## Retrieve all endpoints (forms)

`GET https://forms.un-static.com/api/forms`

**Headers**

| Name | Type | Description |
| --- | --- | --- |
| Authentication | string | Don't forget to authenticate |

```json title="200"
[
  {
    "id": "786035271d01882e129295858656324d3e5110ee",
    "reference": "786035271d01882e129295858656324d3e5110ee",
    "title": "Contact form for YourDomain",
    "email": "you@yourdomain.com",
    "success_redirect": "https://yourdomain.com/contact-success/",
    "created": 1573136139
  }
]
```

## Retrieve one endpoint (form)

`GET https://forms.un-static.com/api/forms/{reference}`

**Headers**

| Name | Type | Description |
| --- | --- | --- |
| Authentication | string | Don't forget to authenticate |

```json title="200"
{
  "reference": "786035271d01882e129295858656324d3e5110ee",
  "title": "Contact form for YourDomain",
  "email": "you@yourdomain.com",
  "status": "active",
  "success_redirect": "https://yourdomain.com/contact-success/",
  "reply_to_field": "email",
  "recaptcha_mode": "default",
  "captcha_provider": "recaptcha",
  "captcha_site_key": "",
  "footer_enabled": true,
  "honeypot_field": "",
  "auto_response_enabled": true,
  "auto_response_subject": "Thanks for reaching out, {{name}}!",
  "auto_response_body": "Hi {{name}},\n\nThanks for reaching out. We will get back to you soon.",
  "auto_response_from_name": "YourDomain",
  "created": 1573136139,
  "last_posted": 1573222539,
  "post_count": 42,
  "last_passed": 1573222539,
  "post_passed": 40,
  "file_uploads_enabled": false
}
```

A few fields worth calling out:

- `recaptcha_mode`: whether captcha runs on Un-static's own keys (`default`), is turned off (`off`), or uses your own secret (`custom`).
- `captcha_provider`: which vendor is used when captcha is on: `recaptcha`, `turnstile`, or `hcaptcha`.
- `reply_to_field`: the name of the submitted field holding the visitor's e-mail address. This is the prerequisite for the auto-response below.
- `auto_response_enabled`, `auto_response_subject`, `auto_response_body`, `auto_response_from_name`: the automatic confirmation e-mail sent back to whoever submits the form. See [Send an Auto-Response Confirmation Email to Form Submitters](/how-to/add-auto-response-confirmation-email/) for setup and placeholder behavior.
- `file_uploads_enabled`: whether your account's plan allows file uploads on this form.

`GET /api/forms/{reference}` returns a `404` when the reference does not exist, and a `403` with `{"error": "Unauthorized"}` when the form belongs to another account.

## Update an endpoint (form)

`PUT https://forms.un-static.com/api/forms/{reference}`

This is a partial update: only the keys present in the request body are changed, everything else is left as-is.

```json title="Request"
{
  "reply_to_field": "email",
  "auto_response_enabled": true,
  "auto_response_subject": "Thanks for reaching out, {{name}}!",
  "auto_response_body": "Hi {{name}},\n\nThanks for reaching out. We will get back to you soon.",
  "auto_response_from_name": "YourDomain"
}
```

**Accepted fields**

| Name | Type | Description |
| --- | --- | --- |
| title | string | The form's display name. |
| success_redirect | string | URL the visitor is redirected to after a successful submission. |
| reply_to_field | string | Name of the submitted field holding the visitor's e-mail address; also the prerequisite for the auto-response. |
| honeypot_field | string | Name of the honeypot field used for spam filtering. |
| footer_enabled | bool | Whether the Un-static branding footer is included in the notification e-mail you receive for each submission. |
| captcha_provider | string | One of `off`, `recaptcha`, `turnstile`, `hcaptcha`. |
| recaptcha_secret | string | `"off"` disables captcha. `""` (empty string) switches to Un-static's own keys. Any other value sets your own secret. Setting a secret on a captcha-disabled form re-enables captcha, defaulting to the `recaptcha` provider unless `captcha_provider` is sent in the same request. |
| captcha_site_key | string | Max 255 characters; letters, digits, dots, dashes, and underscores only. Only valid together with your own captcha secret; returns a `422` otherwise. |
| auto_response_enabled | bool | Whether the auto-response e-mail is sent to submitters. |
| auto_response_subject | string | Max 200 characters. Accepts `{{field}}` placeholders. |
| auto_response_body | string | Max 5000 characters, plain text. Accepts `{{field}}` placeholders. |
| auto_response_from_name | string | Max 60 characters. The sender name shown to the visitor; the mail itself is always sent from `forms@un-static.com`. |

```json title="200"
{
  "reference": "786035271d01882e129295858656324d3e5110ee",
  "title": "Contact form for YourDomain",
  "status": "active",
  "success_redirect": "https://yourdomain.com/contact-success/",
  "reply_to_field": "email",
  "recaptcha_mode": "default",
  "captcha_provider": "recaptcha",
  "captcha_site_key": "",
  "footer_enabled": true,
  "honeypot_field": "",
  "auto_response_enabled": true,
  "auto_response_subject": "Thanks for reaching out, {{name}}!",
  "auto_response_body": "Hi {{name}},\n\nThanks for reaching out. We will get back to you soon.",
  "auto_response_from_name": "YourDomain"
}
```

```json title="422"
{
  "error": "validation_failed",
  "fields": {
    "captcha_site_key": "requires your own captcha secret (recaptcha_secret)"
  }
}
```

`PUT /api/forms/{reference}` returns the same `404` and `403` shapes as the GET endpoint above.