Skip to main content
The public submission endpoint. No authentication required.

​
Endpoint

{slug} is the 12-character ID at the end of your form’s endpoint URL, shown in the Setup tab of the form. Accepts application/json, application/x-www-form-urlencoded, and multipart/form-data.

​
HTML form usage

Each input’s name becomes a key in the stored submission. Repeated names (for example a group of checkboxes) are stored as an array. If the form has a Redirect URL set, the browser gets a 303 redirect there. Without one, the endpoint answers with the JSON below, so set a redirect URL for plain HTML forms.

​
API / JSON usage

Requests sent as JSON (or with Accept: application/json) always get JSON back, even when a redirect URL is set.

​
Response codes

Errors return { "error": "<message>" }.

​
Files

Multipart uploads are accepted, but files are not stored. A file field is saved as a placeholder string such as [File: resume.pdf, 48213 bytes]. If you need attachments, upload them to your own storage and submit the URL as a text field.

​
Spam protection

  • Honeypot: set a Honeypot Field Name in the form’s Setup tab (for example _gotcha) and add a hidden input with that name. Submissions that fill it get a normal success response but are not stored.
  • CAPTCHA: Google reCAPTCHA and hCaptcha are supported. Send the widget’s token as g-recaptcha-response or h-captcha-response. Set the secret key with PATCH /api/v1/forms/{id} (recaptchaSecret). It isn’t in the dashboard UI yet. Tokens are removed before the submission is stored.

​
CORS

By default any origin can submit. To restrict it, list origins under Allowed Origins in the form’s Setup tab. Requests from other origins get 403.

​
Rate limiting

Default: 10 requests per minute per IP, per form. You can change it with PATCH /api/v1/forms/{id} (rateLimit, 1 to 1000). It isn’t in the dashboard UI yet. When rate limited, the response includes a Retry-After header with the seconds until the limit resets.

​
Monthly limit

Each account can store 100 submissions per month (UTC calendar month). Past that, the endpoint returns 403 until the 1st.