Data › Forms is where storefront forms land.
Forms#
A form is declared by placing a form element in a document (the schema's element field) — the Forms page lists every form the project's documents declare, with its fields and the count of records. The storefront posts submissions through the render server's built-in guarded route; the guards (honeypot, timing, origin) live in the render server, not here.
The form card in the document editor carries the form's access panel (Access & protection): the allowed origins — exact (https://shop.example.com) or one subdomain level (https://*.example.com) — and Require page context, which refuses submissions that arrive without the placing page's context (a direct API call, a page sent without a Referer). Enable the latter only once the form's records carry a source. Require reCAPTCHA adds invisible Google reCAPTCHA v3 to the form: a score floor (0.3 / 0.5 / 0.7, default 0.5) and what happens below it — refuse (the default) or keep and flag (the record is stored, marked suspect). The same reCAPTCHA settings open from the settings menu (the gear) on the form's own page (Forms → the form), next to Listing columns; a green shield there marks a protected form. The switch stays disabled until the project has its own reCAPTCHA key under Spam protection. Records of a protected form show the verdict as a chip (the score, suspect, unverified or skipped), and reCAPTCHA is available as a listing column.
Recount (managers only, on the Forms page) rebuilds a form's per-status counters from the records when they drift — the counters are maintained by a trigger and can skew on retries.
Records#
Open a form for its submissions, filter by status (new / open / done / unresolved / closed), open one to see the payload rendered against the declaring fields and to set its status. A submission keeps its creation time (the Date column) apart from the time it was last edited (Updated); one whose locale is not among the project's configured locales is marked unlisted locale.
Uploaded files (image / file / files variables) are listed on the submission with a Download button. They are stored privately — there is no public link, and they never appear in the Files view; deleting the submission deletes its files.
The Listing columns button (next to Filter) picks which columns the records table shows and in what order — the same picker as a collection's Edit collection dialog: the record built-ins (date, status, locale, preview, id, source, note) plus any payload field as data.{key} (the form's declared fields are offered, other keys can be typed). The built-ins include both Date (creation) and Updated. Drag the checked rows to reorder. By default the listing shows the date, the status, the sender field (name, e-mail or phone) and the message field — taken from the form's declared fields or, when it declares none, from the keys its submissions carry (else a preview of the longest text value); nothing selected restores those defaults. The choice is saved on the form and shared by everyone who opens it.
Notifications#
Each form's Notifications dialog — the button on its row in the forms list, or the gear menu on its records page — is a shortcut to the corresponding forms notification hook: an e-mail template rendered and sent to a list of addresses on every new record, through the project's own SMTP setup — or, when the project has none, the platform mailer. The full hook editor lives under Settings › Advanced › Hooks.
Needs the content capability.