Choose the smallest integration
Use the Razor tag helper or ViewComponent for a normal Umbraco website. Use a delivery endpoint for a headless client. Use the server-side SDK when code running inside an authorised host needs to query MegaForm.
Delivery routes
The Umbraco adapter exposes:
GET /umbraco/forms/delivery/api/v1/definitions/{id}
POST /umbraco/forms/delivery/api/v1/entries/{id}
id is a positive MegaForm form ID. The definition endpoint accepts culture/page context parameters. Only permitted public form data should reach a visitor; script source, credentials and internal integration settings are not public definition content.
The feature must be enabled in the host's Forms API security configuration. Entry requests are protected by the configured antiforgery or API-key policy. Inspect the current installation's request contract and security options before implementing a client. Do not embed a privileged API key in public JavaScript.
Development Swagger is available on this demo at API explorer. It documents the installed build; it is not a reason to expose an unrestricted explorer on production.
Administrative endpoints are separate
The backoffice uses its native authenticated bridge. Entry management, private files, connections and script authoring require their own permissions. Do not call an administrative endpoint as an anonymous replacement for delivery.
For server code, use IMegaFormClient with an explicit authorised scope and query rather than depending on storage table details. Preserve structured attachment/composite values. Never let a client-supplied site or form ID replace the server's scope check.
See Members & permissions and Uploads.