Submit Saved Popup

POST

api

forms

popups

{popupId}

Submit Saved Popup

curl --request POST \
  --url https://api.sequenzy.com/api/v1/forms/popups/{popupId} \
  --header 'Authorization: Bearer <token>' \
  --header 'Content-Type: application/json' \
  --data '
{
  "email": "<string>",
  "firstName": "<string>",
  "lastName": "<string>",
  "phone": "<string>",
  "customAttributes[fieldKey]": "<string>",
  "website": "<string>",
  "sequenzyToken": "<string>",
  "sequenzyBotCheckToken": "<string>"
}
'

import requests

url = "https://api.sequenzy.com/api/v1/forms/popups/{popupId}"

payload = {
    "email": "<string>",
    "firstName": "<string>",
    "lastName": "<string>",
    "phone": "<string>",
    "customAttributes[fieldKey]": "<string>",
    "website": "<string>",
    "sequenzyToken": "<string>",
    "sequenzyBotCheckToken": "<string>"
}
headers = {
    "Authorization": "Bearer <token>",
    "Content-Type": "application/json"
}

response = requests.post(url, json=payload, headers=headers)

print(response.text)

const options = {
  method: 'POST',
  headers: {Authorization: 'Bearer <token>', 'Content-Type': 'application/json'},
  body: JSON.stringify({
    email: '<string>',
    firstName: '<string>',
    lastName: '<string>',
    phone: '<string>',
    'customAttributes[fieldKey]': '<string>',
    website: '<string>',
    sequenzyToken: '<string>',
    sequenzyBotCheckToken: '<string>'
  })
};

fetch('https://api.sequenzy.com/api/v1/forms/popups/{popupId}', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

<?php

$curl = curl_init();

curl_setopt_array($curl, [
  CURLOPT_URL => "https://api.sequenzy.com/api/v1/forms/popups/{popupId}",
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_ENCODING => "",
  CURLOPT_MAXREDIRS => 10,
  CURLOPT_TIMEOUT => 30,
  CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
  CURLOPT_CUSTOMREQUEST => "POST",
  CURLOPT_POSTFIELDS => json_encode([
    'email' => '<string>',
    'firstName' => '<string>',
    'lastName' => '<string>',
    'phone' => '<string>',
    'customAttributes[fieldKey]' => '<string>',
    'website' => '<string>',
    'sequenzyToken' => '<string>',
    'sequenzyBotCheckToken' => '<string>'
  ]),
  CURLOPT_HTTPHEADER => [
    "Authorization: Bearer <token>",
    "Content-Type: application/json"
  ],
]);

$response = curl_exec($curl);
$err = curl_error($curl);

curl_close($curl);

if ($err) {
  echo "cURL Error #:" . $err;
} else {
  echo $response;
}

package main

import (
	"fmt"
	"strings"
	"net/http"
	"io"
)

func main() {

	url := "https://api.sequenzy.com/api/v1/forms/popups/{popupId}"

	payload := strings.NewReader("{\n  \"email\": \"<string>\",\n  \"firstName\": \"<string>\",\n  \"lastName\": \"<string>\",\n  \"phone\": \"<string>\",\n  \"customAttributes[fieldKey]\": \"<string>\",\n  \"website\": \"<string>\",\n  \"sequenzyToken\": \"<string>\",\n  \"sequenzyBotCheckToken\": \"<string>\"\n}")

	req, _ := http.NewRequest("POST", url, payload)

	req.Header.Add("Authorization", "Bearer <token>")
	req.Header.Add("Content-Type", "application/json")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(string(body))

}

HttpResponse<String> response = Unirest.post("https://api.sequenzy.com/api/v1/forms/popups/{popupId}")
  .header("Authorization", "Bearer <token>")
  .header("Content-Type", "application/json")
  .body("{\n  \"email\": \"<string>\",\n  \"firstName\": \"<string>\",\n  \"lastName\": \"<string>\",\n  \"phone\": \"<string>\",\n  \"customAttributes[fieldKey]\": \"<string>\",\n  \"website\": \"<string>\",\n  \"sequenzyToken\": \"<string>\",\n  \"sequenzyBotCheckToken\": \"<string>\"\n}")
  .asString();

require 'uri'
require 'net/http'

url = URI("https://api.sequenzy.com/api/v1/forms/popups/{popupId}")

http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true

request = Net::HTTP::Post.new(url)
request["Authorization"] = 'Bearer <token>'
request["Content-Type"] = 'application/json'
request.body = "{\n  \"email\": \"<string>\",\n  \"firstName\": \"<string>\",\n  \"lastName\": \"<string>\",\n  \"phone\": \"<string>\",\n  \"customAttributes[fieldKey]\": \"<string>\",\n  \"website\": \"<string>\",\n  \"sequenzyToken\": \"<string>\",\n  \"sequenzyBotCheckToken\": \"<string>\"\n}"

response = http.request(request)
puts response.read_body

{"success": true}

{
  "success": true,
  "reward": { "value": "10% off your first order", "code": "WELCOME10" }
}

{ "success": true, "redirectUrl": "https://example.com/thank-you" }

{ "success": false, "message": "Please enter a valid email address" }

{
  "success": false,
  "message": "We couldn't verify this signup. Please try again."
}

{ "success": false, "message": "Invalid popup configuration" }

{ "success": false, "message": "Too many requests. Please try again later." }

{ "success": false, "message": "An error occurred. Please try again." }

Saved popup embeds submit here automatically. The popup’s stored content controls lists, tags, duplicate handling, resubscribe behavior, custom fields, and redirect behavior.

This endpoint returns 410 Gone while the workspace is connected to Webflow. Previously deployed popup scripts are no-ops; configure native Webflow form capture instead.

Request

The saved popup ID.

string

required

The subscriber’s email address.

string

The subscriber’s first name, when the popup includes that field.

string

The subscriber’s last name, when the popup includes that field.

string

The subscriber’s phone number when the popup includes that field. It is normalized onto the base subscriber profile without changing SMS consent.

string

Value for a custom popup field, stored as a subscriber custom attribute.

string

Honeypot field. Leave it empty.

string

Signed bot-protection token. The hosted popup script adds it automatically; custom integrations can omit it. See Bot protection.

string

Cloudflare Turnstile token that the hosted popup script adds when bot protection is on. Custom integrations cannot obtain one; see Bot protection.

curl -X POST "https://api.sequenzy.com/api/v1/forms/popups/popup_abc123" \
  -H "Content-Type: application/x-www-form-urlencoded" \
  --data-urlencode "email=user@example.com" \
  --data-urlencode "customAttributes[company_size]=42"

Bot protection

The hosted popup script sends a signed sequenzyToken with each submission. It proves the signup came from a page that loaded your Sequenzy popup, so Sequenzy can tell it apart from scripts that post directly to this endpoint.

You do not need to send a token from your own HTML or server code.
Submissions without a valid token may be asked to confirm by email before they become active subscribers.
When Sequenzy support turns on strict protection for your workspace after a bot attack, submissions without a token, or with a token issued for a different popup, return the normal success response without subscribing anyone. Strict protection is only turned on when your signups all arrive through hosted embed scripts and popups. The native HTML and fetch snippets from the form code dialog do not send a token.

Bot protection toggle

When the popup has botProtection on, the hosted popup script also runs a Cloudflare Turnstile check, invisibly for most visitors, and sends its result as sequenzyBotCheckToken.

Signups that pass are subscribed as usual.
Signups that fail the check, or arrive without a token, must confirm by email before they are subscribed.
If the confirmation email or sender was removed after bot protection was turned on, those signups get a 400 asking them to try again instead.
If Cloudflare cannot be reached, signups are accepted, so an outage never blocks them.

Returning unsubscribed contacts

Submitting again counts as a fresh opt-in. If a contact unsubscribed from all email, a new submission resubscribes them and restores the popup’s lists, whatever the duplicateStrategy. When the popup’s resubscribeBehavior is double_opt_in, or workspace double opt-in is on, they get your confirmation email instead and are resubscribed once they confirm. Contacts whose address bounced or who marked your email as spam are not resubscribed. The response is the same in every case, so it never reveals whether an address was subscribed.

Scratch-to-reveal rewards

When the popup has an enabled scratch-to-reveal reward, a successful response also includes reward: { "value": "...", "code": "..." | null }. The embed script never contains the value or code; this response is where the browser gets them. Every success response for that popup carries the same reward, including submissions ignored by bot and abuse protection, so the response never reveals whether the contact was stored. Error responses never include a reward. The reward is also saved on the contact as the discount custom attribute before any welcome automation starts, so {{discount.code}} in the welcome email matches what the visitor saw. A discount attribute the contact already has from another source is kept.

Responses

{"success": true}

{
  "success": true,
  "reward": { "value": "10% off your first order", "code": "WELCOME10" }
}

{ "success": true, "redirectUrl": "https://example.com/thank-you" }

{ "success": false, "message": "Please enter a valid email address" }

{
  "success": false,
  "message": "We couldn't verify this signup. Please try again."
}

{ "success": false, "message": "Invalid popup configuration" }

{ "success": false, "message": "Too many requests. Please try again later." }

{ "success": false, "message": "An error occurred. Please try again." }

Submit Saved Popup

curl --request POST \
  --url https://api.sequenzy.com/api/v1/forms/popups/{popupId} \
  --header 'Authorization: Bearer <token>' \
  --header 'Content-Type: application/json' \
  --data '
{
  "email": "<string>",
  "firstName": "<string>",
  "lastName": "<string>",
  "phone": "<string>",
  "customAttributes[fieldKey]": "<string>",
  "website": "<string>",
  "sequenzyToken": "<string>",
  "sequenzyBotCheckToken": "<string>"
}
'

import requests

url = "https://api.sequenzy.com/api/v1/forms/popups/{popupId}"

payload = {
    "email": "<string>",
    "firstName": "<string>",
    "lastName": "<string>",
    "phone": "<string>",
    "customAttributes[fieldKey]": "<string>",
    "website": "<string>",
    "sequenzyToken": "<string>",
    "sequenzyBotCheckToken": "<string>"
}
headers = {
    "Authorization": "Bearer <token>",
    "Content-Type": "application/json"
}

response = requests.post(url, json=payload, headers=headers)

print(response.text)

const options = {
  method: 'POST',
  headers: {Authorization: 'Bearer <token>', 'Content-Type': 'application/json'},
  body: JSON.stringify({
    email: '<string>',
    firstName: '<string>',
    lastName: '<string>',
    phone: '<string>',
    'customAttributes[fieldKey]': '<string>',
    website: '<string>',
    sequenzyToken: '<string>',
    sequenzyBotCheckToken: '<string>'
  })
};

fetch('https://api.sequenzy.com/api/v1/forms/popups/{popupId}', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

<?php

$curl = curl_init();

curl_setopt_array($curl, [
  CURLOPT_URL => "https://api.sequenzy.com/api/v1/forms/popups/{popupId}",
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_ENCODING => "",
  CURLOPT_MAXREDIRS => 10,
  CURLOPT_TIMEOUT => 30,
  CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
  CURLOPT_CUSTOMREQUEST => "POST",
  CURLOPT_POSTFIELDS => json_encode([
    'email' => '<string>',
    'firstName' => '<string>',
    'lastName' => '<string>',
    'phone' => '<string>',
    'customAttributes[fieldKey]' => '<string>',
    'website' => '<string>',
    'sequenzyToken' => '<string>',
    'sequenzyBotCheckToken' => '<string>'
  ]),
  CURLOPT_HTTPHEADER => [
    "Authorization: Bearer <token>",
    "Content-Type: application/json"
  ],
]);

$response = curl_exec($curl);
$err = curl_error($curl);

curl_close($curl);

if ($err) {
  echo "cURL Error #:" . $err;
} else {
  echo $response;
}

package main

import (
	"fmt"
	"strings"
	"net/http"
	"io"
)

func main() {

	url := "https://api.sequenzy.com/api/v1/forms/popups/{popupId}"

	payload := strings.NewReader("{\n  \"email\": \"<string>\",\n  \"firstName\": \"<string>\",\n  \"lastName\": \"<string>\",\n  \"phone\": \"<string>\",\n  \"customAttributes[fieldKey]\": \"<string>\",\n  \"website\": \"<string>\",\n  \"sequenzyToken\": \"<string>\",\n  \"sequenzyBotCheckToken\": \"<string>\"\n}")

	req, _ := http.NewRequest("POST", url, payload)

	req.Header.Add("Authorization", "Bearer <token>")
	req.Header.Add("Content-Type", "application/json")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(string(body))

}

HttpResponse<String> response = Unirest.post("https://api.sequenzy.com/api/v1/forms/popups/{popupId}")
  .header("Authorization", "Bearer <token>")
  .header("Content-Type", "application/json")
  .body("{\n  \"email\": \"<string>\",\n  \"firstName\": \"<string>\",\n  \"lastName\": \"<string>\",\n  \"phone\": \"<string>\",\n  \"customAttributes[fieldKey]\": \"<string>\",\n  \"website\": \"<string>\",\n  \"sequenzyToken\": \"<string>\",\n  \"sequenzyBotCheckToken\": \"<string>\"\n}")
  .asString();

require 'uri'
require 'net/http'

url = URI("https://api.sequenzy.com/api/v1/forms/popups/{popupId}")

http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true

request = Net::HTTP::Post.new(url)
request["Authorization"] = 'Bearer <token>'
request["Content-Type"] = 'application/json'
request.body = "{\n  \"email\": \"<string>\",\n  \"firstName\": \"<string>\",\n  \"lastName\": \"<string>\",\n  \"phone\": \"<string>\",\n  \"customAttributes[fieldKey]\": \"<string>\",\n  \"website\": \"<string>\",\n  \"sequenzyToken\": \"<string>\",\n  \"sequenzyBotCheckToken\": \"<string>\"\n}"

response = http.request(request)
puts response.read_body

{"success": true}

{
  "success": true,
  "reward": { "value": "10% off your first order", "code": "WELCOME10" }
}

{ "success": true, "redirectUrl": "https://example.com/thank-you" }

{ "success": false, "message": "Please enter a valid email address" }

{
  "success": false,
  "message": "We couldn't verify this signup. Please try again."
}

{ "success": false, "message": "Invalid popup configuration" }

{ "success": false, "message": "Too many requests. Please try again later." }

{ "success": false, "message": "An error occurred. Please try again." }

​Request

​Bot protection

​Bot protection toggle

​Returning unsubscribed contacts

​Scratch-to-reveal rewards

​Responses

Request

Bot protection

Bot protection toggle

Returning unsubscribed contacts

Scratch-to-reveal rewards

Responses