Accept submissions

The public submission endpoint is:

POST /s/v1/{environment}/{publicSubmissionId}

Supported media types are application/json, application/x-www-form-urlencoded, and multipart/form-data without file parts. Any multipart file rejects the entire request; files are never silently discarded.

Browser and server boundaries

  • Browser fetch requests use the form's exact published origin allowlist and never use credentials.
  • Production public-browser requests require an allowed Origin.
  • Server requests without Origin authenticate with Authorization: Bearer ....
  • Sandbox permits documented no-origin development tools such as curl.
  • Native HTML forms may use optional preconfigured success and error redirects.
  • JavaScript and server integrations always receive structured API responses.

HTML field normalization

Repeated names become ordered arrays. A constrained bracket grammar supports contact[email], tags[], and items[0][name]. Dot notation remains literal. Ambiguous scalar/container conflicts and unsafe property names are rejected.

Strict schemas may coerce canonical numeric strings and exact true or false strings. Flexible forms preserve HTML values as strings.

Idempotency

Server integrations send Idempotency-Key. Native HTML forms may send the exact reserved field _fc_idempotency_key. Records remain valid for 24 hours. Replaying identical content returns the original receipt with replay: true; different content returns 409.

Reserved anti-spam fields

  • _gotcha is the default honeypot. Keep it visually hidden from people but available to unsophisticated bots. A non-empty value is quarantined.
  • _fc_started_at is a Unix timestamp in milliseconds. When minimum-completion timing is enabled, submissions completed implausibly quickly are quarantined.
  • _fc_turnstile_token carries a Cloudflare Turnstile response when customer-configured Turnstile validation is enabled.

These fields are consumed by FormRoost and never appear in stored customer fields. A form may configure a different honeypot field name. Spam quarantine lasts 14 days, consumes no submission unit, and emits no webhook unless the account owner restores the lead.