File Uploads
Basestack Forms accepts file attachments alongside regular form fields. Files are uploaded as part of the same submission, stored securely, and browsable from the Files tab on each form.
Enabling file uploads
File uploads are disabled by default on new forms. Turn them on from Settings → General → File Uploads.
- The form must be enabled.
- Data Retention must be on, otherwise attachments cannot be stored.
- Submissions that include files while the switch is off are rejected with HTTP 400 "File uploads are not allowed for this form.".
Existing forms that already allowed uploads keep that setting after this change.
You don't have to declare file fields in Submission Rules. File inputs are detected automatically and skipped during field validation.
How it works
When a submission includes one or more files, Basestack Forms:
- Validates each file against the per-file size limit and the per-submission file count limit.
- Uploads each file to secure object storage organised by form and submission.
- Persists a record of every file (name, content type, size, submission link) so it appears alongside the submission and in the Files explorer.
- Cleans up every stored file when the form is deleted.
No client SDK is needed, file uploads use the standard multipart/form-data encoding that the browser already supports. Any HTTP client that can send multipart requests works.
Limits
| Limit | Default | Behaviour when exceeded |
|---|---|---|
| File size | 1 MB per file | HTTP 413 → the whole submission is rejected with an error message identifying the file that was too large. |
| Files per submission | 5 | HTTP 413 → |
| the whole submission is rejected with an error message stating the maximum file count. |
Limits are enforced server-side, so even if a client misbehaves the platform will reject anything over the limit.
Required content type
To attach files, your request must use multipart/form-data. This means:
- HTML forms: add
enctype="multipart/form-data"to the<form>element. - JavaScript / fetch: build a
FormDataobject and pass it as the body. Do not set aContent-Typeheader, the browser will set the right value (with boundary) automatically. - cURL: use
-F "name=value"instead of-d '{...}'.
File field naming
A file input uses the same name attribute convention as any other field. The value of name is the field key that surfaces on the submission.
<input type="file" name="resume" />
<input type="file" name="attachments" multiple />If you mark the input as multiple, multiple files can be sent under the same field name. Basestack Forms stores each one separately and links them all to the same submission.
What you'll see in the dashboard
- Submissions tab: submissions with attachments are flagged with a paperclip badge. Expanding the submission shows a thumbnail strip for previewable files; clicking a thumbnail downloads the file or opens it in a new tab.
- Files tab: every uploaded file in a grid view, with search, type filter, sort, and bulk actions (download / delete). Image previews open in a modal; PDFs open in a new tab using the browser's built-in viewer.
Permissions
| Role | View | Download | Delete |
|---|---|---|---|
| Admin | ✅ | ✅ | ✅ |
| Developer | ✅ | ✅ | ✅ |
| Tester | ✅ | ✅ | ❌ |
| Viewer | ✅ | ✅ | ❌ |
Forms without data retention
If a form has data retention disabled, submissions are not stored and neither are their attachments. Files sent to a no-retention form are discarded along with the rest of the submission.
Next steps
- Browse the integration guides for code samples in your stack:
- Manage attachments from the dashboard: