Reference
API reference
Request formats, response shapes, status codes, and CORS behaviour.
Endpoint
POST https://api.formpost.ai/submitAccepted content types
- application/json — returns JSON
- application/x-www-form-urlencoded — classic form post
- multipart/form-data — required when sending files
The endpoint decides how to answer based on your request. Send Accept: application/json (or post JSON) and you get JSON back. A plain browser form post gets a 303 redirect instead, so the visitor lands on a real page.
Successful response
{
"success": true,
"message": "Thanks — your message has been sent."
}Status codes
| Code | Meaning |
|---|---|
| 200 | Accepted. Also returned when the honeypot fires, so bots learn nothing. |
| 400 | Malformed request or missing access_key. |
| 401 | The access key does not exist. |
| 403 | Form disabled, or the request came from a domain that is not allowed. |
| 413 | An attachment is larger than the plan allows. |
| 422 | Captcha verification failed, or the submission was empty. |
| 429 | Rate limited, or the form is over its monthly quota. |
| 500 | Something failed on our side. Safe to retry. |
CORS
The endpoint sends Access-Control-Allow-Origin: * and answers preflight requests, so browser-side fetch works from any origin. If you want to restrict who can post to your key, use domain locking in the form settings — that check runs on our side and cannot be bypassed by the browser.
Rate limits
Eight submissions per minute per IP address, per form. Legitimate humans never hit this; scripted abuse does. Exceeding it returns 429 without consuming your monthly quota.