API
The two public endpoints behind a Folia intake form, for rendering and submitting a form from your own site.
Every published Folia intake form has a hosted page and an iframe embed; for most sites, embedding is all you need. This API is for the rest: reading a form's published questions and posting answers from markup you control — a custom-designed form on your site, a multi-step wizard, a native app. The two pages under Reference are generated from the same schemas the server validates with, so they cannot drift from what the API accepts.
The machine-readable document is at /api/v1/openapi.json (OpenAPI 3.1).
Base URL and versioning
All paths are relative to https://www.foliaplanner.com/api/v1. The version lives in the path. Additive changes — new optional fields, new enum values — ship inside v1; anything that would break a correct client gets a new prefix. Treat unknown fields in responses as expected and ignore them.
Authentication
None. The form's token is the capability: it is the last segment of the share link the planner gives you (https://www.foliaplanner.com/f/{token}). Knowing it lets you read the published questions and submit answers, nothing else. It is not a secret, but do not post it anywhere you would not post the form's link.
Calling from a browser
Both endpoints accept requests from any origin, so a page on your site can call them straight from the visitor's browser, with nothing to register first. Leave fetch's credentials option at its default: the API reads no cookies, and a browser refuses the response to a request sent with them. Retry-After is readable from script.
Requests
Request bodies are JSON (Content-Type: application/json). Every input is validated against a schema before anything else happens. Unknown keys are ignored; wrong types and missing required fields return 400 validation_failed with an errors map naming each offending field by path.
Responses
Success bodies are wrapped:
{ "data": { "id": "…", "heading": "Tell us about your day" } }GET returns 200; a successful submission returns 201. Dates are ISO 8601 strings in UTC. Fields that can be unset are null, never omitted.
Errors
Failures are RFC 9457 problem details with Content-Type: application/problem+json and a stable code you can switch on. See Errors for every code and what to do about it.
Rate limits
Submissions are rate limited per form. Past the limit the API returns 429 rate_limited with a Retry-After header in seconds and stores nothing; wait that long before retrying. A visitor filling in a form by hand will not reach it.