Submit a form from the backend (internal)
Server-to-server submission endpoint. Shares its implementation with the public
/forms/{id}/submit route but runs on the internal channel, which changes three things:
- the form is not restricted to
formType: public— internal forms are reachable; - CAPTCHA is not verified, even when the form has
captcha.enabled=true; - the stored
statusis taken from the request body’sstatusinstead of being forced topending. Required-field, disabled-field and type validation still run, as do fieldrelationchecks.
Auth: the standard extractAuthData chain (x-tenant-id, x-user-id or Authorization Bearer,
x-service-status) plus the form.read permission. There is NO additional gateway/signature
check — the x-internal-token gate in src/middleware/internalGate.ts is mounted only on
/internal in src/app.ts and does not cover this route. “Internal” describes the calling
party (a trusted backend holding user credentials), not a separate authentication scheme.
checkLimits("formSubmissions") applies the tenant’s seat limit and can reject with 426.
Authorizations
Path Parameters
24-char hex identifier of the target form.
^[a-fA-F0-9]{24}$"{{objectId}}"
Body
Language code this submission is stored under (e.g. "en", "fa"). Defaults to "fa" when omitted.
Key-value map where keys are the form's sections[].fields[].name.
Field rules are enforced server-side (406 on violation):
- fields with
required: truemust be present and non-empty - fields with
disabled: truemust be absent - type is checked per field type (email, tel, number, checkbox/switch boolean,
multi-checkbox/multi-select array, select must match an
options[].value) - a field with a
relationmust contain existing submission ids of the target form;one-to-oneandmany-to-onetake a single id string,one-to-manyandmany-to-manytake a non-empty array of id strings
Initial status. Honoured on this route only (ignored on the public submit route). Defaults to 0 (pending) when omitted.
0, 1, 2 Accepted but not verified on this route — CAPTCHA checks are skipped for the internal channel.
Response
Submitted

