Submission Rules

The public submission endpoint accepts whatever fields you POST. That's great for prototyping, but anyone who copies your form's action URL can also send arbitrary fields and pollute your dataset. Submission Rules lock the endpoint down to the exact shape your form expects, anything that doesn't match is rejected before it ever reaches your inbox.

Rules are optional. With no rules defined, your form keeps accepting everything (current behaviour). The moment you add a single rule, the endpoint becomes strict for that form.

Opening the Rules drawer

From the form's Flow page, click the Rules node. A drawer slides in from the right with one card per field and the validations applied to it.

File uploads are configured separately in General Settings, not in this drawer.

Defining a field

Click + Add New Field, type the field's name attribute exactly as it appears in your HTML (email, name, phone, etc.), and pick which validations apply.

The field name must match the form's name attribute character-for-character. We accept letters, digits, _ and -, starting with a letter or underscore.

Available validations

You can mix any number of these per field, the UI hides validations you've already added.

Rule	Effect	Notes
Required	Reject if missing or empty	Without an explicit `Min Length`, automatically requires at least 1 character.
Email	Reject if not a valid email
URL	Reject if not a valid URL
Number	Coerce to a number and reject if not numeric	HTML inputs always send strings; we coerce automatically.
Phone Number	Reject if not a plausible phone number	Accepts `+`, digits, spaces, dashes and parentheses (7+ chars).
Min Length	Reject if shorter than `value`	On Number fields, applies to numeric `min` instead of length.
Max Length	Reject if longer than `value`	On Number fields, applies to numeric `max` instead of length.
Contains	Reject if the substring is missing
Not Contains	Reject if the substring is present

The validations compose under the hood into a Zod schema generated at request time. Failures return HTTP 400 and redirect to your errorUrl with the offending field name in the message.

Strict by default

There is no "strict mode" toggle once you've defined at least one field rule, the schema rejects any extra field that isn't in your rules list. That's the entire point: if a bot adds surprise=spam to your email + name form, the submission is rejected with "Unrecognized key(s) in object: 'surprise'".

File inputs are auto-detected

You don't have to declare your <input type="file" name="attachments" /> in the Rules list. File-valued fields are detected by their value shape (not their name) and skipped during strict validation, so any name works (attachments, resume, photo, cv, etc.).

Enable or disable attachments from Settings → General → File Uploads. When the switch is off, any submission containing a file is rejected with HTTP 400 "File uploads are not allowed for this form.". Per-file size (1 MB) and per-submission file count (5) limits still apply when uploads are on (details →).

What happens on a failure

When a submission violates a rule, the API responds with:

HTTP 400 (or 413 for over-size files)
A descriptive message identifying the offending field
A redirect to your form's errorUrl with ?message=<the error> for HTML form submissions
A JSON error body for mode=rest REST submissions

The submission is not stored, no jobs are enqueued, no email / webhook / integration fires.

Example

A simple contact form whose rules say "must have a valid email and a name between 2 and 80 chars":

form.html

<form
  action="https://forms-api.basestack.co/v1/s/[KEY]"
  method="POST"
  enctype="multipart/form-data"
>
  <input type="email" name="email" required />
  <input type="text" name="name" required />
  <input type="hidden" name="_trap" />
  <button type="submit">Send</button>
</form>

Rules:

email → Required, Email
name → Required, Min Length 2, Max Length 80

Any submission with extra fields, a malformed email, or a missing/too-short name gets rejected before saving, before notifications, before integrations.

Permissions

Role	View	Edit
Admin	✅	✅
Developer	✅	✅
Tester	✅	❌
Viewer	✅	❌

Next steps

Flow page overview →
Spam protection → → complementary, runs after Rules
File uploads → → platform limits that always apply

Submission Rules

On this page