Pull form submissions out with the REST API

A token and a documented API

The API is version 1 and authenticates with a bearer token, the kind that starts with aft_. Every route is described in an OpenAPI specification with browsable ReDoc documentation, so the exact paths, parameters, and response shapes are there to read rather than guessed at. You send the token in an Authorization header:

When to reach for it

The API earns its place when the destination is code rather than a person. Feeding submissions into a warehouse for reporting. Reconciling them against another system on a schedule. Building an internal view that blends form data with something else. If you only need the data in SharePoint, the form already does that on submit, and you may not need the API at all.

For AI orchestrators, an MCP server

There is also an MCP server, served over streamable HTTP and authenticated with a personal access token. If you are wiring forms into an AI agent or orchestrator that speaks the Model Context Protocol, that is the door built for it, rather than bending the REST API to the job.

One practical note on limits: the enforced quota on an account is the AI-credit quota for the AI features. Plan your integration around the documented API behaviour rather than assuming a separate tiered cap on API calls.