Form Emails & Webhooks

When a form is submitted, three things can happen besides storing the answer: a confirmation email to the submitter, a notification email to someone in the org, and a webhook to any external system. Each is configured on the form and all three can coexist.

Confirmation email (to the submitter)

Enable by naming the field that contains the submitter’s email address (the reply-to field). With that set (plus working SMTP under Settings → Email) every submitter gets a copy of their own answers.
Subject and sender name are per-form. The reply-to address is validated and cleaned of line-breaks before use (preventing SMTP header injection through a crafted “email” answer).
Sending happens in the background after the submission is accepted: the visitor isn’t left waiting for the mail hop.

Admin notification email

One or more org addresses get the submission content; the message includes every visible field’s value, formatted (checkbox lists and addresses rendered readably).
The originating IP address can be included as a line in that email (per-form switch, on by default) or omitted; note it’s also suppressed when the form/store-IP rules keep IPs from being recorded.
Notification goes through the same SMTP settings; addresses are validated on save.

Per-form webhooks

Every form can also POST (or PUT/PATCH) its submissions to an external system; a CRM, a pipeline, a bot channel:

Endpoint URL + signing secret: with a secret set, the request carries an X-Chinaski-Signature: sha256=… header (HMAC of the request body) so receivers can verify authenticity.
Custom method, headers, and body template: the default body is JSON containing the answers; a custom body template with {{field_name}} placeholders can shape the payload to a target API, and custom key: value headers (one per line) ride along.
Webhook responses are recorded in the delivery log with retries (1/10/60-minute backoff, three attempts), the same delivery machinery as site-level webhooks, viewable/retryable in the admin.

The air-gap caveat

Emails and webhooks are outbound into the world. With air-gap mode enabled, forms still accept and store submissions, but confirmation emails, admin notifications, and webhook calls are all skipped. Local review in the admin still shows every answer.