# Submit API overview

Public FormsReach submit endpoint - URL, authentication via api_key, content types, and response shape.

## Endpoint

```
POST https://api.formsreach.com/submit
```

This host rewrites to the app’s public submit route (`/api/v1/submit`). Use the public URL above in production snippets.

## Authentication

Include your form API key as field **`api_key`** in the body (JSON, urlencoded, or multipart). No Bearer token is required for public website forms.

## Content types

| Content-Type | Use |
|---|---|
| `application/x-www-form-urlencoded` | Classic HTML forms |
| `multipart/form-data` | HTML forms with [file uploads](/docs/submit-api/file-uploads/) |
| `application/json` | SPAs, mobile, server-to-server |

## Field rules

- **`api_key`** - required
- Any other field names are accepted as submission data (subject to max field limits)
- Reserved spam fields: `_gotcha`, `_ts` - see [Spam protection](/docs/submit-api/spam/)
- File fields use multipart only

## Success and errors

Successful accepts return success envelope (JSON) or redirect/HTML for browsers.

Typical problem codes include validation failures, inactive form, domain denied, rate limits, and insufficient credits.

JSON errors use `{ data, status, error: { type, title, status, code, detail }, meta.requestId }`. Each `error.type` is a page on this site, for example [missing_api_key](/errors/missing_api_key/). Catalog: [API errors](/errors/).

Rate-limit headers (`RateLimit`, `Retry-After` on 429) are documented in [Rate limits](/docs/submit-api/rate-limits/).

Machine-readable spec (unique `operationId` per operation, typed bodies, error schemas): [OpenAPI JSON](/openapi.json) and [OpenAPI YAML](/api/openapi.yaml). Developer hub: [FormsReach developers](/developers/).

## Guides in this section

- [HTML form POST](/docs/submit-api/html/)
- [Programmatic submit (JS SDK)](/docs/submit-api/json/)
- [File uploads](/docs/submit-api/file-uploads/)
- [Redirect and thank-you](/docs/submit-api/redirect/)
- [Domain allowlist](/docs/submit-api/domains/)
- [Spam and honeypot](/docs/submit-api/spam/)