Skip to main content
The Forme hosted API runs the same engine as npm install, behind an HTTP API with saved templates, document storage, and usage tracking. You manage templates, keys, and certificates in the Dashboard. Sign up at app.formepdf.com/sign-up.

​
Hosted or self-hosted

Forme has two HTTP servers. Both serve the same /v1 route family. Pick one: The request bodies are not identical in every case. For example, the hosted POST /v1/render/:slug takes the template data as the whole body, and the self-hosted server takes it under a data key. Each hosted page states the hosted shape. The self-hosted API reference states the self-hosted shape.

​
Base URL

All endpoints are under /v1.

​
Authentication

Every /v1 request needs an API key, sent as a Bearer token:
Create keys on the Credentials page of the Dashboard. A key is forme_sk_ followed by 32 hex characters.
  • The full key is shown once, when you create it. After that, the Dashboard shows only the last 8 characters.
  • Revoking a key stops it working immediately. A revoked key returns 401.
  • A key belongs to the account (personal or organization) that was active when you created it. Requests with that key see only that account’s templates, documents, and certificates, and count against that account’s usage.
Keys created in an organization need the organization to be on the Pro or Business plan. Otherwise every /v1 request with that key returns 403 with "Org features require the Pro plan".

​
Endpoints

​
Operations and plan limits

Each plan has a monthly operation limit. An operation is one successful call to render (sync, HTML, or async), certify, redact, or merge.
  • Failed calls do not count. Only successful operations count toward the limit.
  • Not counted: POST /v1/extract, GET /v1/jobs/:jobId, and the GET resource listings.
  • Async renders count when the job finishes, not when you queue them. The limit is still checked when you queue the job.
  • The count resets at the start of each calendar month.
  • Usage made in the Dashboard itself (editor previews, certifying in the Document Editor) does not count. Only API-key calls count.
When you reach the limit, operation endpoints return 429:
Some features need a paid plan: developer metadata on renders, metadata.* filters on document listings, and saved redaction templates in /v1/redact. The number of saved templates and certificates, the per-request redaction pattern limit, and the document retention period also depend on the plan. A plan-gated request returns 403:
See the Billing page in the Dashboard for the current limits of each plan.

​
Rate limits

Rate limits apply per API key, over a one-minute window, per route group: GET /v1/jobs/:jobId and the resource listings are not rate-limited. Responses from rate-limited routes carry X-RateLimit-Limit, X-RateLimit-Remaining, and X-RateLimit-Reset headers. Over the limit, the API returns 429 with a Retry-After header:

​
Request size

  • JSON bodies: up to 20 MB. This includes base64-encoded PDFs sent to certify, redact, and merge.
  • POST /v1/extract takes raw PDF bytes: up to 10 MB.

​
Errors

All errors return JSON with an error message:

​
SDKs

The HTTP clients in the TypeScript, Python, and Go SDKs default to https://api.formepdf.com. Pass a base URL to point them at a self-hosted server instead.