Submit Saved Form

POST

api

forms

{formId}

Submit Saved Form

curl --request POST \
  --url https://api.sequenzy.com/api/v1/forms/{formId} \
  --header 'Authorization: Bearer <token>' \
  --header 'Content-Type: application/json' \
  --data '
{
  "email": "<string>",
  "firstName": "<string>",
  "lastName": "<string>",
  "phone": "<string>",
  "customAttributes[fieldKey]": "<string>",
  "customAttributes": {},
  "website": "<string>",
  "sequenzyToken": "<string>",
  "sequenzyBotCheckToken": "<string>"
}
'

import requests

url = "https://api.sequenzy.com/api/v1/forms/{formId}"

payload = {
    "email": "<string>",
    "firstName": "<string>",
    "lastName": "<string>",
    "phone": "<string>",
    "customAttributes[fieldKey]": "<string>",
    "customAttributes": {},
    "website": "<string>",
    "sequenzyToken": "<string>",
    "sequenzyBotCheckToken": "<string>"
}
headers = {
    "Authorization": "Bearer <token>",
    "Content-Type": "application/json"
}

response = requests.post(url, json=payload, headers=headers)

print(response.text)

const options = {
  method: 'POST',
  headers: {Authorization: 'Bearer <token>', 'Content-Type': 'application/json'},
  body: JSON.stringify({
    email: '<string>',
    firstName: '<string>',
    lastName: '<string>',
    phone: '<string>',
    'customAttributes[fieldKey]': '<string>',
    customAttributes: {},
    website: '<string>',
    sequenzyToken: '<string>',
    sequenzyBotCheckToken: '<string>'
  })
};

fetch('https://api.sequenzy.com/api/v1/forms/{formId}', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

<?php

$curl = curl_init();

curl_setopt_array($curl, [
  CURLOPT_URL => "https://api.sequenzy.com/api/v1/forms/{formId}",
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_ENCODING => "",
  CURLOPT_MAXREDIRS => 10,
  CURLOPT_TIMEOUT => 30,
  CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
  CURLOPT_CUSTOMREQUEST => "POST",
  CURLOPT_POSTFIELDS => json_encode([
    'email' => '<string>',
    'firstName' => '<string>',
    'lastName' => '<string>',
    'phone' => '<string>',
    'customAttributes[fieldKey]' => '<string>',
    'customAttributes' => [
        
    ],
    'website' => '<string>',
    'sequenzyToken' => '<string>',
    'sequenzyBotCheckToken' => '<string>'
  ]),
  CURLOPT_HTTPHEADER => [
    "Authorization: Bearer <token>",
    "Content-Type: application/json"
  ],
]);

$response = curl_exec($curl);
$err = curl_error($curl);

curl_close($curl);

if ($err) {
  echo "cURL Error #:" . $err;
} else {
  echo $response;
}

package main

import (
	"fmt"
	"strings"
	"net/http"
	"io"
)

func main() {

	url := "https://api.sequenzy.com/api/v1/forms/{formId}"

	payload := strings.NewReader("{\n  \"email\": \"<string>\",\n  \"firstName\": \"<string>\",\n  \"lastName\": \"<string>\",\n  \"phone\": \"<string>\",\n  \"customAttributes[fieldKey]\": \"<string>\",\n  \"customAttributes\": {},\n  \"website\": \"<string>\",\n  \"sequenzyToken\": \"<string>\",\n  \"sequenzyBotCheckToken\": \"<string>\"\n}")

	req, _ := http.NewRequest("POST", url, payload)

	req.Header.Add("Authorization", "Bearer <token>")
	req.Header.Add("Content-Type", "application/json")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(string(body))

}

HttpResponse<String> response = Unirest.post("https://api.sequenzy.com/api/v1/forms/{formId}")
  .header("Authorization", "Bearer <token>")
  .header("Content-Type", "application/json")
  .body("{\n  \"email\": \"<string>\",\n  \"firstName\": \"<string>\",\n  \"lastName\": \"<string>\",\n  \"phone\": \"<string>\",\n  \"customAttributes[fieldKey]\": \"<string>\",\n  \"customAttributes\": {},\n  \"website\": \"<string>\",\n  \"sequenzyToken\": \"<string>\",\n  \"sequenzyBotCheckToken\": \"<string>\"\n}")
  .asString();

require 'uri'
require 'net/http'

url = URI("https://api.sequenzy.com/api/v1/forms/{formId}")

http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true

request = Net::HTTP::Post.new(url)
request["Authorization"] = 'Bearer <token>'
request["Content-Type"] = 'application/json'
request.body = "{\n  \"email\": \"<string>\",\n  \"firstName\": \"<string>\",\n  \"lastName\": \"<string>\",\n  \"phone\": \"<string>\",\n  \"customAttributes[fieldKey]\": \"<string>\",\n  \"customAttributes\": {},\n  \"website\": \"<string>\",\n  \"sequenzyToken\": \"<string>\",\n  \"sequenzyBotCheckToken\": \"<string>\"\n}"

response = http.request(request)
puts response.read_body

{"success": true}

Location: https://example.com/thank-you

{ "success": false, "message": "Please enter a valid email address" }

{
  "success": false,
  "message": "We couldn't verify this signup. Please try again."
}

{ "success": false, "message": "This email address cannot be subscribed" }

{ "success": false, "message": "Invalid form configuration" }

{ "success": false, "message": "Too many requests. Please try again later." }

{ "success": false, "message": "An error occurred. Please try again." }

You can submit a saved signup form created in the dashboard without an API key. The endpoint accepts application/x-www-form-urlencoded form posts and JSON. The form’s stored settings are the source of truth for audience targeting (lists, tags) and success behavior (success message or redirect URL). When you change those settings in the dashboard, deployed embeds pick them up automatically - no re-embedding needed. List, tag, and redirect values in the request are ignored.

This endpoint returns 410 Gone while the workspace is connected to Webflow. Webflow-connected workspaces accept only configured native Webflow form submissions delivered by signed Webflow webhooks.

Request

string

required

The saved form ID. You can find it in the form’s embed code on the Forms screen.

string

required

The subscriber’s email address.

string

The subscriber’s first name.

string

The subscriber’s last name.

string

The subscriber’s phone number when the saved form includes a phone field. It is normalized onto the base subscriber profile without changing SMS consent.

string

Value for a custom field configured on the saved form. The fieldKey is stored as a subscriber custom attribute, for example customAttributes[nickname]=Ace.

object

JSON alternative for custom integrations. Saved forms only accept keys that are configured as custom fields on the form. A hidden field that has a configured value always stores that value and ignores the submitted one; a hidden field with no configured value stores what you submit. See Update Saved Form for the field schema.

string

Honeypot field. Leave it empty.

string

Signed bot-protection token. The hosted embed script adds it automatically; custom integrations can omit it. See Bot protection.

string

Cloudflare Turnstile token that the hosted embed script adds when bot protection is on. Custom integrations cannot obtain one; see Bot protection.

Generated saved-form HTML renders built-in name fields first, then email, then configured custom fields before the submit button. Custom fields cannot currently be interleaved with built-in fields.

curl -X POST "https://api.sequenzy.com/api/v1/forms/form_abc123" \
  -H "Content-Type: application/x-www-form-urlencoded" \
  --data-urlencode "email=user@example.com" \
  --data-urlencode "customAttributes[nickname]=Ace"

Existing company-scoped saved form submission URLs continue to work.

Bot protection

The hosted embed script sends a signed sequenzyToken with each submission. It proves the signup came from a page that loaded your Sequenzy form, so Sequenzy can tell it apart from scripts that post directly to this endpoint.

You do not need to send a token from your own HTML or server code.
Submissions without a valid token may be asked to confirm by email before they become active subscribers.
When Sequenzy support turns on strict protection for your workspace after a bot attack, submissions without a token, or with a token issued for a different form, return the normal success response without subscribing anyone. Strict protection is only turned on when your signups all arrive through hosted embed scripts and popups. The native HTML and fetch snippets from the form code dialog do not send a token.

Bot protection toggle

When the form has botProtection on, the hosted embed script also runs a Cloudflare Turnstile check, invisibly for most visitors, and sends its result as sequenzyBotCheckToken.

Signups that pass are subscribed as usual.
Signups that fail the check, or arrive without a token (such as posts from the native HTML snippet, which cannot run the check), must confirm by email before they are subscribed.
If the confirmation email or sender was removed after bot protection was turned on, those signups get a 400 asking them to try again instead.
If Cloudflare cannot be reached, signups are accepted, so an outage never blocks them.

Returning unsubscribed contacts

Submitting again counts as a fresh opt-in. If a contact unsubscribed from all email, a new submission resubscribes them and restores the form’s lists, whatever the duplicateStrategy. When the form’s resubscribeBehavior is double_opt_in, or workspace double opt-in is on, they get your confirmation email instead and are resubscribed once they confirm. Contacts whose address bounced or who marked your email as spam are not resubscribed. The response is the same in every case, so it never reveals whether an address was subscribed.

Responses

Native HTML form posts that accept text/html receive a hosted confirmation page that mirrors the form’s success screen (checkmark, heading, and message) instead of JSON. Forms configured to redirect respond with a 303 to the stored redirect URL.

{"success": true}

Location: https://example.com/thank-you

{ "success": false, "message": "Please enter a valid email address" }

{
  "success": false,
  "message": "We couldn't verify this signup. Please try again."
}

{ "success": false, "message": "This email address cannot be subscribed" }

{ "success": false, "message": "Invalid form configuration" }

{ "success": false, "message": "Too many requests. Please try again later." }

{ "success": false, "message": "An error occurred. Please try again." }

Submit Saved Form

curl --request POST \
  --url https://api.sequenzy.com/api/v1/forms/{formId} \
  --header 'Authorization: Bearer <token>' \
  --header 'Content-Type: application/json' \
  --data '
{
  "email": "<string>",
  "firstName": "<string>",
  "lastName": "<string>",
  "phone": "<string>",
  "customAttributes[fieldKey]": "<string>",
  "customAttributes": {},
  "website": "<string>",
  "sequenzyToken": "<string>",
  "sequenzyBotCheckToken": "<string>"
}
'

import requests

url = "https://api.sequenzy.com/api/v1/forms/{formId}"

payload = {
    "email": "<string>",
    "firstName": "<string>",
    "lastName": "<string>",
    "phone": "<string>",
    "customAttributes[fieldKey]": "<string>",
    "customAttributes": {},
    "website": "<string>",
    "sequenzyToken": "<string>",
    "sequenzyBotCheckToken": "<string>"
}
headers = {
    "Authorization": "Bearer <token>",
    "Content-Type": "application/json"
}

response = requests.post(url, json=payload, headers=headers)

print(response.text)

const options = {
  method: 'POST',
  headers: {Authorization: 'Bearer <token>', 'Content-Type': 'application/json'},
  body: JSON.stringify({
    email: '<string>',
    firstName: '<string>',
    lastName: '<string>',
    phone: '<string>',
    'customAttributes[fieldKey]': '<string>',
    customAttributes: {},
    website: '<string>',
    sequenzyToken: '<string>',
    sequenzyBotCheckToken: '<string>'
  })
};

fetch('https://api.sequenzy.com/api/v1/forms/{formId}', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

<?php

$curl = curl_init();

curl_setopt_array($curl, [
  CURLOPT_URL => "https://api.sequenzy.com/api/v1/forms/{formId}",
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_ENCODING => "",
  CURLOPT_MAXREDIRS => 10,
  CURLOPT_TIMEOUT => 30,
  CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
  CURLOPT_CUSTOMREQUEST => "POST",
  CURLOPT_POSTFIELDS => json_encode([
    'email' => '<string>',
    'firstName' => '<string>',
    'lastName' => '<string>',
    'phone' => '<string>',
    'customAttributes[fieldKey]' => '<string>',
    'customAttributes' => [
        
    ],
    'website' => '<string>',
    'sequenzyToken' => '<string>',
    'sequenzyBotCheckToken' => '<string>'
  ]),
  CURLOPT_HTTPHEADER => [
    "Authorization: Bearer <token>",
    "Content-Type: application/json"
  ],
]);

$response = curl_exec($curl);
$err = curl_error($curl);

curl_close($curl);

if ($err) {
  echo "cURL Error #:" . $err;
} else {
  echo $response;
}

package main

import (
	"fmt"
	"strings"
	"net/http"
	"io"
)

func main() {

	url := "https://api.sequenzy.com/api/v1/forms/{formId}"

	payload := strings.NewReader("{\n  \"email\": \"<string>\",\n  \"firstName\": \"<string>\",\n  \"lastName\": \"<string>\",\n  \"phone\": \"<string>\",\n  \"customAttributes[fieldKey]\": \"<string>\",\n  \"customAttributes\": {},\n  \"website\": \"<string>\",\n  \"sequenzyToken\": \"<string>\",\n  \"sequenzyBotCheckToken\": \"<string>\"\n}")

	req, _ := http.NewRequest("POST", url, payload)

	req.Header.Add("Authorization", "Bearer <token>")
	req.Header.Add("Content-Type", "application/json")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(string(body))

}

HttpResponse<String> response = Unirest.post("https://api.sequenzy.com/api/v1/forms/{formId}")
  .header("Authorization", "Bearer <token>")
  .header("Content-Type", "application/json")
  .body("{\n  \"email\": \"<string>\",\n  \"firstName\": \"<string>\",\n  \"lastName\": \"<string>\",\n  \"phone\": \"<string>\",\n  \"customAttributes[fieldKey]\": \"<string>\",\n  \"customAttributes\": {},\n  \"website\": \"<string>\",\n  \"sequenzyToken\": \"<string>\",\n  \"sequenzyBotCheckToken\": \"<string>\"\n}")
  .asString();

require 'uri'
require 'net/http'

url = URI("https://api.sequenzy.com/api/v1/forms/{formId}")

http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true

request = Net::HTTP::Post.new(url)
request["Authorization"] = 'Bearer <token>'
request["Content-Type"] = 'application/json'
request.body = "{\n  \"email\": \"<string>\",\n  \"firstName\": \"<string>\",\n  \"lastName\": \"<string>\",\n  \"phone\": \"<string>\",\n  \"customAttributes[fieldKey]\": \"<string>\",\n  \"customAttributes\": {},\n  \"website\": \"<string>\",\n  \"sequenzyToken\": \"<string>\",\n  \"sequenzyBotCheckToken\": \"<string>\"\n}"

response = http.request(request)
puts response.read_body

{"success": true}

Location: https://example.com/thank-you

{ "success": false, "message": "Please enter a valid email address" }

{
  "success": false,
  "message": "We couldn't verify this signup. Please try again."
}

{ "success": false, "message": "This email address cannot be subscribed" }

{ "success": false, "message": "Invalid form configuration" }

{ "success": false, "message": "Too many requests. Please try again later." }

{ "success": false, "message": "An error occurred. Please try again." }

​Request

​Bot protection

​Bot protection toggle

​Returning unsubscribed contacts

​Responses

Request

Bot protection

Bot protection toggle

Returning unsubscribed contacts

Responses