Form backend reference: POST /submit

POST https://aiformapi.com/submit takes a submission from any website. The access key in the body picks the form. The plain-language page is form backend.

Make an access key

Open the dashboard and press New form backend. The key starts with fbk_. The page shows the key and the HTML to copy. A form backend counts as one open form. Its responses count in your monthly quota.

Request

Send one of these content types:

application/x-www-form-urlencoded (a normal browser form)
multipart/form-data
application/json (an object)

Field	Meaning
`access_key`	Required. The key of your form backend.
`botcheck`	Spam trap. Leave it empty. A value means a bot: the message is dropped and the answer looks like a success.
any other name	Saved as an answer. A name can repeat (checkboxes): the answer is a list.

The recipient is never taken from the request. The email goes to the account owner's address.

bash

curl -sS https://aiformapi.com/submit \
  -H "Content-Type: application/json" \
  -d '{"access_key":"fbk_YOUR_KEY","name":"Ann","message":"Hello"}'

Answer

A browser form post (it asks for text/html) gets a hosted thank-you page. A script gets JSON:

json

{ "success": true, "message": "Your message was sent.", "receipt": "AF-7K3Q-9XMD", "submitted_at": "2026-11-01T09:00:00.000Z", "response_id": "rsp_..." }

There is no redirect to a URL from the request.

Errors

Errors use the usual shape.

Status	Code	Cause
401	`unauthorized`	The access key is missing or wrong.
403	`quota_exceeded`	The account has used its responses for this month.
409	`form_closed`	The form is closed.
413	`payload_too_large`	The body is over 64 KB.
415	`validation_failed`	The content type is not one of the three above.
422	`validation_failed`	Too many fields (over 50), a name over 100 characters, a value over 5,000 characters, a file, or no field.
422	`blocked_field`	A field name asks for a secret. See blocked fields.
429	`rate_limited`	5 a minute or 30 an hour for one visitor, or 60 a minute for one form.

CORS

Any origin may send POST. The preflight allows only POST and OPTIONS, and only the Content-Type header. No credentials are allowed, so no cookie is sent.

Read the submissions

Submissions are normal responses with source set to web. Read them in the dashboard, with the responses API or by webhook. The CSV has one column for each name that a website sent.