# List a form's submissions (/docs/api-reference/form-submissions/list-form-submissions)

Newest first. `status` narrows them: `accepted` (delivered), `held` (Risk asked for a review), `spam` and `pending_confirmation` (waiting for the submitter's email link).

`GET https://api.coss.com/v1/forms/{id}/submissions`

Authenticate with your API key as a bearer token (`Authorization: Bearer coss_test_…`). Responses are JSON with snake_case fields; errors are `{ error: { type, code, message, param?, issues?, request_id } }` (https://coss.com/docs/api-reference/errors.md).

## Path parameters

- `id` (string, required): The form's id.

## Query parameters

- `status` (string): Only submissions in these statuses, comma-separated: `held,spam`.
- `limit` (integer, 1-100): 1-100, default 20.
- `after` (string, at most 64 characters): Cursor: the `id` of the last item of the previous page.

## Example request

TypeScript (the `coss` package):

```ts
import { Coss } from "coss";

const coss = new Coss({
  apiKey: process.env.COSS_API_KEY,
  baseUrl: "https://api.coss.com",
});

const { data, error } = await coss.forms.submissions.list("form_01kd2m8n3p4q5r6s7t8v9w0x1y");
```

HTTP:

```sh
curl -X GET "https://api.coss.com/v1/forms/form_01kd2m8n3p4q5r6s7t8v9w0x1y/submissions" \
  -H "Authorization: Bearer $COSS_API_KEY"
```

Python:

```python
from coss import Coss

client = Coss()  # api_key= or COSS_API_KEY

client.forms.submissions.list(
    id="form_01kd2m8n3p4q5r6s7t8v9w0x1y",
)
```

Go:

```go
import (
	"context"

	cossclient "github.com/cosscom/coss-go/client"
	forms "github.com/cosscom/coss-go/forms"
)

client := cossclient.NewClient() // option.WithAPIKey(…) or COSS_API_KEY

request := &forms.ListSubmissionsRequest{
    ID: "form_01kd2m8n3p4q5r6s7t8v9w0x1y",
}
client.Forms.Submissions.List(
    context.TODO(),
    request,
)
```

Ruby:

```ruby
require "coss"

client = Coss::Client.new # api_key: or COSS_API_KEY

client.forms.submissions.list(id: "form_01kd2m8n3p4q5r6s7t8v9w0x1y")
```

PHP:

```php
<?php

use Coss\Coss;
use Coss\Forms\Submissions\Requests\ListSubmissionsRequest;

$client = new Coss(); // apiKey: or COSS_API_KEY

$client->forms->submissions->list(
    'form_01kd2m8n3p4q5r6s7t8v9w0x1y',
    new ListSubmissionsRequest([]),
);
```

Java:

```java
import com.coss.Coss;
import com.coss.resources.forms.submissions.requests.ListSubmissionsRequest;

Coss client = Coss.builder().build(); // .apiKey(…) or COSS_API_KEY

client.forms().submissions().list(
    "form_01kd2m8n3p4q5r6s7t8v9w0x1y",
    ListSubmissionsRequest
        .builder()
        .build()
);
```

.NET:

```csharp
using Coss;
using Coss.Forms;

var client = new CossClient(); // apiKey: or COSS_API_KEY

await client.Forms.Submissions.ListAsync(
    new ListSubmissionsRequest { Id = "form_01kd2m8n3p4q5r6s7t8v9w0x1y" }
);
```

## Response 200

A page of submissions.

- `object` ("list", required)
- `data` (object[], required)
  - `object` ("form_submission", required)
  - `id` (string, required)
  - `form_id` (string, required)
  - `status` ("pending_confirmation" | "accepted" | "held" | "spam", required): `accepted`: delivered (webhooks, notifications, contacts). `held`: Risk asked for a review. `spam`: refused by Risk, the content check or the honeypot. `pending_confirmation`: waiting for the submitter's email link.
  - `data` (map of string | string[], required): Field name → value; a field posted several times has an array.
  - `submitter_email` (string | null, required)
  - `files` (object[], required)
    - `id` (string, required)
    - `field` (string, required)
    - `filename` (string, required)
    - `content_type` (string, required)
    - `size` (integer, required): Bytes.
  - `spam_reason` ("honeypot" | "risk_block" | "risk_review" | "content" | null, required)
  - `risk` (object | null, required): Risk's assessment; `null` when none ran (honeypot).
    - `assessment_id` (string | null, required)
    - `decision` ("allow" | "review" | "block" | null, required)
    - `score` (number | null, required)
  - `ip` (string | null, required)
  - `user_agent` (string | null, required)
  - `origin` (string | null, required)
  - `referrer` (string | null, required)
  - `confirmed_at` (string | null, required, date-time)
  - `accepted_at` (string | null, required, date-time)
  - `released_at` (string | null, required, date-time)
  - `sandbox` (boolean, required)
  - `created_at` (string, required, date-time)
- `has_more` (boolean, required)

Example:

```json
{
  "object": "list",
  "data": [],
  "has_more": false
}
```

## Errors

- `400`: The `Coss-Version` header names an unknown API version (`invalid_api_version`).
- `401`: The API key is missing, invalid, revoked or expired (`authentication_error`).
- `403`: The API key lacks the permission this endpoint needs (`permission_error`), or its organization is suspended (`organization_suspended`).
- `404`: No form with this id exists in the API key's environment (`not_found`).
- `422`: A query parameter failed validation (`validation_error`, see `issues`).
- `429`: Too many requests with this API key (`rate_limited`), or too many requests with invalid keys from this address (`too_many_failed_authentications`). Retry after `Retry-After` seconds. Successful responses carry `RateLimit-Limit`, `RateLimit-Remaining` and `RateLimit-Reset` (seconds until the limit is fully restored).
- `500`: Unexpected server error (`api_error` / `internal_error`).
- `503`: The API key could not be verified right now; retry (`service_unavailable`).