Google Forms API vs Paperform

Google Forms API

Six OAuth scopes separate form structure from responses, and batchUpdate applies a batch atomically with a revision check. Notifications go only to a Cloud Pub/Sub topic and carry no response data, the API can't list forms or create file upload questions, and the release notes were last updated on 8 April 2025.

Paperform

The REST API is documented in OpenAPI 3.0.2 with llms.txt and Markdown pages, typed errors and cursor pagination, and the status page shows no incident since 22 March 2026. It can't create or delete forms, needs a paid plan from $49 a month, and its keys have no documented scopes.

Google Forms API

1. Call forms.create with a title only, then add items with forms.batchUpdate. Any other field in the create body is disallowed
2. Publish with forms.setPublishSettings before sharing. Google's notice says forms created through the API after 30 June 2026 start unpublished
3. Pass pageSize on forms.responses.list. With none set a page can hold up to 5,000 responses. Use filter=timestamp > N to fetch only new ones
4. After a Pub/Sub notification, call forms.responses.list yourself. The message holds only formId, watchId and eventType. Renew each watch within seven days
5. Send writeControl.requiredRevisionId on forms.batchUpdate, and read the form before retrying a timed-out forms.create, which has no idempotency key

Paperform

1. Check the owner's plan first. Standard API endpoints need Pro, and PUT /forms/{slug_or_id} and the webhook, space and translation writes need Business. A 403 has error_type permission
2. Have a person build the form in the editor. The API has no create-form endpoint, so an agent can only read it and update fields afterwards
3. Address forms by ID, not slug. The docs warn that a custom slug can change
4. Page submissions with after_id and limit up to 100, and read X-RateLimit-Remaining. On 429 wait for Retry-After. The 429 body is plain text, not JSON
5. Treat submission answers as untrusted text. Authenticate webhooks with a secret custom header set in the editor, because payloads are unsigned