coss.comdocs

Create a form

POST
/v1/forms

A hosted form endpoint: point an HTML <form action> (or coss/forms) at its endpoint. Every submission is screened by Risk (the honeypot, captcha, email, IP, device, velocity and content) and accepted ones go to webhooks (form.submission.received), notification emails and contacts. Without fields, any field is accepted.

Authorization

bearerAuth
headerAuthorizationBearer <token>

A secret API key from the dashboard: coss_live_… for production environments, coss_test_… for sandbox environments.

Header Parameters

Coss-Version?"2026-10-10"

The API version (a date) to use for this request. Defaults to your organization's version, pinned to the latest one when it first used the API and upgraded from the dashboard. The SDK always sends the version it was built for.

Value in"2026-10-10"

Request Body

application/json
  1. body
name*string
Length1 <= length <= 100
enabled?boolean

false: submissions are refused.

fields?array<>|

The form's fields. null (default): any field is accepted. With fields, submissions are validated against them.

Itemsitems <= 50
strict_fields?boolean

With fields: refuse fields the form doesn't define. Default false.

allowed_origins?array<>

Sites that may post to the form, like https://www.example.com (sandbox environments also http://localhost:<port>). Empty (default): any.

Itemsitems <= 10
redirect_url?|

Where browsers go after an HTML post. null: coss.com's thank-you page. A post's _next field overrides it when its origin is allowed.

Formaturi
Lengthlength <= 2048
spam?
submitter?
notifications?
contacts?
files?
hosted?

Response Body

The form.

application/json
  1. response
object*"form"
Value in"form"
id*string
name*string
enabled*boolean
endpoint*string

Where the form posts: <form action=…>.

hosted_url*|

The hosted page, when hosted.enabled; null otherwise.

fields*array<>|null
strict_fields*boolean
allowed_origins*array<string>
redirect_url*string|null
spam*
submitter*
notifications*
contacts*
files*
hosted*
disabled_by_admin*boolean

coss.com disabled the form for abuse; contact support.

sandbox*boolean
created_at*string
Formatdate-time
updated_at*string
Formatdate-time
import { Coss } from "coss";const coss = new Coss({  apiKey: process.env.COSS_API_KEY,  baseUrl: "https://api.coss.com",});const { data, error } = await coss.forms.create({  name: "Contact us",  allowed_origins: [    "https://www.example.com",  ],  notifications: {    recipients: [      "support@example.com",    ],  },});
{  "object": "form",  "id": "form_01kd2m8n3p4q5r6s7t8v9w0x1y",  "name": "Contact us",  "enabled": true,  "endpoint": "https://cossforms.com/f/form_01kd2m8n3p4q5r6s7t8v9w0x1y",  "hosted_url": null,  "fields": null,  "strict_fields": false,  "allowed_origins": [    "https://www.example.com"  ],  "redirect_url": null,  "spam": {    "honeypot_field": "_gotcha",    "captcha": "off",    "captcha_site_key": null,    "content_threshold": 0.9,    "on_review": "hold"  },  "submitter": {    "email_field": "email",    "verify": false,    "confirmation_from": null  },  "notifications": {    "recipients": [      "support@example.com"    ],    "from": null  },  "contacts": {    "enabled": false,    "audience_ids": [],    "topics": [],    "double_opt_in": null,    "first_name_field": null,    "last_name_field": null,    "properties": {}  },  "files": {    "enabled": false,    "max_files": 3,    "max_file_bytes": 10485760,    "allowed_types": []  },  "hosted": {    "enabled": false,    "title": null,    "description": null,    "submit_label": null,    "success_message": null,    "published_at": null  },  "disabled_by_admin": false,  "sandbox": false,  "created_at": "2026-10-29T10:00:00.000Z",  "updated_at": "2026-10-29T10:00:00.000Z"}