Forms
Form builder + lead capture — tenant-designed forms, their fields (the generic field engine), submissions, and the public submit surface.
List forms
List forms
Create a form
Create a form
Get a form (with its fields)
Get a form (with its fields)
Update a form
Update a form
Delete a form
Delete a form
Publish a form
Publish a form
Unpublish a form (back to draft)
Unpublish a form (back to draft)
Add a field to a form
Add a field to a form
Persist a new field order
Persist a new field order
Update a form field
Update a form field
Delete a form field
Delete a form field
List a form's submissions (paginated, 50 a page, newest first)
Each row carries its `attribution` (where it came from, doc 105 §4.1). `q` searches the ordinary answers only — never the encrypted sensitive ones. `ad_source` and `campaign` read the credited touch exactly as the leads page and the conversion reports do; `facets` lists the values this form's submissions actually have, for those two filters.
Download submissions as CSV
Download submissions as CSV
One submission with its source, person and conversation
The submission page (the panel's `/forms/{form}/submissions/{submission}`). The answers as `FormSubmission`, plus where they came from (`attribution`), the person they were filed under (`contact`) and the conversation they led to (`conversation`). Read with the submission's own rule: with a person, forms.view and that person; without one, forms.manage. A submission of another form is not found.
Delete a submission
Delete a submission
What may be done with a submission — every channel and call, with reasons
Doc 105 §4.4. Whether writing (on every channel the workspace has — `write`; the WhatsApp row alone — `whatsapp`) and 'Call' are possible for the person a submission is about, decided on the server with the reason when not. WhatsApp needs an E.164 phone, a WhatsApp channel this member may use and `conversations.reply`; inside the 24-hour customer window it is free text, outside it an approved template is needed (a MARKETING template counts only with the person's WhatsApp marketing consent). Call needs a phone and a line the dialler says may call. Reading follows the submission's own rule: with a contact, `forms.view` and that contact; without one, `forms.manage`.
Start writing or a call from a submission
Re-checks the action and records it in the audit log against the submission. `write` (with `channel_id`) and `whatsapp` open (or find) the thread through the same opener as `POST /api/compose/start` — nothing is sent; the client lands in the thread with the template picker open when `template_required`. `call` returns the number for the keypad, which places the call. A submission without a contact is matched to the number's owner, or the opener creates the contact.
Ready-made forms per purpose and sector (forms.manage)
Ready-made forms per purpose and sector (forms.manage)
Create a draft form from a template (forms.manage)
Create a draft form from a template (forms.manage)
Results at a glance — counts, option tallies, ratings, NPS (forms.manage)
Results at a glance — counts, option tallies, ratings, NPS (forms.manage)
Arm (or rotate) the front-desk kiosk link (forms.manage; feature form_requests)
Arm (or rotate) the front-desk kiosk link (forms.manage; feature form_requests)
Switch the kiosk link off (forms.manage)
Switch the kiosk link off (forms.manage)
The contact card's Forms tab — sent forms and answers (forms.view)
The contact card's Forms tab — sent forms and answers (forms.view)
Everything this person gave through forms, as data (KVKK portability; forms.view)
Sensitive answers are included only for forms.view_sensitive; `sensitive_omitted` says when they were left out.
Send a form to this contact — personal, expiring link (forms.send; feature form_requests)
Mints a personal link bound to the contact and, with a `conversation_id`, delivers it there through the composer's rules: free text inside the messaging window; outside it, only inside an approved WhatsApp `template` (409 `template_required` otherwise, and nothing is created). A MARKETING template to a contact still inside Meta's per-user marketing limit is refused with 409 `marketing_limit_cooldown` until `confirm_marketing_cooldown` is set. Submissions through the link are linked to this contact — never matched or created by e-mail/phone.
The published forms a sender may pick (forms.send)
The published forms a sender may pick (forms.send)
Send again — a new link (the old one stops working) and a fresh deadline (forms.send)
Send again — a new link (the old one stops working) and a fresh deadline (forms.send)
Withdraw a sent link (forms.send)
Withdraw a sent link (forms.send)
One answer set (forms.view; sensitive answers with forms.view_sensitive)
One answer set (forms.view; sensitive answers with forms.view_sensitive)
The signed copy as PDF (forms.view + forms.view_sensitive)
The signed copy as PDF (forms.view + forms.view_sensitive)
Record a withdrawn consent on top of the signed record (forms.manage)
Record a withdrawn consent on top of the signed record (forms.manage)
Free times for an appointment field (no auth)
Free times for an appointment field (no auth)
Public form schema (no auth — by public token; published only)
The renderable schema of a published form. `settings` is an ALLOWLIST, not the form's stored settings bag: staff notification addresses, the destination table and the contact field map are never published here. A field flagged `hidden` is the form's honeypot — render it in the DOM but out of reach of people (off-screen, `tabindex='-1'`, `aria-hidden`), and treat its `required` as false. Filling it marks the submission spam.
Submit a published form (no auth — by public token)
Submit a published form. The body may be a `{values:{…}}` envelope or a flat field map, plus the optional `__url` and `__utm` context.
Post a form submission from a connected web site's server (server key)
Doc 105 §4.2. The site's BACKEND posts a form its visitor filled in,