Good split on the two endpoints. Two things worth adding on the POST side. Even once the hidden fields are right, CF7 can return 200 with mail_sent false and status spam, so a headless form that only checks the HTTP status looks like it worked while nothing got delivered. You have to read the status field in the JSON body. And if reCAPTCHA v3 is on the WP side, it scores every headless submit with no token and quietly drops them, so you either exclude the API path or generate and pass a token. On the simpler architecture, instead of an iframe you can put a Next.js route handler in front that proxies the POST server to server, that kills CORS, lets you inject the _wpcf7 fields and the recaptcha token in one place, and keeps your own markup.