Secure form intake for modern websites.

1. Step 1

   Create a Site using the website's canonical domain.

2. Step 2

   Create a Hook for the form or workflow.

3. Step 3

   Configure notification routing, allowed origins, and optional approved-webhook delivery.

4. Step 4

   Build the visible form in the website or install a maintained adapter.

5. Step 5

   Submit the browser form to a same-origin site handler.

6. Step 6

   Validate the request and verify Turnstile or captcha before forwarding.

7. Step 7

   Forward the request to the Hook with the intake secret on the trusted server.

8. Step 8

   Run a safe test and verify Inbox, Activity, files, and expected delivery behavior.

Use this request to verify Hook connectivity from a trusted terminal or server.

# Run from a trusted server or terminal only.
curl "$FORMBOX_HOOK_URL" \
  -H "Content-Type: application/json" \
  -H "X-FormBox-Secret: $FORMBOX_HOOK_SECRET" \
  --data '{
    "payload": {
      "name": "Test Lead",
      "email": "test@example.com",
      "message": "Testing FormBox intake"
    }
  }'

• The website owns field names, labels, validation, normalization, conditional logic, and required-state behavior.
• Use lowercase snake_case keys for business fields and keep the order hint aligned with the visible form.
• FormBox applies field order to notification emails, dashboard Submitted fields, API payloadFields, and CSV exports.
• Capture first-touch attribution before the visitor reaches the form and forward it as metadata, not payload.
• Supported reserved metadata fields use the _formbox_ prefix; never use that prefix for normal business fields.

An approved webhook is an optional outbound delivery for systems that should receive only AI-confirmed legitimate submissions. It is separate from client notification email.

• Configure a public HTTPS receiver and a dedicated signing secret together.
• The signing secret is write-only, encrypted at rest, and must not reuse the public intake secret.
• Private hosts, local addresses, and raw IP targets are rejected.
• FormBox withholds the webhook for spam, suspicious, uncertain, pending, failed, or unavailable AI review states.
• Webhook attempts use durable delivery records, retry behavior, and visible submission Activity.

POST /api/v1/provision-site-intake creates one Site and between 1 and 50 Hooks in one authenticated workflow for a website integration.

Use FormBox API keys for agents and automation. Send the key as a bearer token and grant only the scopes the workflow needs.