Developers

REST API

The public routes the visitor runtime uses, the payment webhooks, and the admin routes.

All routes are under /wp-json/flvf/v1/.

Public routes

These are used by the visitor runtime. They are public by design and protected by signed form tokens, rate limits and the same checks as submissions without JavaScript.

Sending entries from your own code is best done by rendering the form; if you post to the submit route directly, include a token from the token route and a unique _flvf_sid per submission.

Answers use the same names as the HTML form: flvf[<field id>], with parts as flvf[<field id>][<part>] (for example [first] and [last] of a name, [line1] and [country] of an address). A telephone field with the country list takes [country] and [number]; a number sent as plain text is read in the field's default country, or kept as typed when the field has none.

Admin routes

Routes under /wp-json/flvf/v1/admin/ serve the dashboard screens: forms, drafts, publishing, revisions, entries, labels, notes, exports, settings, credentials, diagnostics, jobs, the log, imports, permissions and the licence. They need a logged in user with the matching Flavonto Forms capability, and WordPress's REST nonce (X-WP-Nonce) as for any cookie authenticated request. They are documented here so you know what exists; they may change between versions, so prefer the PHP hooks for integrations.

The full list of routes in this version is generated from the plugin: