Customer API endpoints

1. Choose an endpoint

Use https://api.qubeforms.io as the API base URL. Replace {publicKey} with the public key from your form endpoint. A method applies only to the routes listed below; GET is not available on the public submission endpoint.

POST        /v1/{publicKey}/submissions           Submit a form
POST        /v1/{publicKey}/drafts                Create a draft
PATCH, PUT  /v1/{publicKey}/drafts/{draftId}      Update a draft
GET         /v1/read/submissions                  List submissions
GET         /v1/read/submissions/{submissionId}   Get one submission
GET         /v1/recipients/verify/{token}         Verify a recipient
OPTIONS     /v1/{path}                            Browser preflight

2. Use the right credential

Submission and draft creation use the public form key and remain subject to form availability, origin rules, and abuse checks. Updating a draft also requires its secret draft token in X-Qubeforms-Draft-Token. The two /v1/read endpoints require a secret form read key in the Authorization header. Recipient verification uses the token in the emailed link.

3. Call the read API from your server

Browser forms can submit directly to the public endpoints. Read requests belong in your backend, a scheduled job, or another trusted server process. Keep read keys on that server. Your backend must authenticate its own users before sharing submission data with them.

4. Understand method availability

OPTIONS supports browser preflight and does not grant access to submission data. There are no explicitly registered customer HEAD routes. Read keys authorize reading only; use the dashboard to change form settings, manage recipients, or remove submissions. The /v1/manage endpoints are reserved for service operators and do not accept customer read keys.

5. Using an older endpoint

Existing /api/v1, /api/qubeforms/v1, and /api/cloudforms/v1 URLs remain supported. On those prefixes, public submission and draft paths use /forms/{publicKey}/submissions and /forms/{publicKey}/drafts. Read paths remain /read/submissions and /read/submissions/{submissionId}. Use /v1 for new integrations.

6. Verify an integration end to end

Use Submit a form to send a non-sensitive test from an approved origin. Confirm the returned submission ID, then use List submissions and Get a submission from your server to inspect it. For multi-step flows, create and update a draft before the final POST. Check stored fields and delivery status independently, and test an invalid origin, invalid read key, and expired draft before publishing your integration.

• Submit a form
• Create and update drafts
• API authentication