A form can be submitted by API without auth at POST https://api.hsforms.com/submissions/v3/integration/submit/{portalId}/{formGuid}, and it triggers workflows like a browser submission; api.hubapi.com has no submit route (404).
Measured
More facts from this area
- A Forms v3 create (
POST /marketing/v3/forms) is rejected unless the body includescreatedAt.Measured - In the forms v3 API a hidden dropdown field's preset value goes in
defaultValues: ["<value>"]; adefaultValuestring is silently dropped.Measured - A form's
notifyRecipientsis a list of HubSpot user IDs as strings, not email addresses.Source pending - A form's
configuration.lifecycleStagesneeds an entry for contacts (objectTypeId: "0-1") and one for companies ("0-2"), each a stage's internal value (subscriber), even when the form has contact fields only. A contacts entry alone answers 400Lifecycle stage provided were not valid(VALIDATION_ERROR). An empty list is accepted.Documented and measured
Spriggit uses these facts when it plans changes. See something out of date? Email [email protected]