Validation and upload errors
Fix Qubeforms validation and file upload errors. Check form fields, CAPTCHA, redirects, multipart encoding, attachment limits, and private download availability.
1. Read the actual error
Request JSON and inspect error.message from the failed POST. 422 can describe field data, CAPTCHA, spam policy, redirect rules, or uploads. Keep visitor values on screen while showing the error. If the response is HTML or empty, record the HTTP status and check the endpoint and proxy response before assuming a particular field was rejected.
2. Fix missing or changed field values
Give every HTML control a name; disabled controls and unchecked checkboxes are not included by normal form submission. Send a JSON object when using JSON, with at least one non-reserved field. Keep names simple and unique because unsupported characters are stripped. Strings are trimmed and truncated at 20,000 characters, so validate large text before sending. See Submit a form for normalization limits and reserved fields.
3. Resolve CAPTCHA or redirect failures
If CAPTCHA verification fails, confirm the widget matches the provider configured on the form and send its fresh response token using a supported field name. Reset the widget after a failed attempt when another token is needed. For a redirect error, compare _cf_redirect with the form’s redirect allowlist. A permitted website origin does not automatically permit every thank-you URL. See Safe thank-you redirects.
4. Check upload encoding and plan
Use enctype="multipart/form-data" for an HTML file form or send FormData from JavaScript without setting Content-Type manually. Use attachments[] with a multiple file input so all files are represented. A filename in JSON does not send its bytes. Uploads require Starter, Pro, or Business; Free returns 402. Draft endpoints do not save files. Attach them to the final submission.
5. Reduce size or change format
Each file must be 1 byte to 5 MB, and a submission can include at most 10 files across all fields. Empty files, excessive counts, oversize individual files, and blocked types can return 422. 413 can mean the 512 KB encoded field limit or the default 51 MB overall request limit was exceeded; upstream servers can impose their own limit too. HTML, SVG, script, and executable types can be rejected based on detected content. Export to an appropriate document or raster image format instead of renaming the extension.
6. Verify receipt and downloads
Retest with a small PDF or JPEG and a short text field, then inspect the submission and its attachment link. An expired read-API download link can be refreshed by requesting the submission again. A file removed by retention cleanup cannot be recovered by refreshing a link. See Adding file uploads and Export and retention for complete workflows.
Public form keys can appear in browser code. Read keys, management credentials, and webhook signing secrets must stay on the server.