form_submission.created

A form is submitted.

postAstalty sends a POST to each webhook subscribed to this event.

Example payload

{
  "id": "9b1deb4d-3b7d-4bad-9bdd-2b0d7b3dcb6d",
  "event_type": "form_submission.created",
  "resource": {
    "id": "9b1deb4d-3b7d-4bad-9bdd-2b0d7b3dcb6d",
    "type": "form_submission"
  },
  "data": []
}

Verify the signature

import crypto from "node:crypto";

export function isFromAstalty(rawBody, signature, signingSecret) {
  const expected = crypto
    .createHmac("sha256", signingSecret)
    .update(rawBody)
    .digest("hex");

  return (
    typeof signature === "string" &&
    signature.length === expected.length &&
    crypto.timingSafeEqual(Buffer.from(expected), Buffer.from(signature))
  );
}

Headers

X-Astalty-Signaturestringrequired
HMAC-SHA256 of the raw request body, keyed with the webhook's signing secret and hex encoded. See Verifying the signature.

Payload

application/json

idstring<uuid>required
The delivery ID. It stays the same across retries, so use it to ignore a delivery you have already processed.
event_typeenum<string>required
The event that occurred.
Available options:form_submission.created
resourceobjectrequired
The record the event relates to.
▶Show 2 child attributesHide child attributes
- idstring<uuid>required
  The ID of the form submission.
- typeenum<string>required
  Available options:form_submission
dataany[]required
Always empty for this event. Fetch the record from the API for its current details.

Fetch the record

The payload names the record but does not include it. Call this endpoint with resource.id to read its current details.

getGet a Form Submission/public/v1/form-submissions/{formSubmission}

Return any 2xx status within 15 seconds to acknowledge the delivery. Anything else is retried up to 10 times over about 42 hours, so make your handler idempotent on the delivery id. See Retries and delivery.

Command Palette

Headers

Payload

Fetch the record

Responding