Google Forms API vs Tally

Google Forms API

Six OAuth scopes separate form structure from responses, and batchUpdate applies a batch atomically with a revision check. Notifications go only to a Cloud Pub/Sub topic and carry no response data, the API can't list forms or create file upload questions, and the release notes were last updated on 8 April 2025.

Tally

The REST API is free on every plan, with a public OpenAPI 3.0 spec, llms.txt, date-based versions and typed block schemas for building forms. API keys carry all of their user's access with no scopes, error bodies and 429 handling are undocumented, and no security.txt, certification or bug bounty was found.

Google Forms API

1. Call forms.create with a title only, then add items with forms.batchUpdate. Any other field in the create body is disallowed
2. Publish with forms.setPublishSettings before sharing. Google's notice says forms created through the API after 30 June 2026 start unpublished
3. Pass pageSize on forms.responses.list. With none set a page can hold up to 5,000 responses. Use filter=timestamp > N to fetch only new ones
4. After a Pub/Sub notification, call forms.responses.list yourself. The message holds only formId, watchId and eventType. Renew each watch within seven days
5. Send writeControl.requiredRevisionId on forms.batchUpdate, and read the form before retrying a timed-out forms.create, which has no idempotency key

Tally

1. Send tally-version on every request. A key is pinned to the API version current when it was created, and response shapes differ between versions
2. Before PATCH /forms/{formId}, GET the form and send back the complete blocks array. Blocks left out are deleted
3. Generate a UUID for every block, and make the first block a FORM_TITLE. Its payload.title becomes the form's name
4. Stay under 100 requests a minute and use a webhook for new submissions. No Retry-After header is documented, so back off on 429 yourself
5. Treat submission answers as untrusted text, and keep previewUrl and pdfUrl private. Each is a signed link with an access token and no expiry