Gravity Forms 3.1.1 changes a subtle Web API permission boundary. A form submission made while impersonating a user can create an entry successfully, but the response must omit the new entry ID when that user lacks permission to view or edit entries. Integrations that treat a missing ID as a failed submission can retry and create duplicates. Integrations that expose the ID anyway can leak an object reference across roles.
Use this for membership sites, portals, agency integrations, mobile applications, headless forms, support tools, delegated accounts, custom REST clients, and any workflow that submits a form while acting as another WordPress user.
Quick answer
Create two least-privilege test users: one allowed to submit and view entries, and one allowed to submit but not view or edit entries. Send the same synthetic form through the Web API under each identity. Both valid requests should create one entry. Only the authorized identity should receive the created entry ID. Reconcile the response, Gravity Forms entry list, application log, notification, webhook, and client retry behavior. A missing response ID for the restricted role is an intentional privacy result, not proof that creation failed.
Test scenarios to run
Run the same controlled fixture across these branches. Write down the expected result before testing so a surprising response is easy to identify.
| Scenario | Fixture | Expected result |
|---|
| Entry-capable role | Valid submission | Created ID returned |
| Submit-only role | Valid submission | Entry created, ID omitted |
| Invalid form data | Submit-only role | Validation details, no entry |
| Lost response | Stable request marker | One business entry |
Diagnostic table
Use this table to connect the observed behavior to evidence and a verification step.
| Action | Evidence | Verification |
|---|
| Freeze roles and capabilities | Record Gravity Forms version, endpoint, authentication method, impersonated user ID, role, form capabilities, entry capabilities, request ID, and synthetic field marker. | Submit-only users cannot retrieve, edit, enumerate, or infer the created entry after submission. |
| Send marked submissions | Submit as an administrator, an entry-capable editor, a submit-only user, an unauthenticated client, and a user whose permission is removed between authentication and submission. | Authorized users receive the expected entry identifier and can follow the intended workflow. |
| Reconcile entry creation | Compare HTTP status, response fields, entry count, created_by value, audit log, notifications, add-on feeds, and the client's success and retry decision. | The client records success without retrying solely because the identifier is absent. |
| Correct client retry logic | Force a response timeout after entry creation and verify that a missing ID plus a retry cannot produce two business records. | Entries, notifications, webhooks, CRM records, and audit logs reconcile one to one. |
What to check first
- Record Gravity Forms version, endpoint, authentication method, impersonated user ID, role, form capabilities, entry capabilities, request ID, and synthetic field marker.
- Submit as an administrator, an entry-capable editor, a submit-only user, an unauthenticated client, and a user whose permission is removed between authentication and submission.
- Compare HTTP status, response fields, entry count, created_by value, audit log, notifications, add-on feeds, and the client's success and retry decision.
- Force a response timeout after entry creation and verify that a missing ID plus a retry cannot produce two business records.
- Confirm logs and error messages do not reveal the hidden entry ID, private field values, application passwords, cookies, or authorization headers.
Field notes
- Write the pass condition before changing anything and keep one repeatable synthetic fixture for the full test window.
- Record exact versions and UTC timestamps because deployments, caches, retries, scheduled actions, and background jobs can change the evidence.
- Test the public path and the stored server-side result, not only an admin preview, isolated command, or API response.
- Repeat verification after the relevant cache, queue, cron, webhook, and observation window has completed.
Useful command or data shape
Adapt paths, IDs, and privacy handling to the site before running commands or storing data on production.
curl -sS -u 'submit-only:APP_PASSWORD' -H 'Content-Type: application/json' \
+ -d '{"input_1":"GF311-PERM-001"}' \
+ https://example.com/wp-json/gf/v2/forms/7/submissions
Why this usually happens
- A client assumes every successful creation response must contain an object ID.
- A custom permission filter grants form submission but not entry access.
- Retry logic cannot distinguish an ambiguous response from a rejected request.
- Debug logging records a response before a permission-based field filter runs.
Decision rule
Approve the integration only when every valid request creates exactly one entry, restricted users receive no entry identifier, authorized users retain the expected response, and ambiguous retries are deduplicated.
Production verification checklist
- Submit-only users cannot retrieve, edit, enumerate, or infer the created entry after submission.
- Authorized users receive the expected entry identifier and can follow the intended workflow.
- The client records success without retrying solely because the identifier is absent.
- Entries, notifications, webhooks, CRM records, and audit logs reconcile one to one.
Safe fix order
Use a sequence that makes each result easy to prove. Stop when new evidence changes the scope or owner of the problem.
- Freeze roles and capabilities
- Send marked submissions
- Reconcile entry creation
- Correct client retry logic
- Retest privacy boundaries
Mistakes to avoid
- Changing production before recording exact versions, UTC timestamps, a stable fixture, the expected result, and a tested rollback point.
- Treating one successful screen as proof while stored records, logs, queues, caches, emails, APIs, and downstream systems remain unchecked.
- Testing only as an administrator instead of using the role, device, locale, cache state, payment state, and failure branch that customers reach.
- Leaving temporary exclusions, debug output, test accounts, broad permissions, or one-off repair code active after verification.
Questions teams ask during testing
Can I run this directly in production?
Begin with read-only evidence and use staging for package, database, checkout, form, permission, or security changes. If a production canary is necessary, make it identifiable, reversible, monitored, and unable to expose personal data or charge a customer.
How do I avoid a false positive?
Repeat the same fixture with the same versions, role, URL, locale, cache state, and integrations. Compare browser, stored, API, and log evidence instead of relying on one screen.
What should the evidence packet contain?
Keep UTC time, exact versions, synthetic record ID, expected result, actual result, relevant log lines, change made, rollback point, owner, and final verification. Redact secrets and personal data.
When is the test complete?
Close the work when the primary path passes, failure branches are understood, stored and downstream records reconcile, temporary changes are removed, and monitoring covers the next update.
What to tell the client or owner
Give the owner a concise packet with the affected workflow, exact versions, UTC test time, fixture ID, expected result, actual result, key logs, change made, rollback point, final result, unresolved risks, owner, and next review date. Remove credentials and personal data before sharing it.
When HandL WP should help
Bring in help when this affects leads, checkout, search visibility, security, paid media reporting, or a client production site. HandL WP can trace the issue through WordPress, hosting, cache, tracking, and Search Console, then verify the workflow after the technical fix.
If this is active on a production site, have HandL WP test Gravity Forms API permissions.
Related HandL WP guides
Use these related guides when the same issue touches tracking, security, checkout, or crawler visibility.
Prevent retries when the entry ID is missing
A missing entry ID does not prove the submission failed. Use the Gravity Forms API missing entry ID deduplication pattern to add a stable request marker, an authorized reconciliation path, and downstream duplicate protection.
Helpful references