Cannot access Form Builder forms as anonymous user

Question

I'm stumped trying to get Form Builder forms accessible to anonymous users. I've pared back one of the forms to its essentials: it only displays a text box. This works fine when I'm logged into the WordPress site on which CiviCRM is running, but if I access from another Microsoft Edge profile I get the following message: "Sorry, due to an error, we are unable to fulfill your request at the moment. You may want to contact your administrator or service provider with more details about what action you were performing when this occurred. You do not have permission to access this page." I've included two screenshots below: the first shows the bare bones of the test form and the second shows the error message with debugging/logging turned on. Any pointers to what I might check would be greatly appreciated.

These is the list of current permissions turned on for anonymous users:

• CiviCRM: access uploaded files
• CiviCRM: profile create
• CiviCRM: profile edit
• CiviCRM: profile view
• CiviCRM: access all custom data
• CiviCRM: view my invoices
• CiviEvent: register for events
• CiviEvent: view event info
• CiviContribute: make online contributions
• CiviMail: access CiviMail subscribe/unsubscribe pages
• CiviMail: view public CiviMail content
• CiviCampaign: sign CiviCRM Petition

Answer 1

The required permissions are specified in the FormBuilder config. Your screenshot shows "Permission: CiviCRM access CiviCRM backend API".

Change that to be something more suitable for this form's usage.

Answer 2

If you want the form to be accessible to anonymous users then you need to select "Allow All Users (Including Anonymous)" from the "Permissions" dropdown.

Answer 3

It turns out that anonymous also needs the permission CiviCRM: access CiviCRM backend and API (described as "Master control for access to the main CiviCRM backend and API. Give to trusted roles only.")

Perhaps there is a more secure way to achieve the same outcome?

Answer 4

One way of achieving this is to set the permission property in the *.aff.json to be an empty array, e.g.

{
  "title": "About you",
  "server_route": "civicrm/about-you",
  "is_public": true,
  "permission": []
}

It doesn't look like there is an easy way in the GUI to clear the permissions and I am not sure whether this is recommended practice (I couldn't find it documented), but it does work.

Answer 5

I have the same situation as you. After doing some testing, I found a working solution : set the form permission as "generic / allow all users (including anonymous)" Screenshot in French below.

What I don't know is how secure that is. I feel it is more ok than giving wide permissions at CMS level.

Feedbacks welcome, I am experimenting ;)