Automette docs

List a form's webhooks

GET
/api/v1/forms/{id}/webhooks

Authorization

ApiKeyAuth
AuthorizationBearer <token>

API key from Settings → API Keys.

In: header

Path Parameters

id*string

Response Body

application/json

application/json

application/json

curl -X GET "https://example.com/api/v1/forms/string/webhooks"
{  "webhooks": [    {      "id": "string",      "self": "http://example.com",      "url": "http://example.com",      "events": [        "string"      ],      "active": true,      "secret": "string",      "secret_hint": "string",      "failure_count": 0,      "created_at": "2019-08-24T14:15:22Z"    }  ]}

Submit to a form POST

Submit to your own form from a server, with your API key instead of a captcha. The answers go through the same lifecycle as a response typed into the form: they are validated against the current published version, the close state and submission cap are enforced, and — when the form is connected to a template — the document is generated in the background. Keys are the form's field keys; `GET /api/v1/forms/{id}` lists them. For `image` and `file` fields, send the key returned by `POST /api/forms/{id}/upload`, which needs no authentication. Spam protection does not apply on this path. Your API key already establishes who is calling, which is the thing a captcha is a rough substitute for — so a form can keep its captcha on for the public page while your integration posts to it directly. The response returns as soon as the submission is stored, before the document exists. Read it back with `GET`, whose `document` field carries the status and URL, or subscribe to `render.completed`. **This is not the way to generate a document from code.** `POST /api/v1/renders` is: it takes your data and returns the file. Use this endpoint when you want what the form adds on top — the response lands in the inbox and the CSV export, webhooks fire, notification and confirmation emails send, and the answers validate against the published version, so its field keys and template field map are not restated on every call. That makes it the right path for a custom front-end you host yourself, for backfilling responses from another form product, and for exercising your own pipeline without turning spam protection off.

Add a webhook to a form POST

Registers an endpoint for this form's `form.submitted` event. Up to five per form. The response is the **only** time you see the full `secret`. Store it — you need it to verify the signature on every delivery, and a form provisioned entirely through the API has no other way to obtain it. Deliveries follow the [Standard Webhooks](https://www.standardwebhooks.com/) spec: `webhook-id`, `webhook-timestamp`, and `webhook-signature` (`v1,<base64>`), an HMAC-SHA256 over `{webhook-id}.{webhook-timestamp}.{raw-body}`. `webhook-id` is `evt_form_<submissionId>`, stable across retries — use it to deduplicate. See [Webhooks](/docs/delivery/webhooks) for verification code.