# List forms (/docs/api-reference/forms/list-forms)

The environment's forms, newest first.

`GET https://api.coss.com/v1/forms`

Authenticate with your API key as a bearer token (`Authorization: Bearer coss_test_…`). Responses are JSON with snake_case fields; errors are `{ error: { type, code, message, param?, issues?, request_id } }` (https://coss.com/docs/api-reference/errors.md).

## Query parameters

- `limit` (integer, 1-100): 1-100, default 20.
- `after` (string, at most 64 characters): Cursor: the `id` of the last item of the previous page.

## Example request

TypeScript (the `coss` package):

```ts
import { Coss } from "coss";

const coss = new Coss({
  apiKey: process.env.COSS_API_KEY,
  baseUrl: "https://api.coss.com",
});

const { data, error } = await coss.forms.list();
```

HTTP:

```sh
curl -X GET "https://api.coss.com/v1/forms" \
  -H "Authorization: Bearer $COSS_API_KEY"
```

Python:

```python
from coss import Coss

client = Coss()  # api_key= or COSS_API_KEY

client.forms.list()
```

Go:

```go
import (
	"context"

	coss "github.com/cosscom/coss-go"
	cossclient "github.com/cosscom/coss-go/client"
)

client := cossclient.NewClient() // option.WithAPIKey(…) or COSS_API_KEY

request := &coss.ListFormsRequest{}
client.Forms.List(
    context.TODO(),
    request,
)
```

Ruby:

```ruby
require "coss"

client = Coss::Client.new # api_key: or COSS_API_KEY

client.forms.list
```

PHP:

```php
<?php

use Coss\Coss;
use Coss\Forms\Requests\ListFormsRequest;

$client = new Coss(); // apiKey: or COSS_API_KEY

$client->forms->list(
    new ListFormsRequest([]),
);
```

Java:

```java
import com.coss.Coss;
import com.coss.resources.forms.requests.ListFormsRequest;

Coss client = Coss.builder().build(); // .apiKey(…) or COSS_API_KEY

client.forms().list(
    ListFormsRequest
        .builder()
        .build()
);
```

.NET:

```csharp
using Coss;

var client = new CossClient(); // apiKey: or COSS_API_KEY

await client.Forms.ListAsync(new ListFormsRequest());
```

## Response 200

A page of forms.

- `object` ("list", required)
- `data` (object[], required)
  - `object` ("form", required)
  - `id` (string, required)
  - `name` (string, required)
  - `enabled` (boolean, required)
  - `endpoint` (string, required): Where the form posts: `<form action=…>`.
  - `hosted_url` (string | null, required): The hosted page, when `hosted.enabled`; `null` otherwise.
  - `fields` (object[] | null, required)
    - `name` (string, required)
    - `type` ("text" | "email" | "textarea" | "number" | "tel" | "url" | "date" | "select" | "radio" | "checkbox" | "hidden" | "file", required)
    - `label` (string | null, required)
    - `required` (boolean, required)
    - `placeholder` (string | null, required)
    - `options` (string[], required)
    - `max_length` (integer | null, required)
  - `strict_fields` (boolean, required)
  - `allowed_origins` (string[], required)
  - `redirect_url` (string | null, required)
  - `spam` (object, required)
    - `honeypot_field` (string, required)
    - `captcha` ("off" | "required", required)
    - `captcha_site_key` (string | null, required)
    - `content_threshold` (number | null, required)
    - `on_review` ("deliver" | "hold", required)
  - `submitter` (object, required)
    - `email_field` (string, required)
    - `verify` (boolean, required)
    - `confirmation_from` (string | null, required)
  - `notifications` (object, required)
    - `recipients` (string[], required)
    - `from` (string | null, required)
  - `contacts` (object, required)
    - `enabled` (boolean, required)
    - `audience_ids` (string[], required)
    - `topics` (string[], required)
    - `double_opt_in` (boolean | null, required)
    - `first_name_field` (string | null, required)
    - `last_name_field` (string | null, required)
    - `properties` (map of string, required)
  - `files` (object, required)
    - `enabled` (boolean, required)
    - `max_files` (integer, required)
    - `max_file_bytes` (integer, required)
    - `allowed_types` (string[], required)
  - `hosted` (object, required)
    - `enabled` (boolean, required)
    - `title` (string | null, required)
    - `description` (string | null, required)
    - `submit_label` (string | null, required)
    - `success_message` (string | null, required)
    - `published_at` (string | null, required, date-time)
  - `disabled_by_admin` (boolean, required): coss.com disabled the form for abuse; contact support.
  - `sandbox` (boolean, required)
  - `created_at` (string, required, date-time)
  - `updated_at` (string, required, date-time)
- `has_more` (boolean, required)

Example:

```json
{
  "object": "list",
  "data": [],
  "has_more": false
}
```

## Errors

- `400`: The `Coss-Version` header names an unknown API version (`invalid_api_version`).
- `401`: The API key is missing, invalid, revoked or expired (`authentication_error`).
- `403`: The API key lacks the permission this endpoint needs (`permission_error`), or its organization is suspended (`organization_suspended`).
- `422`: A query parameter failed validation (`validation_error`, see `issues`).
- `429`: Too many requests with this API key (`rate_limited`), or too many requests with invalid keys from this address (`too_many_failed_authentications`). Retry after `Retry-After` seconds. Successful responses carry `RateLimit-Limit`, `RateLimit-Remaining` and `RateLimit-Reset` (seconds until the limit is fully restored).
- `500`: Unexpected server error (`api_error` / `internal_error`).
- `503`: Forms isn't available in this deployment yet (`forms_unavailable`).