Get a submission

1. Retrieve one submission

Take a submission_id from the list API and replace SUBMISSION_ID in this example. Use the same form read key, stored as QUBEFORMS_READ_KEY on your server. A key for a different form cannot read the record, even if you know its ID.

curl --fail-with-body \
  'https://api.qubeforms.io/v1/read/submissions/SUBMISSION_ID' \
  --header "Authorization: Bearer ${QUBEFORMS_READ_KEY}" \
  --header 'Accept: application/json'

2. Use the response

HTTP 200 returns a single submission object directly. Its data property contains the submitted fields; deliveries contains delivery records; uploads contains attachment records with download_url links. Metadata includes submission_id, form_id, status, created_at, and trust_passport. The example below shows selected fields only; actual responses contain additional metadata and delivery information.

{
  "submission_id": "EXAMPLE_SUBMISSION_ID",
  "form_id": "EXAMPLE_FORM_ID",
  "status": "inbox",
  "data": {
    "email": "alex@example.com",
    "message": "Please contact me."
  },
  "deliveries": [],
  "uploads": []
}

3. Handle private attachments

Use the download_url supplied for each attachment. These links are signed and expire after 15 minutes, so request the submission again when you need a fresh link. Treat the field data and download links as private. Successful responses include Cache-Control: no-store.

4. Handle missing records

HTTP 404 means the submission does not exist, has been deleted or purged, or belongs to another form. Confirm the ID and the form associated with your key. HTTP 401 indicates an authentication failure. Error responses include ok: false and error.message; a server error returns HTTP 500.

5. Display fields and delivery information safely

Treat submitted fields as untrusted text and escape them when rendering HTML. Do not assume every record has an email field, attachments, or deliveries. Delivery records describe asynchronous work and may still be pending or retrying; retrieve the record again to see later status. Your backend should authenticate and authorize its own users before exposing fields or signed links. Verify with a text-only record and an upload.

• API authentication
• Delivery status and retries
• Adding file uploads