Form Backend API

Point any HTML form at /f/{id}: submissions are stored, e-mailed to you and forwarded to a webhook, with spam honeypot, Turnstile and origin allow-list.

GETPOSTPATCHDELETEhttps://apibox.io.vn/v1/form-endpoint

Web & SEO

POST /v1/form-endpoint creates a form and returns its public endpoint_url (https://apibox.io.vn/f/{id}) and a ready HTML snippet. Put that URL in <form action> on any static site or landing page: the receiver accepts application/x-www-form-urlencoded, multipart/form-data (file fields are dropped and noted) and JSON (fetch with CORS), up to 128 KB and 100 fields. Browser posts are redirected to your redirect_url (or a _next field on an allowed origin) or get a bilingual thank-you page; JSON / XHR calls get {"ok": true, "id"}. _subject sets the e-mail subject.

Spam protection: a hidden honeypot field (_gotcha by default; filled in = silently dropped and counted), an optional Cloudflare Turnstile check with your own secret key (turnstile_secret; add the widget to your form), allowed_origins (exact origins or https://*.example.vn), required_fields, and rate limits per form and per IP. Each stored submission is e-mailed to your verified account address (notify_email, sharing the daily e-mail caps of uptime monitors) and / or POSTed as JSON to your webhook_url ({"event": "form.submission", "form", "submission"}).

GET /v1/form-endpoint/{id}/submissions lists submissions newest first (limit, before cursor, since), format=csv exports them for Excel (UTF-8 BOM), DELETE removes one or all. PATCH /v1/form-endpoint/{id} changes settings (paused=true stops accepting). Forms belong to an account; each accepted submission counts one request of the owner’s quota. Plans: Free 2 forms, newest 100 submissions kept per form; Starter 20 forms, 2,000; Pro 100 forms, 10,000.

Parameters

Name	In	Type	Required	Default
`name`	body	string	no		Display name (max 100 characters).
`allowed_origins`	body	array	no		Origins allowed to post, e.g. `https://example.com`, `https://*.example.vn` (empty = any).
`redirect_url`	body	string	no		Thank-you page for browser submissions (303 redirect).
`honeypot_field`	body	string	no	`_gotcha`	Hidden field name; a filled-in value marks the submission as spam.
`required_fields`	body	array	no		Fields that must be present and non-empty.
`turnstile_secret`	body	string	no		Your Cloudflare Turnstile secret key; submissions then need a valid `cf-turnstile-response` (empty to remove). Never returned.
`notify_email`	body	boolean	no	`true`	E-mail each submission to the verified account address.
`webhook_url`	body	string	no		URL receiving a JSON POST per submission; empty to remove.
`paused`	body	boolean	no	`false`	Stop accepting submissions.
`id`	path	string	no		`/{id}` (GET, PATCH, POST, DELETE), `/{id}/submissions` (GET list / CSV, DELETE all), `/{id}/submissions/{sid}` (GET, DELETE).
`format`	query	string	no	`json`	`/{id}/submissions`: `json` or `csv`.
`limit`	query	number	no	`50`	`/{id}/submissions`: 1–500 (CSV up to 10,000).
`before`	query	string	no		`/{id}/submissions`: cursor (`next_before` of the previous page).

Example

curl -X POST "https://apibox.io.vn/v1/form-endpoint" \
  -H "Authorization: Bearer YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"name":"Liên hệ","allowed_origins":["https://shop.example.com","https://*.example.vn"],"redirect_url":"https://shop.example.com/cam-on","required_fields":["email"],"webhook_url":"https://hooks.example.net/form"}'

const res = await fetch('https://apibox.io.vn/v1/form-endpoint', {
  method: 'POST',
  headers: {
    Authorization: 'Bearer YOUR_API_KEY',
    'Content-Type': 'application/json',
  },
  body: JSON.stringify({
    "name": "Liên hệ",
    "allowed_origins": [
      "https://shop.example.com",
      "https://*.example.vn"
    ],
    "redirect_url": "https://shop.example.com/cam-on",
    "required_fields": [
      "email"
    ],
    "webhook_url": "https://hooks.example.net/form"
  }),
});
const data = await res.json();
console.log(data);

import requests

res = requests.post(
    "https://apibox.io.vn/v1/form-endpoint",
    headers={"Authorization": "Bearer YOUR_API_KEY"},
    json={"name": "Liên hệ", "allowed_origins": ["https://shop.example.com", "https://*.example.vn"], "redirect_url": "https://shop.example.com/cam-on", "required_fields": ["email"], "webhook_url": "https://hooks.example.net/form"},
    timeout=30,
)
print(res.json())

<?php
$ch = curl_init('https://apibox.io.vn/v1/form-endpoint');
curl_setopt_array($ch, [
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_CUSTOMREQUEST => 'POST',
    CURLOPT_HTTPHEADER => ['Authorization: Bearer YOUR_API_KEY', 'Content-Type: application/json'],
    CURLOPT_POSTFIELDS => '{"name":"Liên hệ","allowed_origins":["https://shop.example.com","https://*.example.vn"],"redirect_url":"https://shop.example.com/cam-on","required_fields":["email"],"webhook_url":"https://hooks.example.net/form"}',
]);
$response = curl_exec($ch);
print_r(json_decode($response, true));

Response

{
  "id": "0rwawcx0zfofbpnsuu1e",
  "name": "Liên hệ",
  "endpoint_url": "https://apibox.io.vn/f/0rwawcx0zfofbpnsuu1e",
  "allowed_origins": [
    "https://shop.example.com",
    "https://*.example.vn"
  ],
  "redirect_url": "https://shop.example.com/cam-on",
  "honeypot_field": "_gotcha",
  "required_fields": [
    "email"
  ],
  "turnstile": false,
  "notify_email": true,
  "webhook_url": "https://hooks.example.net/form",
  "paused": false,
  "submission_count": 0,
  "spam_count": 0,
  "last_submission_at": null,
  "created_at": "2026-11-11T03:21:15.000Z",
  "html_example": "<form action=\"https://apibox.io.vn/f/0rwawcx0zfofbpnsuu1e\" method=\"POST\">\n  <input type=\"email\" name=\"email\" required>\n  <textarea name=\"message\"></textarea>\n  <input type=\"text\" name=\"_gotcha\" style=\"display:none\" tabindex=\"-1\" autocomplete=\"off\">\n  <button type=\"submit\">Send</button>\n</form>"
}

Use cases

Collect contact or order forms on a landing page without a server
Receive leads from a static site in your inbox and CRM webhook
Export campaign sign-ups to Excel as CSV
Protect a public form with honeypot, Turnstile and an origin allow-list

FAQ

Do I need JavaScript on my page?

No. A plain <form action="https://apibox.io.vn/f/{id}" method="POST"> works; JSON with fetch() is supported too, with CORS for your allowed origins.

Can visitors upload files?

Not yet: file fields are dropped and their names are listed in _files_ignored. Link to a file instead.

Which e-mail receives submissions?

The verified e-mail address of the form owner’s account. E-mails share the daily caps of monitor alerts; the dashboard and the API always have every stored submission.

Form Backend API

Parameters

Example

Response

Use cases

FAQ

Related APIs

URL Metadata

HTTP Headers

Redirect Checker