Retrieving Form URL via API

gyezhov

I have an automation that makes a copy of a folder and moves it into another folder using Make.com. Within the new folder is a sheet with a form, and I simply want to generate a QR code for this form using the form's URL returned by the Smartsheet API. I have come to learn that, since 2018, this functionality has been acknowledged by the Smartsheet engineering team. However, they have completely ceased any update regarding this since 2021.

1. Why is there still no method of being able to retrieve the URL for an active form using the REST API? If it is a security issue, then I am confused as to why forms do not have access safeguards implemented.

2. If Smartsheet does implement safeguards for forms, then why are they not enough to enable API functionality on them?

3. Furthermore, I would like to gain some insight into how the Smartsheet engineering team plans functionality rollout, if possible. It is a bit disheartening to constantly search up issues I am having with this platform only to find the only relevant post about my issue is from 2019, with a last response in 2021 being: "I'll get it to our engineering team".

Melissa Yamada

1. Why can’t the API retrieve a form URL?
Because Smartsheet forms are public and unauthenticated. Engineering has intentionally avoided exposing form URLs via the API to prevent programmatic discovery or enumeration of submission endpoints. This is a design decision, not a technical limitation.

2. Are there safeguards, and why aren’t they sufficient?
There are essentially no true access safeguards on forms beyond CAPTCHA and manual deactivation. Because forms lack tokenization, authentication, or scoped permissions, there is nothing secure enough to justify enabling API access.

In short: the API limitation exists because proper form security controls do not exist, not because they are insufficient.

3. How does Smartsheet plan functionality rollout?
Smartsheet prioritizes features based on enterprise governance, security, and core collaboration impact. Community posts marked as “shared with engineering” indicate awareness, not commitment. Items that do not meet internal prioritization thresholds—such as form API enhancements for external automation—can remain acknowledged for years without action, which is why many threads stall after an initial response.