# Update a form (/docs/api-reference/forms/update-form)

Only the fields given change, within each group (`spam`, `contacts`, …) too.

`PATCH https://api.coss.com/v1/forms/{id}`

Authenticate with your API key as a bearer token (`Authorization: Bearer coss_test_…`). Responses are JSON with snake_case fields; errors are `{ error: { type, code, message, param?, issues?, request_id } }` (https://coss.com/docs/api-reference/errors.md).

## Path parameters

- `id` (string, required): The form's id.

## Request body

- `name` (string, 1-100 characters)
- `enabled` (boolean): `false`: submissions are refused.
- `fields` (object[] | null, at most 50 items): The form's fields. `null` (default): any field is accepted. With fields, submissions are validated against them.
  - `name` (string, required): The `name` the form's input posts.
  - `type` ("text" | "email" | "textarea" | "number" | "tel" | "url" | "date" | "select" | "radio" | "checkbox" | "hidden" | "file", required): Validates the value (`email`, `number`, `url`, `date` as `YYYY-MM-DD`, `select`/`radio` one of `options`, `checkbox` any of them or `on`) and picks the input on hosted pages. `file` needs uploads on (`files.enabled`).
  - `label` (string, 1-200 characters): Shown on hosted pages and in notifications. Default: the name.
  - `required` (boolean): Default false.
  - `placeholder` (string, at most 200 characters)
  - `options` (string[], at most 50 items): The choices of `select`, `radio` and `checkbox` fields.
  - `max_length` (integer, 1-10000)
- `strict_fields` (boolean): With `fields`: refuse fields the form doesn't define. Default false.
- `allowed_origins` (string[], at most 10 items): Sites that may post to the form, like `https://www.example.com` (sandbox environments also `http://localhost:<port>`). Empty (default): any.
- `redirect_url` (string | null, uri, at most 2048 characters): Where browsers go after an HTML post. `null`: coss.com's thank-you page. A post's `_next` field overrides it when its origin is allowed.
- `spam` (object)
  - `honeypot_field` (string): A field people leave empty (hide it with CSS); a submission that fills it is spam. Default `_gotcha`.
  - `captcha` ("off" | "required"): `required`: submissions need a token from the captcha set in the environment's risk settings (Turnstile or hCaptcha). Default `off`.
  - `captcha_site_key` (string | null, 1-200 characters): The captcha's site key, which hosted pages render the widget with.
  - `content_threshold` (number | null, 0.5-1): A submission whose text scores at least this in a content category (spam, phishing, malware, fraud) is spam. Default 0.9; `null` leaves content to the environment's risk settings.
  - `on_review` ("deliver" | "hold"): What happens when Risk's decision is `review`: `hold` (default) keeps the submission until you release it, `deliver` delivers it.
- `submitter` (object)
  - `email_field` (string): The field holding the submitter's email address (Risk checks it, notifications reply to it, contacts are made from it). Default `email`.
  - `verify` (boolean): Hold every submission until the submitter clicks the link emailed to them (double opt-in for the whole submission). Default false.
  - `confirmation_from` (string | null, email, at most 254 characters): The verification email's sender: an address on a verified domain (required with `verify` in live environments).
- `notifications` (object)
  - `recipients` (string[], at most 5 items): Who gets an email for each accepted submission: members of your organization, or addresses on its verified domains.
  - `from` (string | null, email, at most 254 characters): The notification's sender, on a verified domain in live environments. `null`: coss.com, as "<form name> via coss.com".
- `contacts` (object)
  - `enabled` (boolean)
  - `audience_ids` (string[], at most 20 items)
  - `topics` (string[], at most 20 items): Topic keys the contact is opted into.
  - `double_opt_in` (boolean | null): New contacts confirm their subscription by email first. `null` (default): the environment's marketing settings decide.
  - `first_name_field` (string | null): The `name` the form's input posts.
  - `last_name_field` (string | null): The `name` the form's input posts.
  - `properties` (map of string): Contact property key → the field whose value it takes.
- `files` (object)
  - `enabled` (boolean): Accept uploads (`multipart/form-data`). Default false.
  - `max_files` (integer, 1-10)
  - `max_file_bytes` (integer, 1-10485760)
  - `allowed_types` (string[], at most 50 items): MIME types (`image/*` allowed). Empty: images, PDFs, text and Office.
- `hosted` (object)
  - `enabled` (boolean): Serve the form as a page at its `hosted_url` (needs `fields`). Default false.
  - `title` (string | null, 1-200 characters)
  - `description` (string | null, at most 2000 characters)
  - `submit_label` (string | null, 1-60 characters)
  - `success_message` (string | null, 1-500 characters)

## Example request

TypeScript (the `coss` package):

```ts
import { Coss } from "coss";

const coss = new Coss({
  apiKey: process.env.COSS_API_KEY,
  baseUrl: "https://api.coss.com",
});

const { data, error } = await coss.forms.update("form_01kd2m8n3p4q5r6s7t8v9w0x1y", {
  spam: {
    captcha: "required",
  },
  contacts: {
    enabled: true,
  },
});
```

HTTP:

```sh
curl -X PATCH "https://api.coss.com/v1/forms/form_01kd2m8n3p4q5r6s7t8v9w0x1y" \
  -H "Authorization: Bearer $COSS_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
  "spam": {
    "captcha": "required"
  },
  "contacts": {
    "enabled": true
  }
}'
```

Python:

```python
from coss import Coss
from coss.forms import UpdateFormRequestSpam, UpdateFormRequestContacts

client = Coss()  # api_key= or COSS_API_KEY

client.forms.update(
    id="form_01kd2m8n3p4q5r6s7t8v9w0x1y",
    spam=UpdateFormRequestSpam(
        captcha="required",
    ),
    contacts=UpdateFormRequestContacts(
        enabled=True,
    ),
)
```

Go:

```go
import (
	"context"

	coss "github.com/cosscom/coss-go"
	cossclient "github.com/cosscom/coss-go/client"
)

client := cossclient.NewClient() // option.WithAPIKey(…) or COSS_API_KEY

request := &coss.UpdateFormRequest{
    ID: "form_01kd2m8n3p4q5r6s7t8v9w0x1y",
    Spam: &coss.UpdateFormRequestSpam{
        Captcha: coss.UpdateFormRequestSpamCaptchaRequired.Ptr(),
    },
    Contacts: &coss.UpdateFormRequestContacts{
        Enabled: coss.Bool(
            true,
        ),
    },
}
client.Forms.Update(
    context.TODO(),
    request,
)
```

Ruby:

```ruby
require "coss"

client = Coss::Client.new # api_key: or COSS_API_KEY

client.forms.update(
  id: "form_01kd2m8n3p4q5r6s7t8v9w0x1y",
  spam: {
    captcha: "required"
  },
  contacts: {
    enabled: true
  }
)
```

PHP:

```php
<?php

use Coss\Coss;
use Coss\Forms\Requests\UpdateFormRequest;
use Coss\Forms\Types\UpdateFormRequestContacts;
use Coss\Forms\Types\UpdateFormRequestSpam;
use Coss\Forms\Types\UpdateFormRequestSpamCaptcha;

$client = new Coss(); // apiKey: or COSS_API_KEY

$client->forms->update(
    'form_01kd2m8n3p4q5r6s7t8v9w0x1y',
    new UpdateFormRequest([
        'spam' => new UpdateFormRequestSpam([
            'captcha' => UpdateFormRequestSpamCaptcha::Required->value,
        ]),
        'contacts' => new UpdateFormRequestContacts([
            'enabled' => true,
        ]),
    ]),
);
```

Java:

```java
import com.coss.Coss;
import com.coss.resources.forms.requests.UpdateFormRequest;
import com.coss.resources.forms.types.UpdateFormRequestContacts;
import com.coss.resources.forms.types.UpdateFormRequestSpam;
import com.coss.resources.forms.types.UpdateFormRequestSpamCaptcha;

Coss client = Coss.builder().build(); // .apiKey(…) or COSS_API_KEY

client.forms().update(
    "form_01kd2m8n3p4q5r6s7t8v9w0x1y",
    UpdateFormRequest
        .builder()
        .spam(
            UpdateFormRequestSpam
                .builder()
                .captcha(UpdateFormRequestSpamCaptcha.REQUIRED)
                .build()
        )
        .contacts(
            UpdateFormRequestContacts
                .builder()
                .enabled(true)
                .build()
        )
        .build()
);
```

.NET:

```csharp
using Coss;

var client = new CossClient(); // apiKey: or COSS_API_KEY

await client.Forms.UpdateAsync(
    new UpdateFormRequest
    {
        Id = "form_01kd2m8n3p4q5r6s7t8v9w0x1y",
        Spam = new UpdateFormRequestSpam { Captcha = UpdateFormRequestSpamCaptcha.Required },
        Contacts = new UpdateFormRequestContacts { Enabled = true },
    }
);
```

## Response 200

The form.

- `object` ("form", required)
- `id` (string, required)
- `name` (string, required)
- `enabled` (boolean, required)
- `endpoint` (string, required): Where the form posts: `<form action=…>`.
- `hosted_url` (string | null, required): The hosted page, when `hosted.enabled`; `null` otherwise.
- `fields` (object[] | null, required)
  - `name` (string, required)
  - `type` ("text" | "email" | "textarea" | "number" | "tel" | "url" | "date" | "select" | "radio" | "checkbox" | "hidden" | "file", required)
  - `label` (string | null, required)
  - `required` (boolean, required)
  - `placeholder` (string | null, required)
  - `options` (string[], required)
  - `max_length` (integer | null, required)
- `strict_fields` (boolean, required)
- `allowed_origins` (string[], required)
- `redirect_url` (string | null, required)
- `spam` (object, required)
  - `honeypot_field` (string, required)
  - `captcha` ("off" | "required", required)
  - `captcha_site_key` (string | null, required)
  - `content_threshold` (number | null, required)
  - `on_review` ("deliver" | "hold", required)
- `submitter` (object, required)
  - `email_field` (string, required)
  - `verify` (boolean, required)
  - `confirmation_from` (string | null, required)
- `notifications` (object, required)
  - `recipients` (string[], required)
  - `from` (string | null, required)
- `contacts` (object, required)
  - `enabled` (boolean, required)
  - `audience_ids` (string[], required)
  - `topics` (string[], required)
  - `double_opt_in` (boolean | null, required)
  - `first_name_field` (string | null, required)
  - `last_name_field` (string | null, required)
  - `properties` (map of string, required)
- `files` (object, required)
  - `enabled` (boolean, required)
  - `max_files` (integer, required)
  - `max_file_bytes` (integer, required)
  - `allowed_types` (string[], required)
- `hosted` (object, required)
  - `enabled` (boolean, required)
  - `title` (string | null, required)
  - `description` (string | null, required)
  - `submit_label` (string | null, required)
  - `success_message` (string | null, required)
  - `published_at` (string | null, required, date-time)
- `disabled_by_admin` (boolean, required): coss.com disabled the form for abuse; contact support.
- `sandbox` (boolean, required)
- `created_at` (string, required, date-time)
- `updated_at` (string, required, date-time)

Example:

```json
{
  "object": "form",
  "id": "form_01kd2m8n3p4q5r6s7t8v9w0x1y",
  "name": "Contact us",
  "enabled": true,
  "endpoint": "https://cossforms.com/f/form_01kd2m8n3p4q5r6s7t8v9w0x1y",
  "hosted_url": null,
  "fields": null,
  "strict_fields": false,
  "allowed_origins": [
    "https://www.example.com"
  ],
  "redirect_url": null,
  "spam": {
    "honeypot_field": "_gotcha",
    "captcha": "off",
    "captcha_site_key": null,
    "content_threshold": 0.9,
    "on_review": "hold"
  },
  "submitter": {
    "email_field": "email",
    "verify": false,
    "confirmation_from": null
  },
  "notifications": {
    "recipients": [
      "support@example.com"
    ],
    "from": null
  },
  "contacts": {
    "enabled": false,
    "audience_ids": [],
    "topics": [],
    "double_opt_in": null,
    "first_name_field": null,
    "last_name_field": null,
    "properties": {}
  },
  "files": {
    "enabled": false,
    "max_files": 3,
    "max_file_bytes": 10485760,
    "allowed_types": []
  },
  "hosted": {
    "enabled": false,
    "title": null,
    "description": null,
    "submit_label": null,
    "success_message": null,
    "published_at": null
  },
  "disabled_by_admin": false,
  "sandbox": false,
  "created_at": "2026-10-29T10:00:00.000Z",
  "updated_at": "2026-10-29T10:00:00.000Z"
}
```

## Errors

- `400`: The body is not valid JSON (`invalid_json`). Also when the `Coss-Version` header names an unknown API version (`invalid_api_version`).
- `401`: The API key is missing, invalid, revoked or expired (`authentication_error`).
- `403`: The API key lacks the permission this endpoint needs (`permission_error`), or its organization is suspended (`organization_suspended`).
- `404`: No form with this id exists in the API key's environment (`not_found`).
- `409`: Other updates of this form kept racing this one (`form_conflict`). Retry after `Retry-After` seconds.
- `415`: The body is not sent as `application/json` (`unsupported_media_type`).
- `422`: The body failed validation (`validation_error`), or the form can't be saved: duplicate or misplaced fields (`invalid_fields`), an origin or redirect that isn't https (`invalid_origin`, `invalid_redirect`), a sender or recipient that isn't verified (`invalid_sender`, `invalid_recipient`), an unknown audience, topic or property (`invalid_contacts`), no captcha in the risk settings (`captcha_not_configured`), a hosted page without fields or asking for credentials (`hosted_needs_fields`, `hosted_content_refused`), or too many forms (`form_limit_reached`).
- `429`: Too many requests with this API key (`rate_limited`), or too many requests with invalid keys from this address (`too_many_failed_authentications`). Retry after `Retry-After` seconds. Successful responses carry `RateLimit-Limit`, `RateLimit-Remaining` and `RateLimit-Reset` (seconds until the limit is fully restored).
- `500`: Unexpected server error (`api_error` / `internal_error`).
- `503`: Forms isn't available in this deployment yet (`forms_unavailable`).