Ana içeriğe geç

Post a form submission from a connected web site's server (server key)

POST 
/api/intake/forms/:form/submissions

Doc 105 §4.2. The site's BACKEND posts a form its visitor filled in, with a site server key (sk_…, scope forms:submit). Server to server: no CORS is granted to the site. No captcha — the site has verified its visitor; the key proves it is the site.

The same checks as the hosted form (field values, required fields, a requested time still free) and the same pipeline: contact upsert when the form's destination.create_contact is on (the site's ready-made default form has it on), tags, consent recorded with the VISITOR's client_ip / user_agent as evidence, FormSubmitted and the form.submitted webhook. Source website.

A web_form attribution touch is recorded with the submission (attribution_touch_id), from attribution — the cw_attribution hidden field cw-attribution.js put into the form, as an object or its JSON text (a site forwarding the whole POST may leave cw_attribution / cw_event_id inside values). Consent rules as for recordWebsiteTouch; a top-level consent is merged over the one inside attribution (its keys win). consent.ad_measurement — the site form's optional "share for ad measurement" checkbox — is stored on the touch for the conversion sends to honour. Once a person is known the touch and every earlier touch of the same visitor_key become theirs. event_id (the Meta pixel / CAPI dedup key) is kept in the submission's meta.event_id.

IDEMPOTENT: send your own submission id as idempotency_key; the same key returns the submission it created (200, duplicate: true) with no second contact, consent, event or webhook — at any later time.

Request​

Responses​

The same idempotency_key again — the submission it created.