are preferable for integrations. `GET /v1/campaigns/:id/responses/export?format=json|csv|xlsx&limit=100&cursor=…` exports one page, not the entire campaign. JSON uses the same page envelope. CSV and XLSX are downloadable files and return `x-next-cursor` when more pages remain. CSV cells are escaped to prevent spreadsheet formulas; XLSX stores strings as typed strings. Continue page by page for a complete export. ## Respondent flow, idempotency, and uploads Respondent routes under `/v1/public` are distinct from organization management routes. A public audience does not need an organization key. Organization and selected-user campaigns require the respondent's interactive identity; management keys do not bypass audience checks or authorize a chosen user's identity. Signed links, campaign state, deadlines, rate limits, and submission/file rules remain enforced. Open `GET /v1/public/campaigns/:token` using the token or slug from the shared link. Preserve its `formSession` and immutable form version. Send `X-Pollen-Form-Session` on subsequent campaign operations to retain the same form revision. Protected media uses a short-lived session cookie obtained from its media-session endpoint; preserve cookies in your HTTP client. Do not treat a signed form-session receipt as an organization access token. ```sh # TOKEN is taken from the real returned public link, never guessed. OPENING=$(curl --fail-with-body "$BASE_URL/v1/public/campaigns/$TOKEN") FORM_SESSION=$(printf '%s' "$OPENING" | jq -r .formSession) curl --fail-with-body -X POST "$BASE_URL/v1/public/campaigns/$TOKEN/submissions" \ -H 'Content-Type: application/json' \ -H "X-Pollen-Form-Session: $FORM_SESSION" \ -H 'Idempotency-Key: workshop-registration-alex-2027-01' \ --data '{"values":{"full_name":"Alex Morgan"}}' ``` Generate an `Idempotency-Key` of 8–200 characters once per logical respondent submission. After a lost response, retry the same submission with the same key; do not generate a fresh key. A successful submission returns 201 with `id`, `status`, and `acceptedAt`. Partial responses have separate create/read/update/lookup/delete operations; retain their IDs and use the corresponding session/identity checks. They are drafts, not accepted submissions. Uploads use an intent/PUT/complete sequence. Management uploads start at `POST /v1/assets/upload-intents`; respondent uploads use `POST /v1/public/campaigns/:token/assets/upload-intents`. Send `{kind,filename,mediaType,sizeBytes}`. Use the returned `uploadUrl`, `method`, and exact required headers to PUT bytes directly to storage, then call the matching `/:id/complete` endpoint. Do not send the PollenForms bearer token to the signed storage URL. Wait for the asset to become ready before using its ID in form content or response file values. Upload grants expire; file kind, type, count, quota, and maximum size are validated. File values use `{fileId,filename,mediaType,size}`. Some file preprocessing is asynchronous. ## Library, trash, branding, data sources, and bookings Folders and forms support rename, move, tagging, soft deletion, and restoration. Move requests send `parentId` (folders) or `folderId` (forms), including null for the top level, and a zero-based `position`. Preserve the old parent and ordering if implementing an Undo action. Folder deletion can include `expectedContents` containing `folderIds` and `formIds` to detect a stale subtree. `/v1/trash` lists deleted items. Restores preserve deletion-batch membership; children may move to the top level if their original parent is unavailable. Name and managed-integration conflicts return 409. Ordinary deletion does not permanently erase retained product data. `/v1/color-schemes`, `/v1/style-defaults`, and `/v1/forms/:id/style` expose custom palettes, organization defaults, and form overrides. Form overrides change colors; organization branding belongs to organization defaults and uses the stricter admin capability described above. Reuse managed logo assets or safe HTTPS branding URLs. `/v1/data-connections` lists or creates Nextcloud WebDAV connections; credential values are write-only. `/v1/data-connections/:id/files?path=…` lists source files. Form data automations use `/v1/forms/:formId/data-automations`: preview a mapping, inspect its proposal, confirm it with the returned proposal ID, enable/disable it, run it, or soft-delete it. Confirm only after reviewing target fields and mapping semantics. Preview/confirmation and scheduled runs validate source formats, field mappings, revisions, and overlapping targets. AuraFlow-managed secret sources require independent AuraFlow authorization and appropriate process access; no endpoint returns the stored secret itself. `/v1/bookings` manages booking pages, resources (people or places), slots, and appointment lists. Slot times are ISO timestamps and the booking page carries its IANA time zone, horizon, and optional weekly limit. Public booking endpoints read published availability and create appointments. A competing reservation, an expired slot, or a weekly limit can return 409. Creating an appointment can send confirmation email; do not blindly retry it after an ambiguous network failure. ## Error handling and safe retries Errors preserve `{error,details?}` and add `code` and `requestId` where available. The response `x-request-id` is the correlation identifier. HTTP 422 has two validation detail shapes: - Request/schema validation uses `details:{issues:[{code,path,message,…}]}`. For example, `POST /v1/forms` with an empty name returns: ```json { "error": "Request validation failed", "code": "validation_error", "requestId": "req_example", "details": { "issues": [ { "code": "too_small", "path": ["name"], "message": "Too small: expected string to have >=1 characters" } ] } } ``` - Respondent field validation uses `details:[{submissionKey,message}]` on `POST /v1/public/campaigns/:token/submissions` and partial-response create/update endpoints. For example, a missing required answer returns: ```json { "error": "Submission validation failed", "code": "validation_error", "requestId": "req_example", "details": [ { "submissionKey": "full_name", "message": "This field is required" } ] } ``` Respondent endpoints can also return the first shape for an invalid request envelope. Check `Array.isArray(details)` before reading `details.issues`; map respondent errors by `submissionKey` and schema issues by `path`. Some 422 errors omit `details`. Other structured details can include required scopes, lease holders, or integration failure context. Never rely on matching human error text; the examples' messages are illustrative. Common statuses are 400 malformed input, 401 authentication failure, 403 insufficient scopes/role/independent authorization, 404 missing or inaccessible resource, 409 revision/state conflict, 410 expired resource or link, 413 size limit, 415 media type, 416 invalid media range, 422 validation, 423 editing lease, 429 rate limit, and 500/502/503/504 server or dependency failure. The reference lists operation-specific success bodies, 204 empty responses, redirects, binary downloads, and applicable failures. Some upstream failures are translated into safe API errors. A 200 AI stream may itself contain a terminal error event; inspect the event stream. Retry GETs with bounded exponential backoff and jitter for transient network or 5xx failures. Respect `Retry-After` on 429. Do not retry 401/403 until credentials or access change, 422 until input changes, or 409/423 until you reconcile current state. Publish, move, webhook test, delivery retry, and booking requests do not promise universal idempotency. Form/campaign creation is deduplicated only when an API-key caller supplies the documented command idempotency header. After an ambiguous write, read the resulting state before retrying. Only documented submission idempotency and specific integration contracts offer their stated deduplication guarantees. ## MCP: stateless Streamable HTTP Connect an MCP-compatible client to `https:///v1/mcp` using `Authorization: Bearer `. Use a client that supports Streamable HTTP. The transport is stateless: send each JSON-RPC request in a new HTTP POST; no persistent `Mcp-Session-Id` or SSE session is required. GET/DELETE session transport is not supported. Send both `application/json` and `text/event-stream` in the Accept header for protocol compatibility. Negotiate the protocol version with `initialize`, then call `tools/list` and `tools/call` according to the returned capability contract. Tool availability follows the key's current scopes and the same registered API operation inventory; transport access does not expand permissions. ```json { "mcpServers": { "pollenforms": { "url": "https://forms.example.org/v1/mcp", "headers": { "Authorization": "Bearer ${POLLENFORMS_API_KEY}" } } } } ``` Client configuration syntax and environment interpolation vary: use your client's private credential fields when available. For AuraFlow operations, add independent AuraFlow credentials as HTTP headers, never JSON-RPC tool arguments. Do not configure service-only integration endpoints as general agent tools. Inspect the current `tools/list` result instead of assuming fixed tool names. Use the OpenAPI schemas and examples for exact operation arguments, read before writing, and retain returned revisions and IDs. ### Carry a form receipt between stateless MCP calls `call_operation` accepts optional `formSession` (1–16,384 characters). Copy the signed `formSession` returned by the public form-opening operation into each subsequent relevant call; MCP forwards it as `X-Pollen-Form-Session`. This preserves the displayed immutable form version across reads, uploads, saved progress, and submission without storing a server-side MCP session. The receipt does not authenticate a respondent or bypass campaign audience restrictions. Identity-bound campaigns require an interactive respondent identity; an organization API key cannot stand in for that identity. Anonymous public campaigns retain their public submission flow. After opening an anonymous public campaign, a submission tool call has this shape (replace the example slug and receipt with the returned values): ```json { "jsonrpc": "2.0", "id": 2, "method": "tools/call", "params": { "name": "call_operation", "arguments": { "operationId": "post_v1_public_campaigns_by_token_submissions", "path": { "token": "january-workshop" }, "formSession": "", "idempotencyKey": "workshop-registration-alex-2027-01", "body": { "values": { "full_name": "Alex Morgan" } } } } } ``` ### Send audio through MCP Transcription calls accept `audio:{contentType,base64}` instead of `body`. `audio` is permitted only for POST transcription operations, uses a supported `audio/*` media type, and must contain canonical base64 with no whitespace. The decoded audio limit is 12 MB; the MCP HTTP body limit also accounts for base64 expansion. `audio` and JSON `body` are mutually exclusive. Other binary uploads keep their documented intent/PUT/complete REST flow. MCP does not accept arbitrary per-call headers. This example encodes a real local recording and sends it to the management transcription operation after protocol initialization: ```sh AUDIO_BASE64=$(base64 < recording.wav | tr -d '\n') jq -n --arg audio "$AUDIO_BASE64" '{ jsonrpc:"2.0",id:3,method:"tools/call", params:{name:"call_operation",arguments:{ operationId:"post_v1_ai_transcriptions", audio:{contentType:"audio/wav",base64:$audio} }} }' | curl --fail-with-body -X POST "$BASE_URL/v1/mcp" \ -H "Authorization: Bearer $POLLENFORMS_API_KEY" \ -H 'Content-Type: application/json' \ -H 'Accept: application/json, text/event-stream' \ --data-binary @- ``` For respondent transcription, choose its advertised operation ID, supply its campaign `path` parameters, and carry `formSession` when continuing an opened form. Independent AuraFlow authorization still belongs in connection transport headers; neither an audio payload nor a form receipt substitutes for it. Binary export results such as XLSX use `bodyEncoding:"base64"` with a base64 `body`; decode that body to bytes before saving the file. ## Protected integration and administration reference `/v1/integrations/auraflow/*` documents the existing managed-form, immutable version discovery, intake preparation/completion, correlation reconciliation, email-response, trigger-attempt, user-sync, and integration-file contracts. These require their explicitly configured AuraFlow service identity and organization headers; ordinary API keys cannot call them. Preparation contracts may return one-time integration secrets; treat those as confidential and never expose them in agent prompts. Documentation contains placeholders only. `/v1/api-keys`, `/v1/superadmin/*`, interactive edit leases, support access, and operational diagnostics have their own human/service/monitoring guards. Their appearance in a public reference does not make them API-key capabilities. Public readiness and metrics diagnostics are operational endpoints rather than product data APIs. ## Keeping this reference accurate Install `registerApiDocumentation(app, config)` before routes so Fastify's `onRoute` hook captures the real inventory. Input schemas come from the same Zod expressions used by handlers; output schemas derive from TypeScript's inferred handler return types, with explicit overrides for streams, binary formats, dynamic form values, and safe output metadata. Schemas describe wire JSON, so Date fields are ISO strings. JSON Schema cannot represent every refinement or cross-field rule; runtime validation remains authoritative. After changing a route or contract, run `node scripts/generate-api-documentation.mjs`, then `node scripts/generate-api-documentation.mjs --check`. The OpenAPI `x-documentation-coverage` field and `getApiDocumentationCoverage(app)` report registered routes missing generated definitions. Tests check the real route inventory, critical request examples, schema references, private-route authentication, and special content types. Required checks must pass before release. ## Registered operations POST /v1/ai/forms/events — Create or run ai / forms / events Organization-scoped API operation. Required granular scopes: forms:write. Resource ownership and organization roles are also enforced. Legacy read/write scope behavior is described in the guide. POST /v1/ai/forms/generate — Create or run ai / forms / generate Organization-scoped API operation. Required granular scopes: forms:write. Resource ownership and organization roles are also enforced. Legacy read/write scope behavior is described in the guide. For advanced field types, conditions, tables, and layouts, fetch [GET /v1/schemas/form](/v1/schemas/form). In MCP, describe_operation then call_operation with operationId get_v1_schemas_form. Draft and published structural schemas are returned; referenced definitions also accompany this operation description. Use POST /v1/forms/validate for publication constraints beyond JSON Schema. POST /v1/ai/transcriptions — Create or run ai / transcriptions Organization-scoped API operation. Required granular scopes: forms:write. Resource ownership and organization roles are also enforced. Legacy read/write scope behavior is described in the guide. Upload raw audio bytes, not JSON or multipart data. Use a supported audio Content-Type. Transcription budgets and size limits apply. GET /v1/api-keys — List api keys Interactive human access is required. Ordinary API keys are not accepted; the account's organization role and permissions still apply. POST /v1/api-keys — Create or run api keys Interactive human access is required. Ordinary API keys are not accepted; the account's organization role and permissions still apply. DELETE /v1/api-keys/:id — Soft-delete api keys Interactive human access is required. Ordinary API keys are not accepted; the account's organization role and permissions still apply. DELETE /v1/assets/:id — Soft-delete assets Organization-scoped API operation. Required granular scopes: assets:write. Resource ownership and organization roles are also enforced. Legacy read/write scope behavior is described in the guide. GET /v1/assets/:id — Read assets Organization-scoped API operation. Required granular scopes: assets:read. Resource ownership and organization roles are also enforced. Legacy read/write scope behavior is described in the guide. POST /v1/assets/:id/complete — Create or run assets / complete Organization-scoped API operation. Required granular scopes: assets:write. Resource ownership and organization roles are also enforced. Legacy read/write scope behavior is described in the guide. GET /v1/assets/:id/url — List assets / url Organization-scoped API operation. Required granular scopes: assets:read. Resource ownership and organization roles are also enforced. Legacy read/write scope behavior is described in the guide. POST /v1/assets/upload-intents — Create or run assets / upload intents Organization-scoped API operation. Required granular scopes: assets:write. Resource ownership and organization roles are also enforced. Legacy read/write scope behavior is described in the guide. GET /v1/audience-users — Find users for a selected-user campaign audience Organization-scoped API operation. Required granular scopes: campaigns:read. Resource ownership and organization roles are also enforced. Legacy read/write scope behavior is described in the guide. Calls that read or mutate AuraFlow also require X-AuraFlow-Authorization: Bearer (and, when required by your login, X-Zitadel-Id-Token). The server verifies the same approved user and organization and enforces AuraFlow process ACLs. It never forwards the PollenForms key upstream. Missing authorization returns 403 auraflow_authorization_required; identity mismatch returns 403 auraflow_identity_mismatch. Configure these as MCP transport headers, never tool arguments. An admin-owned key and independent AuraFlow session are required in production. GET /v1/bookings — List bookings Organization-scoped API operation. Required granular scopes: bookings:read. Resource ownership and organization roles are also enforced. Legacy read/write scope behavior is described in the guide. POST /v1/bookings — Create or run bookings Organization-scoped API operation. Required granular scopes: bookings:write. Resource ownership and organization roles are also enforced. Legacy read/write scope behavior is described in the guide. DELETE /v1/bookings/:id — Soft-delete bookings Organization-scoped API operation. Required granular scopes: bookings:write. Resource ownership and organization roles are also enforced. Legacy read/write scope behavior is described in the guide. GET /v1/bookings/:id — Read bookings Organization-scoped API operation. Required granular scopes: bookings:read. Resource ownership and organization roles are also enforced. Legacy read/write scope behavior is described in the guide. PATCH /v1/bookings/:id — Update bookings Organization-scoped API operation. Required granular scopes: bookings:write. Resource ownership and organization roles are also enforced. Legacy read/write scope behavior is described in the guide. GET /v1/bookings/:id/appointments — List bookings / appointments Organization-scoped API operation. Required granular scopes: bookings:read, responses:read. Resource ownership and organization roles are also enforced. Legacy read/write scope behavior is described in the guide. POST /v1/bookings/:id/resources — Create or run bookings / resources Organization-scoped API operation. Required granular scopes: bookings:write. Resource ownership and organization roles are also enforced. Legacy read/write scope behavior is described in the guide. DELETE /v1/bookings/:id/resources/:resourceId — Soft-delete bookings / resources Organization-scoped API operation. Required granular scopes: bookings:write. Resource ownership and organization roles are also enforced. Legacy read/write scope behavior is described in the guide. PATCH /v1/bookings/:id/slots — Update bookings / slots Organization-scoped API operation. Required granular scopes: bookings:write. Resource ownership and organization roles are also enforced. Legacy read/write scope behavior is described in the guide. POST /v1/bookings/:id/slots — Create or run bookings / slots Organization-scoped API operation. Required granular scopes: bookings:write. Resource ownership and organization roles are also enforced. Legacy read/write scope behavior is described in the guide. DELETE /v1/bookings/:id/slots/:slotId — Soft-delete bookings / slots Organization-scoped API operation. Required granular scopes: bookings:write. Resource ownership and organization roles are also enforced. Legacy read/write scope behavior is described in the guide. GET /v1/campaigns — List campaigns Organization-scoped API operation. Required granular scopes: campaigns:read. Resource ownership and organization roles are also enforced. Legacy read/write scope behavior is described in the guide. POST /v1/campaigns — Create or run campaigns Organization-scoped API operation. Required granular scopes: campaigns:write. Resource ownership and organization roles are also enforced. Legacy read/write scope behavior is described in the guide. API-key callers can send Idempotency-Key (1–200 visible ASCII characters) to deduplicate creation. First creation returns 201; an identical replay returns 200. The same key with changed normalized input returns 409 idempotency_conflict. Deduplication is scoped to key, operation, and organization; preserve the same API key for retries. One-time destination secrets are not repeated on campaign replay. GET /v1/campaigns/:campaignId/deliveries/:deliveryId/attempts — List campaigns / deliveries / attempts Organization-scoped API operation. Required granular scopes: responses:read. Resource ownership and organization roles are also enforced. Legacy read/write scope behavior is described in the guide. POST /v1/campaigns/:campaignId/deliveries/:deliveryId/retry — Create or run campaigns / deliveries / retry Organization-scoped API operation. Required granular scopes: responses:write. Resource ownership and organization roles are also enforced. Legacy read/write scope behavior is described in the guide. Active interactive editing leases can reject writes with HTTP 423. Refresh the resource after HTTP 409 before applying a deliberate merged change. GET /v1/campaigns/:id — Read campaigns Organization-scoped API operation. Required granular scopes: campaigns:read. Resource ownership and organization roles are also enforced. Legacy read/write scope behavior is described in the guide. PATCH /v1/campaigns/:id — Update campaigns Organization-scoped API operation. Required granular scopes: campaigns:write. Resource ownership and organization roles are also enforced. Legacy read/write scope behavior is described in the guide. Active interactive editing leases can reject writes with HTTP 423. Refresh the resource after HTTP 409 before applying a deliberate merged change. POST /v1/campaigns/:id/auto-update-form — Create or run campaigns / auto update form Organization-scoped API operation. Required granular scopes: campaigns:write. Resource ownership and organization roles are also enforced. Legacy read/write scope behavior is described in the guide. Active interactive editing leases can reject writes with HTTP 423. Refresh the resource after HTTP 409 before applying a deliberate merged change. GET /v1/campaigns/:id/dashboard — List campaigns / dashboard Organization-scoped API operation. Required granular scopes: responses:read. Resource ownership and organization roles are also enforced. Legacy read/write scope behavior is described in the guide. POST /v1/campaigns/:id/edit-lock/acquire — Create or run campaigns / edit lock / acquire Interactive human access is required. Ordinary API keys are not accepted; the account's organization role and permissions still apply. Active interactive editing leases can reject writes with HTTP 423. Refresh the resource after HTTP 409 before applying a deliberate merged change. POST /v1/campaigns/:id/edit-lock/release — Create or run campaigns / edit lock / release Interactive human access is required. Ordinary API keys are not accepted; the account's organization role and permissions still apply. Active interactive editing leases can reject writes with HTTP 423. Refresh the resource after HTTP 409 before applying a deliberate merged change. POST /v1/campaigns/:id/edit-lock/renew — Create or run campaigns / edit lock / renew Interactive human access is required. Ordinary API keys are not accepted; the account's organization role and permissions still apply. Active interactive editing leases can reject writes with HTTP 423. Refresh the resource after HTTP 409 before applying a deliberate merged change. GET /v1/campaigns/:id/form-update — List campaigns / form update Organization-scoped API operation. Required granular scopes: campaigns:read. Resource ownership and organization roles are also enforced. Legacy read/write scope behavior is described in the guide. PATCH /v1/campaigns/:id/form-update-policy — Update campaigns / form update policy Organization-scoped API operation. Required granular scopes: campaigns:write. Resource ownership and organization roles are also enforced. Legacy read/write scope behavior is described in the guide. Active interactive editing leases can reject writes with HTTP 423. Refresh the resource after HTTP 409 before applying a deliberate merged change. POST /v1/campaigns/:id/ignore-form-version — Create or run campaigns / ignore form version Organization-scoped API operation. Required granular scopes: campaigns:write. Resource ownership and organization roles are also enforced. Legacy read/write scope behavior is described in the guide. Active interactive editing leases can reject writes with HTTP 423. Refresh the resource after HTTP 409 before applying a deliberate merged change. GET /v1/campaigns/:id/outputs — List campaigns / outputs Organization-scoped API operation. Required granular scopes: campaigns:read. Resource ownership and organization roles are also enforced. Legacy read/write scope behavior is described in the guide. HTTP outputs redact authentication values. A newly created signing secret is returned once; store it securely. Test sends a real external request; do not blindly retry after a timeout. POST /v1/campaigns/:id/outputs — Create or run campaigns / outputs Organization-scoped API operation. Required granular scopes: campaigns:write. Resource ownership and organization roles are also enforced. Legacy read/write scope behavior is described in the guide. Active interactive editing leases can reject writes with HTTP 423. Refresh the resource after HTTP 409 before applying a deliberate merged change. HTTP outputs redact authentication values. A newly created signing secret is returned once; store it securely. Test sends a real external request; do not blindly retry after a timeout. DELETE /v1/campaigns/:id/outputs/:outputId — Soft-delete campaigns / outputs Organization-scoped API operation. Required granular scopes: campaigns:write. Resource ownership and organization roles are also enforced. Legacy read/write scope behavior is described in the guide. Active interactive editing leases can reject writes with HTTP 423. Refresh the resource after HTTP 409 before applying a deliberate merged change. HTTP outputs redact authentication values. A newly created signing secret is returned once; store it securely. Test sends a real external request; do not blindly retry after a timeout. PATCH /v1/campaigns/:id/outputs/:outputId — Update campaigns / outputs Organization-scoped API operation. Required granular scopes: campaigns:write. Resource ownership and organization roles are also enforced. Legacy read/write scope behavior is described in the guide. Active interactive editing leases can reject writes with HTTP 423. Refresh the resource after HTTP 409 before applying a deliberate merged change. HTTP outputs redact authentication values. A newly created signing secret is returned once; store it securely. Test sends a real external request; do not blindly retry after a timeout. POST /v1/campaigns/:id/outputs/:outputId/test — Create or run campaigns / outputs / test Organization-scoped API operation. Required granular scopes: campaigns:write. Resource ownership and organization roles are also enforced. Legacy read/write scope behavior is described in the guide. Active interactive editing leases can reject writes with HTTP 423. Refresh the resource after HTTP 409 before applying a deliberate merged change. HTTP outputs redact authentication values. A newly created signing secret is returned once; store it securely. Test sends a real external request; do not blindly retry after a timeout. GET /v1/campaigns/:id/responses — Read a page of accepted responses Organization-scoped API operation. Required granular scopes: responses:read. Resource ownership and organization roles are also enforced. Legacy read/write scope behavior is described in the guide. Responses use immutable submission keys from formVersionId. Soft-deleted responses are excluded. No IP hash or idempotency key is exposed. List pages use an opaque base64url {acceptedAt,id} cursor, descending by acceptedAt and id; limit is 1–100 (default 50). GET /v1/campaigns/:id/responses/:responseId — Read one response and sanitized deliveries Organization-scoped API operation. Required granular scopes: responses:read. Resource ownership and organization roles are also enforced. Legacy read/write scope behavior is described in the guide. Responses use immutable submission keys from formVersionId. Soft-deleted responses are excluded. No IP hash or idempotency key is exposed. List pages use an opaque base64url {acceptedAt,id} cursor, descending by acceptedAt and id; limit is 1–100 (default 50). GET /v1/campaigns/:id/responses/:responseId/files/:assetId — Get a signed download URL for a response file Organization-scoped API operation. Required granular scopes: responses:read. Resource ownership and organization roles are also enforced. Legacy read/write scope behavior is described in the guide. Responses use immutable submission keys from formVersionId. Soft-deleted responses are excluded. No IP hash or idempotency key is exposed. List pages use an opaque base64url {acceptedAt,id} cursor, descending by acceptedAt and id; limit is 1–100 (default 50). GET /v1/campaigns/:id/responses/export — Export one response page as JSON or CSV Organization-scoped API operation. Required granular scopes: responses:read. Resource ownership and organization roles are also enforced. Legacy read/write scope behavior is described in the guide. Responses use immutable submission keys from formVersionId. Soft-deleted responses are excluded. No IP hash or idempotency key is exposed. List pages use an opaque base64url {acceptedAt,id} cursor, descending by acceptedAt and id; limit is 1–100 (default 50). format=json|csv|xlsx exports one page. CSV escapes spreadsheet formulas and XLSX uses typed string cells. Accumulate pages for a complete export. GET /v1/campaigns/:id/settings — List campaigns / settings Organization-scoped API operation. Required granular scopes: campaigns:read. Resource ownership and organization roles are also enforced. Legacy read/write scope behavior is described in the guide. POST /v1/campaigns/:id/state — Create or run campaigns / state Organization-scoped API operation. Required granular scopes: campaigns:write. Resource ownership and organization roles are also enforced. Legacy read/write scope behavior is described in the guide. Active interactive editing leases can reject writes with HTTP 423. Refresh the resource after HTTP 409 before applying a deliberate merged change. PUT /v1/campaigns/:id/tags — Replace campaigns / tags Organization-scoped API operation. Required granular scopes: campaigns:write. Resource ownership and organization roles are also enforced. Legacy read/write scope behavior is described in the guide. Active interactive editing leases can reject writes with HTTP 423. Refresh the resource after HTTP 409 before applying a deliberate merged change. POST /v1/campaigns/:id/use-latest-form — Create or run campaigns / use latest form Organization-scoped API operation. Required granular scopes: campaigns:write. Resource ownership and organization roles are also enforced. Legacy read/write scope behavior is described in the guide. Active interactive editing leases can reject writes with HTTP 423. Refresh the resource after HTTP 409 before applying a deliberate merged change. GET /v1/campaigns/:id/workflow-connections — List campaigns / workflow connections Organization-scoped API operation. Required granular scopes: campaigns:read. Resource ownership and organization roles are also enforced. Legacy read/write scope behavior is described in the guide. Calls that read or mutate AuraFlow also require X-AuraFlow-Authorization: Bearer (and, when required by your login, X-Zitadel-Id-Token). The server verifies the same approved user and organization and enforces AuraFlow process ACLs. It never forwards the PollenForms key upstream. Missing authorization returns 403 auraflow_authorization_required; identity mismatch returns 403 auraflow_identity_mismatch. Configure these as MCP transport headers, never tool arguments. POST /v1/campaigns/:id/workflow-connections/:connectionId/retry — Create or run campaigns / workflow connections / retry Organization-scoped API operation. Required granular scopes: campaigns:write. Resource ownership and organization roles are also enforced. Legacy read/write scope behavior is described in the guide. Calls that read or mutate AuraFlow also require X-AuraFlow-Authorization: Bearer (and, when required by your login, X-Zitadel-Id-Token). The server verifies the same approved user and organization and enforces AuraFlow process ACLs. It never forwards the PollenForms key upstream. Missing authorization returns 403 auraflow_authorization_required; identity mismatch returns 403 auraflow_identity_mismatch. Configure these as MCP transport headers, never tool arguments. Active interactive editing leases can reject writes with HTTP 423. Refresh the resource after HTTP 409 before applying a deliberate merged change. POST /v1/campaigns/:id/workflow-connections/:connectionId/state — Create or run campaigns / workflow connections / state Organization-scoped API operation. Required granular scopes: campaigns:write. Resource ownership and organization roles are also enforced. Legacy read/write scope behavior is described in the guide. Calls that read or mutate AuraFlow also require X-AuraFlow-Authorization: Bearer (and, when required by your login, X-Zitadel-Id-Token). The server verifies the same approved user and organization and enforces AuraFlow process ACLs. It never forwards the PollenForms key upstream. Missing authorization returns 403 auraflow_authorization_required; identity mismatch returns 403 auraflow_identity_mismatch. Configure these as MCP transport headers, never tool arguments. Active interactive editing leases can reject writes with HTTP 423. Refresh the resource after HTTP 409 before applying a deliberate merged change. POST /v1/campaigns/:id/workflow-destinations — Create or run campaigns / workflow destinations Organization-scoped API operation. Required granular scopes: campaigns:write. Resource ownership and organization roles are also enforced. Legacy read/write scope behavior is described in the guide. Calls that read or mutate AuraFlow also require X-AuraFlow-Authorization: Bearer (and, when required by your login, X-Zitadel-Id-Token). The server verifies the same approved user and organization and enforces AuraFlow process ACLs. It never forwards the PollenForms key upstream. Missing authorization returns 403 auraflow_authorization_required; identity mismatch returns 403 auraflow_identity_mismatch. Configure these as MCP transport headers, never tool arguments. Active interactive editing leases can reject writes with HTTP 423. Refresh the resource after HTTP 409 before applying a deliberate merged change. GET /v1/color-schemes — List color schemes Organization-scoped API operation. Required granular scopes: branding:read. Resource ownership and organization roles are also enforced. Legacy read/write scope behavior is described in the guide. POST /v1/color-schemes — Create or run color schemes Organization-scoped API operation. Required granular scopes: branding:write. Resource ownership and organization roles are also enforced. Legacy read/write scope behavior is described in the guide. DELETE /v1/color-schemes/:id — Soft-delete color schemes Organization-scoped API operation. Required granular scopes: branding:write. Resource ownership and organization roles are also enforced. Legacy read/write scope behavior is described in the guide. PUT /v1/color-schemes/:id — Replace color schemes Organization-scoped API operation. Required granular scopes: branding:write. Resource ownership and organization roles are also enforced. Legacy read/write scope behavior is described in the guide. GET /v1/data-connections — List data connections Organization-scoped API operation. Required granular scopes: connections:read. Resource ownership and organization roles are also enforced. Legacy read/write scope behavior is described in the guide. POST /v1/data-connections — Create or run data connections Organization-scoped API operation. Required granular scopes: connections:write. Resource ownership and organization roles are also enforced. Legacy read/write scope behavior is described in the guide. DELETE /v1/data-connections/:id — Soft-delete data connections Organization-scoped API operation. Required granular scopes: connections:write. Resource ownership and organization roles are also enforced. Legacy read/write scope behavior is described in the guide. GET /v1/data-connections/:id/file-preview — List data connections / file preview Organization-scoped API operation. Required granular scopes: connections:read. Resource ownership and organization roles are also enforced. Legacy read/write scope behavior is described in the guide. GET /v1/data-connections/:id/files — List data connections / files Organization-scoped API operation. Required granular scopes: connections:read. Resource ownership and organization roles are also enforced. Legacy read/write scope behavior is described in the guide. GET /v1/data-connections/:id/usages — List data connections / usages Organization-scoped API operation. Required granular scopes: connections:read. Resource ownership and organization roles are also enforced. Legacy read/write scope behavior is described in the guide. POST /v1/data-connections/workflow — Create or run data connections / workflow Organization-scoped API operation. Required granular scopes: connections:write. Resource ownership and organization roles are also enforced. Legacy read/write scope behavior is described in the guide. Calls that read or mutate AuraFlow also require X-AuraFlow-Authorization: Bearer (and, when required by your login, X-Zitadel-Id-Token). The server verifies the same approved user and organization and enforces AuraFlow process ACLs. It never forwards the PollenForms key upstream. Missing authorization returns 403 auraflow_authorization_required; identity mismatch returns 403 auraflow_identity_mismatch. Configure these as MCP transport headers, never tool arguments. GET /v1/data-connections/workflow-processes — List data connections / workflow processes Organization-scoped API operation. Required granular scopes: connections:read. Resource ownership and organization roles are also enforced. Legacy read/write scope behavior is described in the guide. Calls that read or mutate AuraFlow also require X-AuraFlow-Authorization: Bearer (and, when required by your login, X-Zitadel-Id-Token). The server verifies the same approved user and organization and enforces AuraFlow process ACLs. It never forwards the PollenForms key upstream. Missing authorization returns 403 auraflow_authorization_required; identity mismatch returns 403 auraflow_identity_mismatch. Configure these as MCP transport headers, never tool arguments. GET /v1/data-connections/workflow-secrets — List data connections / workflow secrets Organization-scoped API operation. Required granular scopes: connections:read. Resource ownership and organization roles are also enforced. Legacy read/write scope behavior is described in the guide. Calls that read or mutate AuraFlow also require X-AuraFlow-Authorization: Bearer (and, when required by your login, X-Zitadel-Id-Token). The server verifies the same approved user and organization and enforces AuraFlow process ACLs. It never forwards the PollenForms key upstream. Missing authorization returns 403 auraflow_authorization_required; identity mismatch returns 403 auraflow_identity_mismatch. Configure these as MCP transport headers, never tool arguments. POST /v1/folders — Create or run folders Organization-scoped API operation. Required granular scopes: library:write. Resource ownership and organization roles are also enforced. Legacy read/write scope behavior is described in the guide. DELETE /v1/folders/:id — Soft-delete folders Organization-scoped API operation. Required granular scopes: library:write. Resource ownership and organization roles are also enforced. Legacy read/write scope behavior is described in the guide. PATCH /v1/folders/:id — Update folders Organization-scoped API operation. Required granular scopes: library:write. Resource ownership and organization roles are also enforced. Legacy read/write scope behavior is described in the guide. POST /v1/folders/:id/move — Create or run folders / move Organization-scoped API operation. Required granular scopes: library:write. Resource ownership and organization roles are also enforced. Legacy read/write scope behavior is described in the guide. POST /v1/folders/:id/restore — Create or run folders / restore Organization-scoped API operation. Required granular scopes: library:write. Resource ownership and organization roles are also enforced. Legacy read/write scope behavior is described in the guide. GET /v1/forms — List forms Organization-scoped API operation. Required granular scopes: forms:read. Resource ownership and organization roles are also enforced. Legacy read/write scope behavior is described in the guide. POST /v1/forms — Create or run forms Organization-scoped API operation. Required granular scopes: forms:write. Resource ownership and organization roles are also enforced. Legacy read/write scope behavior is described in the guide. For advanced field types, conditions, tables, and layouts, fetch [GET /v1/schemas/form](/v1/schemas/form). In MCP, describe_operation then call_operation with operationId get_v1_schemas_form. Draft and published structural schemas are returned; referenced definitions also accompany this operation description. Use POST /v1/forms/validate for publication constraints beyond JSON Schema. API-key callers can send Idempotency-Key (1–200 visible ASCII characters) to deduplicate creation. First creation returns 201; an identical replay returns 200. The same key with changed normalized input returns 409 idempotency_conflict. Deduplication is scoped to key, operation, and organization; preserve the same API key for retries. One-time destination secrets are not repeated on campaign replay. GET /v1/forms/:formId/data-automations — List forms / data automations Organization-scoped API operation. Required granular scopes: forms:read, connections:read. Resource ownership and organization roles are also enforced. Legacy read/write scope behavior is described in the guide. DELETE /v1/forms/:formId/data-automations/:id — Soft-delete forms / data automations Organization-scoped API operation. Required granular scopes: forms:write, connections:write. Resource ownership and organization roles are also enforced. Legacy read/write scope behavior is described in the guide. Active interactive editing leases can reject writes with HTTP 423. Refresh the resource after HTTP 409 before applying a deliberate merged change. PATCH /v1/forms/:formId/data-automations/:id — Update forms / data automations Organization-scoped API operation. Required granular scopes: forms:write, connections:write. Resource ownership and organization roles are also enforced. Legacy read/write scope behavior is described in the guide. Active interactive editing leases can reject writes with HTTP 423. Refresh the resource after HTTP 409 before applying a deliberate merged change. POST /v1/forms/:formId/data-automations/:id/confirm — Create or run forms / data automations / confirm Organization-scoped API operation. Required granular scopes: forms:write, connections:write. Resource ownership and organization roles are also enforced. Legacy read/write scope behavior is described in the guide. Active interactive editing leases can reject writes with HTTP 423. Refresh the resource after HTTP 409 before applying a deliberate merged change. POST /v1/forms/:formId/data-automations/:id/run — Create or run forms / data automations / run Organization-scoped API operation. Required granular scopes: forms:write, connections:write. Resource ownership and organization roles are also enforced. Legacy read/write scope behavior is described in the guide. Active interactive editing leases can reject writes with HTTP 423. Refresh the resource after HTTP 409 before applying a deliberate merged change. POST /v1/forms/:formId/data-automations/preview — Create or run forms / data automations / preview Organization-scoped API operation. Required granular scopes: forms:write, connections:write. Resource ownership and organization roles are also enforced. Legacy read/write scope behavior is described in the guide. Active interactive editing leases can reject writes with HTTP 423. Refresh the resource after HTTP 409 before applying a deliberate merged change. DELETE /v1/forms/:id — Soft-delete forms Organization-scoped API operation. Required granular scopes: forms:write. Resource ownership and organization roles are also enforced. Legacy read/write scope behavior is described in the guide. Active interactive editing leases can reject writes with HTTP 423. Refresh the resource after HTTP 409 before applying a deliberate merged change. GET /v1/forms/:id — Read forms Organization-scoped API operation. Required granular scopes: forms:read. Resource ownership and organization roles are also enforced. Legacy read/write scope behavior is described in the guide. PATCH /v1/forms/:id — Update forms Organization-scoped API operation. Required granular scopes: forms:write. Resource ownership and organization roles are also enforced. Legacy read/write scope behavior is described in the guide. Active interactive editing leases can reject writes with HTTP 423. Refresh the resource after HTTP 409 before applying a deliberate merged change. GET /v1/forms/:id/campaigns — List forms / campaigns Organization-scoped API operation. Required granular scopes: forms:read. Resource ownership and organization roles are also enforced. Legacy read/write scope behavior is described in the guide. PUT /v1/forms/:id/draft — Save a draft using its base revision Organization-scoped API operation. Required granular scopes: forms:write. Resource ownership and organization roles are also enforced. Legacy read/write scope behavior is described in the guide. Active interactive editing leases can reject writes with HTTP 423. Refresh the resource after HTTP 409 before applying a deliberate merged change. baseRevision must equal the draftRevision from GET /v1/forms/:id. Saving an already published valid form can update its publication; inspect publishedUpToDate and workflowSyncPending. Invalid drafts may be saved but cannot be published. For advanced field types, conditions, tables, and layouts, fetch [GET /v1/schemas/form](/v1/schemas/form). In MCP, describe_operation then call_operation with operationId get_v1_schemas_form. Draft and published structural schemas are returned; referenced definitions also accompany this operation description. Use POST /v1/forms/validate for publication constraints beyond JSON Schema. POST /v1/forms/:id/edit-lock/acquire — Create or run forms / edit lock / acquire Interactive human access is required. Ordinary API keys are not accepted; the account's organization role and permissions still apply. Active interactive editing leases can reject writes with HTTP 423. Refresh the resource after HTTP 409 before applying a deliberate merged change. POST /v1/forms/:id/edit-lock/release — Create or run forms / edit lock / release Interactive human access is required. Ordinary API keys are not accepted; the account's organization role and permissions still apply. Active interactive editing leases can reject writes with HTTP 423. Refresh the resource after HTTP 409 before applying a deliberate merged change. POST /v1/forms/:id/edit-lock/renew — Create or run forms / edit lock / renew Interactive human access is required. Ordinary API keys are not accepted; the account's organization role and permissions still apply. Active interactive editing leases can reject writes with HTTP 423. Refresh the resource after HTTP 409 before applying a deliberate merged change. GET /v1/forms/:id/history — List forms / history Organization-scoped API operation. Required granular scopes: forms:read. Resource ownership and organization roles are also enforced. Legacy read/write scope behavior is described in the guide. POST /v1/forms/:id/history/:operation — Create or run forms / history Organization-scoped API operation. Required granular scopes: forms:write. Resource ownership and organization roles are also enforced. Legacy read/write scope behavior is described in the guide. Active interactive editing leases can reject writes with HTTP 423. Refresh the resource after HTTP 409 before applying a deliberate merged change. operation is undo, redo, or restore. All require baseRevision; restore additionally requires snapshotId. History edits produce a new revision. GET /v1/forms/:id/history/:snapshotId — Read forms / history Organization-scoped API operation. Required granular scopes: forms:read. Resource ownership and organization roles are also enforced. Legacy read/write scope behavior is described in the guide. POST /v1/forms/:id/move — Create or run forms / move Organization-scoped API operation. Required granular scopes: forms:write. Resource ownership and organization roles are also enforced. Legacy read/write scope behavior is described in the guide. Active interactive editing leases can reject writes with HTTP 423. Refresh the resource after HTTP 409 before applying a deliberate merged change. POST /v1/forms/:id/publish — Publish the current valid draft Organization-scoped API operation. Required granular scopes: forms:write. Resource ownership and organization roles are also enforced. Legacy read/write scope behavior is described in the guide. Active interactive editing leases can reject writes with HTTP 423. Refresh the resource after HTTP 409 before applying a deliberate merged change. For advanced field types, conditions, tables, and layouts, fetch [GET /v1/schemas/form](/v1/schemas/form). In MCP, describe_operation then call_operation with operationId get_v1_schemas_form. Draft and published structural schemas are returned; referenced definitions also accompany this operation description. Use POST /v1/forms/validate for publication constraints beyond JSON Schema. POST /v1/forms/:id/restore — Create or run forms / restore Organization-scoped API operation. Required granular scopes: forms:write. Resource ownership and organization roles are also enforced. Legacy read/write scope behavior is described in the guide. Active interactive editing leases can reject writes with HTTP 423. Refresh the resource after HTTP 409 before applying a deliberate merged change. GET /v1/forms/:id/style — List forms / style Organization-scoped API operation. Required granular scopes: forms:read. Resource ownership and organization roles are also enforced. Legacy read/write scope behavior is described in the guide. PUT /v1/forms/:id/style — Replace forms / style Organization-scoped API operation. Required granular scopes: forms:write. Resource ownership and organization roles are also enforced. Legacy read/write scope behavior is described in the guide. Active interactive editing leases can reject writes with HTTP 423. Refresh the resource after HTTP 409 before applying a deliberate merged change. PUT /v1/forms/:id/tags — Replace forms / tags Organization-scoped API operation. Required granular scopes: forms:write. Resource ownership and organization roles are also enforced. Legacy read/write scope behavior is described in the guide. Active interactive editing leases can reject writes with HTTP 423. Refresh the resource after HTTP 409 before applying a deliberate merged change. POST /v1/forms/:id/unpublish — Create or run forms / unpublish Organization-scoped API operation. Required granular scopes: forms:write. Resource ownership and organization roles are also enforced. Legacy read/write scope behavior is described in the guide. Active interactive editing leases can reject writes with HTTP 423. Refresh the resource after HTTP 409 before applying a deliberate merged change. GET /v1/forms/:id/versions — List forms / versions Organization-scoped API operation. Required granular scopes: forms:read. Resource ownership and organization roles are also enforced. Legacy read/write scope behavior is described in the guide. GET /v1/forms/:id/versions/:versionId — Read forms / versions Organization-scoped API operation. Required granular scopes: forms:read. Resource ownership and organization roles are also enforced. Legacy read/write scope behavior is described in the guide. GET /v1/forms/:id/workflow-connections — List forms / workflow connections Organization-scoped API operation. Required granular scopes: forms:read. Resource ownership and organization roles are also enforced. Legacy read/write scope behavior is described in the guide. Calls that read or mutate AuraFlow also require X-AuraFlow-Authorization: Bearer (and, when required by your login, X-Zitadel-Id-Token). The server verifies the same approved user and organization and enforces AuraFlow process ACLs. It never forwards the PollenForms key upstream. Missing authorization returns 403 auraflow_authorization_required; identity mismatch returns 403 auraflow_identity_mismatch. Configure these as MCP transport headers, never tool arguments. POST /v1/forms/validate — Validate a form without saving it Organization-scoped API operation. Required granular scopes: forms:read. Resource ownership and organization roles are also enforced. Legacy read/write scope behavior is described in the guide. For advanced field types, conditions, tables, and layouts, fetch [GET /v1/schemas/form](/v1/schemas/form). In MCP, describe_operation then call_operation with operationId get_v1_schemas_form. Draft and published structural schemas are returned; referenced definitions also accompany this operation description. Use POST /v1/forms/validate for publication constraints beyond JSON Schema. Invalid form content returns HTTP 200 with {valid:false,issues:[...]}; HTTP 422 indicates an invalid outer request envelope. GET /v1/integrations/auraflow/campaigns/:campaignId/submissions/:submissionId/files/:fileId — Read integrations / auraflow / campaigns / submissions / files Protected operational or AuraFlow integration endpoint. Ordinary organization API keys cannot call this operation. Use only the deployment's explicitly configured service identity and organization headers. POST /v1/integrations/auraflow/campaigns/:id/email-form — Create or run integrations / auraflow / campaigns / email form Protected operational or AuraFlow integration endpoint. Ordinary organization API keys cannot call this operation. Use only the deployment's explicitly configured service identity and organization headers. Active interactive editing leases can reject writes with HTTP 423. Refresh the resource after HTTP 409 before applying a deliberate merged change. POST /v1/integrations/auraflow/campaigns/by-correlation/:reference/close — Create or run integrations / auraflow / campaigns / by correlation / close Protected operational or AuraFlow integration endpoint. Ordinary organization API keys cannot call this operation. Use only the deployment's explicitly configured service identity and organization headers. POST /v1/integrations/auraflow/campaigns/by-correlation/:reference/reconcile — Create or run integrations / auraflow / campaigns / by correlation / reconcile Protected operational or AuraFlow integration endpoint. Ordinary organization API keys cannot call this operation. Use only the deployment's explicitly configured service identity and organization headers. POST /v1/integrations/auraflow/form-proposals — Create or run integrations / auraflow / form proposals Protected operational or AuraFlow integration endpoint. Ordinary organization API keys cannot call this operation. Use only the deployment's explicitly configured service identity and organization headers. GET /v1/integrations/auraflow/forms — List integrations / auraflow / forms Protected operational or AuraFlow integration endpoint. Ordinary organization API keys cannot call this operation. Use only the deployment's explicitly configured service identity and organization headers. GET /v1/integrations/auraflow/forms/:formTemplateId/versions — List integrations / auraflow / forms / versions Protected operational or AuraFlow integration endpoint. Ordinary organization API keys cannot call this operation. Use only the deployment's explicitly configured service identity and organization headers. GET /v1/integrations/auraflow/forms/:formTemplateId/versions/:formVersionId — Read integrations / auraflow / forms / versions Protected operational or AuraFlow integration endpoint. Ordinary organization API keys cannot call this operation. Use only the deployment's explicitly configured service identity and organization headers. PUT /v1/integrations/auraflow/managed-forms/:reference — Replace integrations / auraflow / managed forms Protected operational or AuraFlow integration endpoint. Ordinary organization API keys cannot call this operation. Use only the deployment's explicitly configured service identity and organization headers. POST /v1/integrations/auraflow/response-context-grants — Create or run integrations / auraflow / response context grants Protected operational or AuraFlow integration endpoint. Ordinary organization API keys cannot call this operation. Use only the deployment's explicitly configured service identity and organization headers. Issues a narrow credential for preparing date restrictions on this workflow's pinned response form. Store the returned token as a managed workflow secret and call POST /v1/public/workflow-response-contexts before opening the response campaign. The integration service credential must never be copied into a customer workflow. POST /v1/integrations/auraflow/response-contexts — Create or run integrations / auraflow / response contexts Protected operational or AuraFlow integration endpoint. Ordinary organization API keys cannot call this operation. Use only the deployment's explicitly configured service identity and organization headers. PUT /v1/integrations/auraflow/users — Replace integrations / auraflow / users Protected operational or AuraFlow integration endpoint. Ordinary organization API keys cannot call this operation. Use only the deployment's explicitly configured service identity and organization headers. GET /v1/integrations/auraflow/workflow-connections/:connectionId/trigger-attempts — List integrations / auraflow / workflow connections / trigger attempts Protected operational or AuraFlow integration endpoint. Ordinary organization API keys cannot call this operation. Use only the deployment's explicitly configured service identity and organization headers. POST /v1/integrations/auraflow/workflow-connections/:connectionId/trigger-attempts/:deliveryId/retry — Create or run integrations / auraflow / workflow connections / trigger attempts / retry Protected operational or AuraFlow integration endpoint. Ordinary organization API keys cannot call this operation. Use only the deployment's explicitly configured service identity and organization headers. GET /v1/integrations/auraflow/workflow-intakes/:reference — Read integrations / auraflow / workflow intakes Protected operational or AuraFlow integration endpoint. Ordinary organization API keys cannot call this operation. Use only the deployment's explicitly configured service identity and organization headers. PUT /v1/integrations/auraflow/workflow-intakes/:reference — Replace integrations / auraflow / workflow intakes Protected operational or AuraFlow integration endpoint. Ordinary organization API keys cannot call this operation. Use only the deployment's explicitly configured service identity and organization headers. POST /v1/integrations/auraflow/workflow-intakes/:reference/complete — Create or run integrations / auraflow / workflow intakes / complete Protected operational or AuraFlow integration endpoint. Ordinary organization API keys cannot call this operation. Use only the deployment's explicitly configured service identity and organization headers. GET /v1/integrations/auraflow/workflow-intakes/:reference/trigger-attempts — List integrations / auraflow / workflow intakes / trigger attempts Protected operational or AuraFlow integration endpoint. Ordinary organization API keys cannot call this operation. Use only the deployment's explicitly configured service identity and organization headers. POST /v1/integrations/auraflow/workflow-intakes/:reference/trigger-attempts/:deliveryId/retry — Create or run integrations / auraflow / workflow intakes / trigger attempts / retry Protected operational or AuraFlow integration endpoint. Ordinary organization API keys cannot call this operation. Use only the deployment's explicitly configured service identity and organization headers. GET /v1/library — Browse folders, forms, and tags Organization-scoped API operation. Required granular scopes: library:read. Resource ownership and organization roles are also enforced. Legacy read/write scope behavior is described in the guide. GET /v1/me — Read the authenticated identity and organization Organization-scoped API operation. Required granular scopes: none beyond a valid identity. Resource ownership and organization roles are also enforced. Legacy read/write scope behavior is described in the guide. GET /v1/operations/health — List operations / health Operational diagnostic, not an ordinary API-key operation. Uses the deployment's monitoring credential or explicitly supported service identity. Metrics/readiness return Prometheus text; health can return JSON. GET /v1/operations/metrics — List operations / metrics Operational diagnostic, not an ordinary API-key operation. Uses the deployment's monitoring credential or explicitly supported service identity. Metrics/readiness return Prometheus text; health can return JSON. GET /v1/operations/ready — List operations / ready Operational diagnostic, not an ordinary API-key operation. Uses the deployment's monitoring credential or explicitly supported service identity. Metrics/readiness return Prometheus text; health can return JSON. GET /v1/public/assets/:token — Read public / assets Respondent endpoint. No organization API key is required for public audiences. Organization and selected-user audiences require the respondent's interactive identity; an API key does not bypass campaign access, signed links, session receipts, expiry, or media cookies. GET /v1/public/bookings/:token — Read public / bookings Respondent endpoint. No organization API key is required for public audiences. Organization and selected-user audiences require the respondent's interactive identity; an API key does not bypass campaign access, signed links, session receipts, expiry, or media cookies. POST /v1/public/bookings/:token/appointments — Create or run public / bookings / appointments Respondent endpoint. No organization API key is required for public audiences. Organization and selected-user audiences require the respondent's interactive identity; an API key does not bypass campaign access, signed links, session receipts, expiry, or media cookies. GET /v1/public/bookings/page/:id — Read public / bookings / page Respondent endpoint. No organization API key is required for public audiences. Organization and selected-user audiences require the respondent's interactive identity; an API key does not bypass campaign access, signed links, session receipts, expiry, or media cookies. GET /v1/public/branding/:id/logo — List public / branding / logo Respondent endpoint. No organization API key is required for public audiences. Organization and selected-user audiences require the respondent's interactive identity; an API key does not bypass campaign access, signed links, session receipts, expiry, or media cookies. GET /v1/public/campaigns/:token — Open a respondent form and obtain its form session Respondent endpoint. No organization API key is required for public audiences. Organization and selected-user audiences require the respondent's interactive identity; an API key does not bypass campaign access, signed links, session receipts, expiry, or media cookies. GET /v1/public/campaigns/:token/assets/:id — Read public / campaigns / assets Respondent endpoint. No organization API key is required for public audiences. Organization and selected-user audiences require the respondent's interactive identity; an API key does not bypass campaign access, signed links, session receipts, expiry, or media cookies. POST /v1/public/campaigns/:token/assets/:id/complete — Create or run public / campaigns / assets / complete Respondent endpoint. No organization API key is required for public audiences. Organization and selected-user audiences require the respondent's interactive identity; an API key does not bypass campaign access, signed links, session receipts, expiry, or media cookies. Active interactive editing leases can reject writes with HTTP 423. Refresh the resource after HTTP 409 before applying a deliberate merged change. POST /v1/public/campaigns/:token/assets/upload-intents — Create or run public / campaigns / assets / upload intents Respondent endpoint. No organization API key is required for public audiences. Organization and selected-user audiences require the respondent's interactive identity; an API key does not bypass campaign access, signed links, session receipts, expiry, or media cookies. Active interactive editing leases can reject writes with HTTP 423. Refresh the resource after HTTP 409 before applying a deliberate merged change. GET /v1/public/campaigns/:token/downloads/:assetId — Read public / campaigns / downloads Respondent endpoint. No organization API key is required for public audiences. Organization and selected-user audiences require the respondent's interactive identity; an API key does not bypass campaign access, signed links, session receipts, expiry, or media cookies. POST /v1/public/campaigns/:token/email-response — Create or run public / campaigns / email response Respondent endpoint. No organization API key is required for public audiences. Organization and selected-user audiences require the respondent's interactive identity; an API key does not bypass campaign access, signed links, session receipts, expiry, or media cookies. Active interactive editing leases can reject writes with HTTP 423. Refresh the resource after HTTP 409 before applying a deliberate merged change. Requires the signed receipt query parameter from the generated email form. Submit form-urlencoded field values, not JSON. AMP-Email-Sender must match the receipt's sender when supplied. This is a dedicated service-generated one-response workflow contract, not a general anonymous form submit endpoint. POST /v1/public/campaigns/:token/media/:assetId/session — Create or run public / campaigns / media / session Respondent endpoint. No organization API key is required for public audiences. Organization and selected-user audiences require the respondent's interactive identity; an API key does not bypass campaign access, signed links, session receipts, expiry, or media cookies. Active interactive editing leases can reject writes with HTTP 423. Refresh the resource after HTTP 409 before applying a deliberate merged change. GET /v1/public/campaigns/:token/media/:assetId/stream — List public / campaigns / media / stream Respondent endpoint. No organization API key is required for public audiences. Organization and selected-user audiences require the respondent's interactive identity; an API key does not bypass campaign access, signed links, session receipts, expiry, or media cookies. Obtain a media-session cookie first and preserve it. Supports byte ranges; invalid ranges return 416 with Content-Range. POST /v1/public/campaigns/:token/partial-responses — Create or run public / campaigns / partial responses Respondent endpoint. No organization API key is required for public audiences. Organization and selected-user audiences require the respondent's interactive identity; an API key does not bypass campaign access, signed links, session receipts, expiry, or media cookies. Active interactive editing leases can reject writes with HTTP 423. Refresh the resource after HTTP 409 before applying a deliberate merged change. GET /v1/public/campaigns/:token/partial-responses/:id — Read public / campaigns / partial responses Respondent endpoint. No organization API key is required for public audiences. Organization and selected-user audiences require the respondent's interactive identity; an API key does not bypass campaign access, signed links, session receipts, expiry, or media cookies. PUT /v1/public/campaigns/:token/partial-responses/:id — Replace public / campaigns / partial responses Respondent endpoint. No organization API key is required for public audiences. Organization and selected-user audiences require the respondent's interactive identity; an API key does not bypass campaign access, signed links, session receipts, expiry, or media cookies. Active interactive editing leases can reject writes with HTTP 423. Refresh the resource after HTTP 409 before applying a deliberate merged change. POST /v1/public/campaigns/:token/submissions — Submit a respondent form idempotently Respondent endpoint. No organization API key is required for public audiences. Organization and selected-user audiences require the respondent's interactive identity; an API key does not bypass campaign access, signed links, session receipts, expiry, or media cookies. Active interactive editing leases can reject writes with HTTP 423. Refresh the resource after HTTP 409 before applying a deliberate merged change. POST /v1/public/campaigns/:token/transcriptions — Create or run public / campaigns / transcriptions Respondent endpoint. No organization API key is required for public audiences. Organization and selected-user audiences require the respondent's interactive identity; an API key does not bypass campaign access, signed links, session receipts, expiry, or media cookies. Active interactive editing leases can reject writes with HTTP 423. Refresh the resource after HTTP 409 before applying a deliberate merged change. Upload raw audio bytes, not JSON or multipart data. Use a supported audio Content-Type. Transcription budgets and size limits apply. GET /v1/public/campaigns/:token/version — List public / campaigns / version Respondent endpoint. No organization API key is required for public audiences. Organization and selected-user audiences require the respondent's interactive identity; an API key does not bypass campaign access, signed links, session receipts, expiry, or media cookies. DELETE /v1/public/partial-responses/:id — Soft-delete public / partial responses Respondent endpoint. No organization API key is required for public audiences. Organization and selected-user audiences require the respondent's interactive identity; an API key does not bypass campaign access, signed links, session receipts, expiry, or media cookies. POST /v1/public/partial-responses/lookup — Create or run public / partial responses / lookup Respondent endpoint. No organization API key is required for public audiences. Organization and selected-user audiences require the respondent's interactive identity; an API key does not bypass campaign access, signed links, session receipts, expiry, or media cookies. GET /v1/public/workflow-assets/:deliveryId/:assetId/:signature — Read public / workflow assets Respondent endpoint. No organization API key is required for public audiences. Organization and selected-user audiences require the respondent's interactive identity; an API key does not bypass campaign access, signed links, session receipts, expiry, or media cookies. POST /v1/public/workflow-response-contexts — Prepare a case-specific response date range Supply the narrow Bearer credential issued by POST /v1/integrations/auraflow/response-context-grants. It is bound to one organization, workflow node and immutable form version; it grants no form, response or campaign access. Prepare the range before the workflow opens its response campaign. Exact retries are safe; conflicting restrictions return 409. Campaigns freeze the prepared range and reject out-of-range dates server-side. GET /v1/resource-context — List resource context Interactive human access is required. Ordinary API keys are not accepted; the account's organization role and permissions still apply. GET /v1/schemas/form — Get machine-readable form content schemas Organization-scoped API operation. Required granular scopes: forms:read. Resource ownership and organization roles are also enforced. Legacy read/write scope behavior is described in the guide. GET /v1/style-defaults — List style defaults Organization-scoped API operation. Required granular scopes: branding:read. Resource ownership and organization roles are also enforced. Legacy read/write scope behavior is described in the guide. PUT /v1/style-defaults — Replace style defaults Organization-scoped API operation. Required granular scopes: branding:write. Resource ownership and organization roles are also enforced. Legacy read/write scope behavior is described in the guide. Requires an admin/user_admin-owned key with explicit branding:write. Legacy write alone is insufficient. GET /v1/superadmin/organizations — List superadmin / organizations Interactive human access is required. Ordinary API keys are not accepted; the account's organization role and permissions still apply. GET /v1/superadmin/organizations/:id — Read superadmin / organizations Interactive human access is required. Ordinary API keys are not accepted; the account's organization role and permissions still apply. POST /v1/tags — Create or run tags Organization-scoped API operation. Required granular scopes: library:write. Resource ownership and organization roles are also enforced. Legacy read/write scope behavior is described in the guide. DELETE /v1/tags/:id — Soft-delete tags Organization-scoped API operation. Required granular scopes: library:write. Resource ownership and organization roles are also enforced. Legacy read/write scope behavior is described in the guide. PATCH /v1/tags/:id — Update tags Organization-scoped API operation. Required granular scopes: library:write. Resource ownership and organization roles are also enforced. Legacy read/write scope behavior is described in the guide. POST /v1/tags/:id/restore — Create or run tags / restore Organization-scoped API operation. Required granular scopes: library:write. Resource ownership and organization roles are also enforced. Legacy read/write scope behavior is described in the guide. GET /v1/trash — List trash Organization-scoped API operation. Required granular scopes: library:read. Resource ownership and organization roles are also enforced. Legacy read/write scope behavior is described in the guide. GET /v1/workflow-categories — List workflow categories Organization-scoped API operation. Required granular scopes: workflows:read. Resource ownership and organization roles are also enforced. Legacy read/write scope behavior is described in the guide. Calls that read or mutate AuraFlow also require X-AuraFlow-Authorization: Bearer (and, when required by your login, X-Zitadel-Id-Token). The server verifies the same approved user and organization and enforces AuraFlow process ACLs. It never forwards the PollenForms key upstream. Missing authorization returns 403 auraflow_authorization_required; identity mismatch returns 403 auraflow_identity_mismatch. Configure these as MCP transport headers, never tool arguments. GET /v1/workflow-processes — List workflow processes Organization-scoped API operation. Required granular scopes: workflows:read. Resource ownership and organization roles are also enforced. Legacy read/write scope behavior is described in the guide. Calls that read or mutate AuraFlow also require X-AuraFlow-Authorization: Bearer (and, when required by your login, X-Zitadel-Id-Token). The server verifies the same approved user and organization and enforces AuraFlow process ACLs. It never forwards the PollenForms key upstream. Missing authorization returns 403 auraflow_authorization_required; identity mismatch returns 403 auraflow_identity_mismatch. Configure these as MCP transport headers, never tool arguments. GET /v1/workflows — List workflows Organization-scoped API operation. Required granular scopes: workflows:read. Resource ownership and organization roles are also enforced. Legacy read/write scope behavior is described in the guide. Calls that read or mutate AuraFlow also require X-AuraFlow-Authorization: Bearer (and, when required by your login, X-Zitadel-Id-Token). The server verifies the same approved user and organization and enforces AuraFlow process ACLs. It never forwards the PollenForms key upstream. Missing authorization returns 403 auraflow_authorization_required; identity mismatch returns 403 auraflow_identity_mismatch. Configure these as MCP transport headers, never tool arguments. POST /v1/workflows — Create or run workflows Organization-scoped API operation. Required granular scopes: workflows:write. Resource ownership and organization roles are also enforced. Legacy read/write scope behavior is described in the guide. Calls that read or mutate AuraFlow also require X-AuraFlow-Authorization: Bearer (and, when required by your login, X-Zitadel-Id-Token). The server verifies the same approved user and organization and enforces AuraFlow process ACLs. It never forwards the PollenForms key upstream. Missing authorization returns 403 auraflow_authorization_required; identity mismatch returns 403 auraflow_identity_mismatch. Configure these as MCP transport headers, never tool arguments. GET /v1/workflows/:processId/:workflowId/input — List workflows / input Organization-scoped API operation. Required granular scopes: workflows:read. Resource ownership and organization roles are also enforced. Legacy read/write scope behavior is described in the guide. Calls that read or mutate AuraFlow also require X-AuraFlow-Authorization: Bearer (and, when required by your login, X-Zitadel-Id-Token). The server verifies the same approved user and organization and enforces AuraFlow process ACLs. It never forwards the PollenForms key upstream. Missing authorization returns 403 auraflow_authorization_required; identity mismatch returns 403 auraflow_identity_mismatch. Configure these as MCP transport headers, never tool arguments.