We’re trying to connect the Rest API to Zapier but keep getting this error message in the debug log: 2026-04-07 16:59:03.161875 - DEBUG → GF_REST_Controller::current_user_can_any(): method: GET; route: /gf/v2/zapier-requirements; capability: “gravityforms_edit_forms”; result: false.
I have asked our hosting regarding Cloudflare and this is their response:
Zapier user agent is whitelisted from our firewall
In the last 24 hours, Zapier did not actually receive any 403 blocks from our firewall or the website
All requests made by Zapier to your website actually received 200 ok 301 responses
This is a permissions issue, not a firewall/Cloudflare issue. The WordPress user account that Gravity Forms is using to authenticate the Zapier connection doesn’t have the gravityforms_edit_forms capability.
Most Likely Causes & Fixes
1. The API Key user isn’t an Administrator (most common)
Gravity Forms REST API keys are tied to a specific WordPress user. If that user is an Editor, Author, or any non-Admin role, they won’t have Gravity Forms capabilities by default.
Fix:
Go to Gravity Forms → Settings → REST API
Check which user the API key is assigned to
Make sure that user has the Administrator role in WordPress (Users → All Users)
2. The API Key was generated with the wrong permissions
When you create a GF REST API key, you choose Read, Write, or Read/Write. Zapier needs Read/Write.
Fix:
Go to Gravity Forms → Settings → REST API
Delete the existing key and create a new one
Set permissions to Read/Write
Re-authenticate in Zapier with the new key
3. Role-based capability issue (if using a non-Admin user intentionally)
If you want to use a non-Admin user, you need to explicitly grant them the gravityforms_edit_forms capability.
Fix — add this to your theme’s functions.php or a custom plugin:
php
// Run once, then remove this code
add_action('init', function() {
$user = get_user_by('login', 'your-api-username');
if ($user) {
$user->add_cap('gravityforms_edit_forms');
$user->add_cap('gravityforms_view_entries');
$user->add_cap('gravityforms_edit_entries');
}
});
Recommended Action Order
Check the API key’s associated user role first — this resolves it 90% of the time
Regenerate the key with Read/Write if the role is correct but it still fails
Re-authenticate Zapier after any key change (the old key will be invalid)
The hosting response confirms this isn’t a network/firewall problem — the requests are reaching WordPress and returning 200/301. WordPress is receiving them fine; it’s just rejecting the action internally due to insufficient permissions.