Creating & Managing Forms

Everything you need to know about creating, configuring, and maintaining forms in Submito.

Creating a new form

There are two ways to create a form inside a workspace:

Click the + icon next to Forms in the sidebar. This is the fastest path when you already know which workspace you are working in.
Navigate to the Forms page and click New form in the top right corner.

Enter a name for the form. The name is for your own reference - it is never exposed to visitors submitting data. Choose something descriptive, like Contact form, Project enquiry, or Newsletter signup.

Form endpoint URL and public ID

Each form is assigned a unique public ID when it is created. This ID is used to construct the form endpoint - the URL your HTML form or JavaScript code posts data to.

POSThttps://api.submi.to/f/{form_id}

Submit data to a form. Accepts application/x-www-form-urlencoded (HTML forms) or application/json (API / fetch).

You can find and copy the endpoint from the form overview page in the dashboard. The public ID is safe to include in client-side HTML and JavaScript - it does not reveal any account or workspace information.

contact.html

<form action="https://api.submi.to/f/abc123xyz" method="POST">
  <input type="text"  name="name"    required />
  <input type="email" name="email"   required />
  <textarea           name="message"          ></textarea>
  <button type="submit">Send</button>
</form>

Redirect after submission

When a visitor submits an HTML form, Submito redirects them back to the referring page by default. Configure a custom redirect URL in the form settings to send them to a dedicated thank-you page instead.

Form settings

Open a form and click Settings in the left navigation to access its configuration. Settings are grouped into sections described below.

Enable / disable the form

Toggle the Accept submissions switch to control whether the form is open. When disabled, any POST request to the endpoint returns a 422 error with the message "This form is not currently accepting submissions."

Disabling a form is useful when a project has concluded, a campaign has ended, or you are temporarily pausing intake while reviewing a backlog of leads.

Custom redirect URL

By default Submito redirects visitors back to the page they submitted from (using the Referer header). Set a Custom redirect URL to send them to a specific page after a successful submission - typically a thank-you or confirmation page on the client's site.

The redirect URL must be an absolute URL including the scheme, for example:

https://example.com/thank-you

Redirect only applies to HTML form submissions

When you post JSON via fetch or another HTTP client, Submito returns a JSON response instead of redirecting. Handle the success state in your JavaScript code.

Dynamic vs strict field mode

Submito offers two modes for how it handles incoming field data:

Dynamic mode (default) - any field name included in a submission is stored, even if it was not declared in advance. This is the quickest way to get started: just point your form at the endpoint and Submito captures everything.
Strict mode - only fields you have explicitly defined in the form configuration are accepted. Any extra field names are silently ignored. Use strict mode when you want a predictable, fixed schema or when you are processing the data downstream and need consistent column names.

Switching from dynamic to strict mode

If you switch an existing form to strict mode, make sure you have defined all the field names your HTML form submits. Any field not listed will be dropped from new submissions - existing submissions are not affected.

Rate limiting

Rate limiting restricts how many submissions a single IP address can send within a rolling time window. This reduces spam and abuse without requiring a CAPTCHA.

Configure two values under Rate limiting in the form settings:

Max submissions - the maximum number of submissions allowed from a single IP within the window.
Window (minutes) - the length of the rolling time window.

When the limit is exceeded, the endpoint returns a 429 Too Many Requests response. For HTML form visitors this renders as an error page. For JSON requests the response body explains the limit.

A common configuration for a contact form is 5 submissions per 10 minutes. Set the max submissions to 0 to disable rate limiting entirely for that form.

Duplicating forms

To duplicate a form, open its settings and click Duplicate form at the bottom of the page. A new form will be created in the same workspace with all settings copied - including field definitions, redirect URL, and rate limit configuration.

The duplicate is created with a new public ID and is disabled by default. Update the name, review the settings, then enable it when you are ready to start receiving submissions.

Submissions are not duplicated

Duplicating a form copies its configuration only. Existing submissions from the original form are not carried over to the duplicate.

Deleting forms

To permanently delete a form, open its settings and scroll to the Danger zone section. Click Delete form and confirm by typing the form name.

Deletion is permanent

Deleting a form removes all of its submissions, pipeline stages, integrations, and settings permanently. This action cannot be undone. If you just want to stop accepting new submissions temporarily, disable the form instead.

Any existing HTML forms on your site that point to the deleted endpoint will receive a 404 response after deletion. Update the endpoint URL on your site before or immediately after deleting.

Several form-level features are covered in dedicated articles:

Spam protection - configure Cloudflare Turnstile, Google reCAPTCHA v3, or hCaptcha to block bot submissions at the point of entry.
Email notifications - set up instant alerts or a daily digest to be notified when new submissions arrive.
Webhooks - forward submissions in real time to external services such as Zapier, Make, Slack, or a custom HTTP endpoint.
Submission pipeline - define stages to track leads through your review workflow from first contact to close.