NetPad - Build forms, workflows and manage MongoDB data

v1.0.0

Manage NetPad forms, submissions, users, and RBAC. Use when: (1) Creating forms with custom fields, (2) Submitting data to forms, (3) Querying form submissions, (4) Managing users/groups/roles (RBAC), (5) Installing NetPad apps from marketplace. Requires NETPAD_API_KEY for API, or `netpad login` for CLI.

⭐ 3· 1.7k·0 current·0 all-time

byMichael Lynn@mrlynn

Security Scan

VirusTotal

Benign

View report →

OpenClaw

Suspicious

medium confidence

ℹ

Purpose & Capability

Name, description, CLI wrapper, and API docs align: the skill manages forms, submissions, RBAC and installs a netpad CLI via the @netpad/cli npm package. Required binaries (curl, jq, netpad) are appropriate for the stated purpose. However, the registry metadata lists no required environment variables while both SKILL.md and scripts/netpad.sh require NETPAD_API_KEY — an incoherence between declaration and actual needs.

✓

Instruction Scope

SKILL.md and the shell wrapper limit actions to calling NetPad REST endpoints or the netpad CLI and printing results. They instruct using a Bearer API key and provide example curl calls; there are no instructions to read unrelated local files or send data to third-party endpoints outside netpad.io. The wrapper does include an 'export NETPAD_API_KEY' example and uses NETPAD_BASE_URL override (which is reasonable).

✓

Install Mechanism

Install uses the npm package @netpad/cli to create the netpad binary. This is a standard distribution method for a CLI and is proportionate to the functionality. No arbitrary downloads or extract-from-unknown-URLs are present in the spec.

Credentials

The runtime clearly requires an API key (NETPAD_API_KEY) to call the service, but the registry metadata provided to the platform does not list any required environment variables or a primary credential. That mismatch is concerning because a user or automated installer may not be warned that they need to supply a secret. The wrapper also allows NETPAD_BASE_URL override (acceptable) but the skill does not declare these in its manifest.

✓

Persistence & Privilege

The skill is not always-enabled and does not request elevated platform privileges. It installs a CLI binary via npm (normal) and contains no code that attempts to modify other skills or system-wide agent settings. Autonomous invocation is enabled by default but not combined with other high-risk factors here.

What to consider before installing

Key things to consider before installing: (1) The skill requires an API key (NETPAD_API_KEY) even though the manifest omitted it — do not provide production credentials until you confirm trust. Use a test key if available. (2) Inspect the npm package @netpad/cli source (or its npm page and publisher) to ensure it’s legitimate and hasn’t been tampered with. (3) The included shell wrapper has coding bugs (e.g., add-field uses undefined variable names) — this suggests limited maintenance; test functionality in an isolated environment first. (4) Check where the netpad CLI stores credentials (local files, OS keychain) and whether it persists tokens; avoid giving long-lived production credentials until you’re comfortable. (5) If you need higher confidence, ask the publisher for source repo/homepage or a checksum for the npm package; presence of a well-known org website or GitHub repo would raise confidence.

Like a lobster shell, security has layers — review code before you run it.

Runtime requirements

📋 Clawdis

Binscurl, jq, netpad

Install

Install NetPad CLI (npm)

Bins: netpad

npm i -g @netpad/cli

latestvk97f86rx6anny2pjhf2m7bs40d809teb

1.7kdownloads

3stars

1versions

Updated 1mo ago

v1.0.0

MIT-0

NetPad

Manage forms, submissions, users, and RBAC via CLI and REST API.

Two Tools

Tool	Install	Purpose
`netpad` CLI	`npm i -g @netpad/cli`	RBAC, marketplace, packages
REST API	curl + API key	Forms, submissions, data

Authentication

export NETPAD_API_KEY="np_live_xxx"  # Production
export NETPAD_API_KEY="np_test_xxx"  # Test (can submit to drafts)

All requests use Bearer token:

curl -H "Authorization: Bearer $NETPAD_API_KEY" \
  "https://www.netpad.io/api/v1/..."

Quick Reference

Task	Endpoint	Method
List projects	`/projects`	GET
List forms	`/forms`	GET
Create form	`/forms`	POST
Get form	`/forms/{formId}`	GET
Update/publish form	`/forms/{formId}`	PATCH
Delete form	`/forms/{formId}`	DELETE
List submissions	`/forms/{formId}/submissions`	GET
Create submission	`/forms/{formId}/submissions`	POST
Get submission	`/forms/{formId}/submissions/{id}`	GET
Delete submission	`/forms/{formId}/submissions/{id}`	DELETE

Projects

Forms belong to projects. Get project ID before creating forms.

# List projects
curl -H "Authorization: Bearer $NETPAD_API_KEY" \
  "https://www.netpad.io/api/v1/projects" | jq '.data[] | {projectId, name}'

Forms

List Forms

curl -H "Authorization: Bearer $NETPAD_API_KEY" \
  "https://www.netpad.io/api/v1/forms?status=published&pageSize=50"

Create Form

curl -X POST -H "Authorization: Bearer $NETPAD_API_KEY" \
  -H "Content-Type: application/json" \
  "https://www.netpad.io/api/v1/forms" \
  -d '{
    "name": "Contact Form",
    "description": "Simple contact form",
    "projectId": "proj_xxx",
    "fields": [
      {"path": "name", "label": "Name", "type": "text", "required": true},
      {"path": "email", "label": "Email", "type": "email", "required": true},
      {"path": "phone", "label": "Phone", "type": "phone"},
      {"path": "message", "label": "Message", "type": "textarea"}
    ]
  }'

Get Form Details

curl -H "Authorization: Bearer $NETPAD_API_KEY" \
  "https://www.netpad.io/api/v1/forms/{formId}"

Publish Form

curl -X PATCH -H "Authorization: Bearer $NETPAD_API_KEY" \
  -H "Content-Type: application/json" \
  "https://www.netpad.io/api/v1/forms/{formId}" \
  -d '{"status": "published"}'

Update Form Fields

curl -X PATCH -H "Authorization: Bearer $NETPAD_API_KEY" \
  -H "Content-Type: application/json" \
  "https://www.netpad.io/api/v1/forms/{formId}" \
  -d '{
    "fields": [
      {"path": "name", "label": "Full Name", "type": "text", "required": true},
      {"path": "email", "label": "Email Address", "type": "email", "required": true},
      {"path": "company", "label": "Company", "type": "text"},
      {"path": "role", "label": "Role", "type": "select", "options": [
        {"value": "dev", "label": "Developer"},
        {"value": "pm", "label": "Product Manager"},
        {"value": "exec", "label": "Executive"}
      ]}
    ]
  }'

Delete Form

curl -X DELETE -H "Authorization: Bearer $NETPAD_API_KEY" \
  "https://www.netpad.io/api/v1/forms/{formId}"

Submissions

Submit Data

curl -X POST -H "Authorization: Bearer $NETPAD_API_KEY" \
  -H "Content-Type: application/json" \
  "https://www.netpad.io/api/v1/forms/{formId}/submissions" \
  -d '{
    "data": {
      "name": "John Doe",
      "email": "john@example.com",
      "message": "Hello from the API!"
    }
  }'

List Submissions

# Recent submissions
curl -H "Authorization: Bearer $NETPAD_API_KEY" \
  "https://www.netpad.io/api/v1/forms/{formId}/submissions?pageSize=50"

# With date filter
curl -H "Authorization: Bearer $NETPAD_API_KEY" \
  "https://www.netpad.io/api/v1/forms/{formId}/submissions?startDate=2026-01-01T00:00:00Z"

# Sorted ascending
curl -H "Authorization: Bearer $NETPAD_API_KEY" \
  "https://www.netpad.io/api/v1/forms/{formId}/submissions?sortOrder=asc"

Get Single Submission

curl -H "Authorization: Bearer $NETPAD_API_KEY" \
  "https://www.netpad.io/api/v1/forms/{formId}/submissions/{submissionId}"

Delete Submission

curl -X DELETE -H "Authorization: Bearer $NETPAD_API_KEY" \
  "https://www.netpad.io/api/v1/forms/{formId}/submissions/{submissionId}"

Field Types

Type	Description	Validation
`text`	Single line text	minLength, maxLength, pattern
`email`	Email address	Built-in validation
`phone`	Phone number	Built-in validation
`number`	Numeric input	min, max
`date`	Date picker	-
`select`	Dropdown	options: [{value, label}]
`checkbox`	Boolean	-
`textarea`	Multi-line text	minLength, maxLength
`file`	File upload	-

Field Schema

{
  "path": "fieldName",
  "label": "Display Label",
  "type": "text",
  "required": true,
  "placeholder": "Hint text",
  "helpText": "Additional guidance",
  "options": [{"value": "a", "label": "Option A"}],
  "validation": {
    "minLength": 1,
    "maxLength": 500,
    "pattern": "^[A-Z].*",
    "min": 0,
    "max": 100
  }
}

Common Patterns

Create and Publish Form

# 1. Create draft
RESULT=$(curl -s -X POST -H "Authorization: Bearer $NETPAD_API_KEY" \
  -H "Content-Type: application/json" \
  "https://www.netpad.io/api/v1/forms" \
  -d '{"name":"Survey","projectId":"proj_xxx","fields":[...]}')
FORM_ID=$(echo $RESULT | jq -r '.data.id')

# 2. Publish
curl -X PATCH -H "Authorization: Bearer $NETPAD_API_KEY" \
  -H "Content-Type: application/json" \
  "https://www.netpad.io/api/v1/forms/$FORM_ID" \
  -d '{"status":"published"}'

Export All Submissions

curl -H "Authorization: Bearer $NETPAD_API_KEY" \
  "https://www.netpad.io/api/v1/forms/{formId}/submissions?pageSize=1000" \
  | jq '.data[].data'

Bulk Submit

for row in $(cat data.json | jq -c '.[]'); do
  curl -s -X POST -H "Authorization: Bearer $NETPAD_API_KEY" \
    -H "Content-Type: application/json" \
    "https://www.netpad.io/api/v1/forms/{formId}/submissions" \
    -d "{\"data\":$row}"
done

Search Forms

curl -H "Authorization: Bearer $NETPAD_API_KEY" \
  "https://www.netpad.io/api/v1/forms?search=contact&status=published"

Helper Script

Use scripts/netpad.sh for common operations:

# Make executable
chmod +x scripts/netpad.sh

# Usage
./scripts/netpad.sh projects list
./scripts/netpad.sh forms list published
./scripts/netpad.sh forms create "Contact Form" proj_xxx
./scripts/netpad.sh forms publish frm_xxx
./scripts/netpad.sh submissions list frm_xxx
./scripts/netpad.sh submissions create frm_xxx '{"name":"John","email":"john@example.com"}'
./scripts/netpad.sh submissions export frm_xxx > data.jsonl
./scripts/netpad.sh submissions count frm_xxx

Rate Limits

Limit	Value
Requests/hour	1,000
Requests/day	10,000

Headers: X-RateLimit-Limit, X-RateLimit-Remaining, X-RateLimit-Reset

Response Format

Success

{
  "success": true,
  "data": { ... },
  "pagination": {"total": 100, "page": 1, "pageSize": 20, "hasMore": true},
  "requestId": "uuid"
}

Error

{
  "success": false,
  "error": {
    "code": "VALIDATION_ERROR",
    "message": "Description",
    "details": {}
  },
  "requestId": "uuid"
}

Environment Variables

# Required for REST API
export NETPAD_API_KEY="np_live_xxx"

# Optional (for local/staging)
export NETPAD_BASE_URL="https://staging.netpad.io/api/v1"

NetPad CLI (@netpad/cli)

Install: npm i -g @netpad/cli

Authentication

netpad login              # Opens browser
netpad whoami             # Check auth status
netpad logout             # Clear credentials

Marketplace & Packages

# Search for apps
netpad search "helpdesk"

# Install an app
netpad install @netpad/helpdesk-app

# List installed
netpad list

# Create new app scaffold
netpad create-app my-app

# Submit to marketplace
netpad submit ./my-app

RBAC - Users

# List org members
netpad users list -o org_xxx

# Add user
netpad users add user@example.com -o org_xxx --role member

# Change role
netpad users update user@example.com -o org_xxx --role admin

# Remove user
netpad users remove user@example.com -o org_xxx

RBAC - Groups

# List groups
netpad groups list -o org_xxx

# Create group
netpad groups create "Engineering" -o org_xxx

# Add user to group
netpad groups add-member grp_xxx user@example.com -o org_xxx

# Delete group
netpad groups delete grp_xxx -o org_xxx

RBAC - Roles

# List roles (builtin + custom)
netpad roles list -o org_xxx

# Create custom role
netpad roles create "Reviewer" -o org_xxx --base viewer --description "Can review submissions"

# View role details
netpad roles get role_xxx -o org_xxx

# Delete custom role
netpad roles delete role_xxx -o org_xxx

RBAC - Assignments

# Assign role to user
netpad assign user user@example.com role_xxx -o org_xxx

# Assign role to group
netpad assign group grp_xxx role_xxx -o org_xxx

# Remove assignment
netpad unassign user user@example.com role_xxx -o org_xxx

RBAC - Permissions

# List all permissions
netpad permissions list -o org_xxx

# Check user's effective permissions
netpad permissions check user@example.com -o org_xxx

References

references/api-endpoints.md — Complete REST API endpoint docs
references/cli-commands.md — Full CLI command reference

Author

Michael Lynn — Principal Staff Developer Advocate at MongoDB

🌐 Website: mlynn.org
🐙 GitHub: @mrlynn
💼 LinkedIn: linkedin.com/in/mlynn

Comments

Loading comments...