Built with Chinaski

Form Emails & Webhooks

When a form is submitted, three things can happen besides storing the answer: a confirmation email to the submitter, a notification email to someone in the org, and a webhook to any external system. Each is configured on the form and all three can coexist.

Confirmation email (to the submitter)

  • Enable by naming the field that contains the submitter’s email address (the reply-to field). With that set — plus working SMTP under Settings → Email — every submitter gets a copy of their own answers.
  • Subject and sender name are per-form. The reply-to address is validated and cleaned of line-breaks before use (preventing SMTP header injection through a crafted “email” answer).
  • Sending happens in the background after the submission is accepted — the visitor isn’t left waiting for the mail hop.

Admin notification email

  • One or more org addresses get the submission content; the message includes every visible field’s value, formatted (checkbox lists and addresses rendered readably).
  • The originating IP address can be included as a line in that email (per-form switch, on by default) or omitted — note it’s also suppressed when the form/store-IP rules keep IPs from being recorded.
  • Notification goes through the same SMTP settings; addresses are validated on save.

Per-form webhooks

Every form can also POST (or PUT/PATCH) its submissions to an external system — a CRM, a pipeline, a bot channel:

  • Endpoint URL + signing secret — with a secret set, the request carries an X-Chinaski-Signature: sha256=… header (HMAC of the request body) so receivers can verify authenticity.
  • Custom method, headers, and body template — the default body is JSON containing the answers; a custom body template with {{field_name}} placeholders can shape the payload to a target API, and custom key: value headers (one per line) ride along.
  • Webhook responses are recorded in the delivery log with retries (1/10/60-minute backoff, three attempts) — the same delivery machinery as site-level webhooks, viewable/retryable in the admin.

The air-gap caveat

Emails and webhooks are outbound into the world. With air-gap mode enabled, forms still accept and store submissions, but confirmation emails, admin notifications, and webhook calls are all skipped. Local review in the admin still shows every answer.