What is the GET endpoint for?

Returns public schema, embed submit token, and optional Turnstile site key.

What status code is validation failure?

422 with field-level errors; 403 for auth, origin, or Turnstile failures.

Is OPTIONS supported?

Yes, for CORS preflight from allowed browser origins.

Must I send the honeypot field?

If it exists in the schema, send it empty or omit it on trusted native clients per docs.

Where do I get a personal API key?

Dashboard → My account → Personal API keys. Keys are shown once at creation.

How does submission pagination work?

Pass nextCursor.before and nextCursor.sid as the before and sid query parameters until hasMore is false.

Upgrade to Pro

View .md

The MuxForms API accepts POST JSON at /api/v1/forms/{formId}/submit (per-form ingest secret) and GET /api/v1/forms/{formId}/submissions (personal API key from My account). Browser embeds use submit tokens from GET schema instead of secrets.

Docs

Form API

Submit JSON with a per-form ingest secret or list submissions with a personal API key from My account. Browser embeds use CORS and a submit token from GET schema.

API basics

Item	Value
Submit	POST /api/v1/forms/{id}/submit
List submissions	GET /api/v1/forms/{id}/submissions
Auth (submit)	ingsec_… ingest secret
Auth (list)	mfk_… personal API key
Max body (submit)	64 KB

Submit endpoint

POST https://www.muxforms.com/api/v1/forms/{formId}/submit
Content-Type: application/json
Authorization: Bearer ingsec_xxxxxxxx
X-MuxForms-Ingest-Secret: ingsec_xxxxxxxx

{
  "email": "lead@example.com",
  "message": "Need a demo next week"
}

Field names must match the form schema. Include the honeypot field as empty if you render it. OPTIONS is supported for browser CORS.

Responses

Success returns JSON confirming the submission. 413 means the JSON body exceeded 64 KB. 403 means missing ingest secret, invalid submit token, failed Turnstile, or a browser origin not on the allowlist. 422 includes per-field length limits (5,000 characters by default). 429 means rate limited.

GET https://www.muxforms.com/api/v1/forms/{formId} returns the public schema, a submitToken for embeds, and optional Turnstile site key.

List submissions

Create a personal API key under Dashboard → My account (starts with mfk_). Use it to fetch submissions for forms you own—no browser CORS.

GET https://www.muxforms.com/api/v1/forms/{formId}/submissions?limit=50
Authorization: Bearer mfk_xxxxxxxx
X-MuxForms-Api-Key: mfk_xxxxxxxx

# Optional cursor pagination (newest first):
GET .../submissions?before=2026-10-01T12:00:00.000Z&sid=SUBMISSION_UUID

Response: { submissions, hasMore, nextCursor }. Each submission includes payload, origin, and timestamps. limit is 1–100 (default 50). 401 means a missing or revoked key; 404 means the form id is not yours.

For real-time push, use a signed webhook instead of polling.

Common questions

What is the GET endpoint for?: Returns public schema, embed submit token, and optional Turnstile site key.
What status code is validation failure?: 422 with field-level errors; 403 for auth, origin, or Turnstile failures.
Is OPTIONS supported?: Yes, for CORS preflight from allowed browser origins.
Must I send the honeypot field?: If it exists in the schema, send it empty or omit it on trusted native clients per docs.
Where do I get a personal API key?: Dashboard → My account → Personal API keys. Keys are shown once at creation.
How does submission pagination work?: Pass nextCursor.before and nextCursor.sid as the before and sid query parameters until hasMore is false.

Point the app at one URL.

Same form id on the website and in Expo.

Upgrade to Pro