Form Domains

Base URL: https://api.cornerspot.net

Authentication: requests use a bearer token, for example Authorization: Bearer YOUR_API_KEY.

List form domains

GET /c/api/v1/form_domains

Returns a paginated, filterable list of the team's form-embedding allowlist entries. Requires the form_domains_read scope and the Forms module.

Query parameters

FIELD	TYPE	DESCRIPTION
`query`	string	Partial hostname search.
`filter[enabled]`	string one of `true`, `false`	Filter by enabled state. `true` returns only active entries; `false` returns only disabled ones.
`filter[search]`	string	Alternative to `query` — partial hostname search.
`sort`	string	Sort column, `-` prefix for descending. One of hostname, enabled, created_at, updated_at. Default: hostname.
`page`	integer	1-based page number.
`per_page`	integer	Page size (1–100, default 25).

Code samples

curl --request GET \
  --url 'https://api.cornerspot.net/c/api/v1/form_domains' \
  --header 'Authorization: Bearer YOUR_API_KEY'

const response = await fetch('https://api.cornerspot.net/c/api/v1/form_domains', {
  method: 'GET',
  headers: {
    'Authorization': 'Bearer YOUR_API_KEY'
  }
});

const data = await response.json();
console.log(data);

// Node.js 18+ (native fetch)
const response = await fetch('https://api.cornerspot.net/c/api/v1/form_domains', {
  method: 'GET',
  headers: {
    'Authorization': 'Bearer YOUR_API_KEY'
  }
});

if (!response.ok) {
  throw new Error(`Request failed: ${response.status}`);
}

const data = await response.json();
console.log(data);

import json
import urllib.request

url = "https://api.cornerspot.net/c/api/v1/form_domains"
headers = {
    "Authorization": "Bearer YOUR_API_KEY",
}

request = urllib.request.Request(url, headers=headers, method="GET")

with urllib.request.urlopen(request) as response:
    data = json.loads(response.read().decode("utf-8"))
    print(data)

require "json"
require "net/http"

uri = URI("https://api.cornerspot.net/c/api/v1/form_domains")

request = Net::HTTP::Get.new(uri)
request["Authorization"] = "Bearer YOUR_API_KEY"

response = Net::HTTP.start(uri.hostname, uri.port, use_ssl: uri.scheme == "https") do |http|
  http.request(request)
end

puts JSON.parse(response.body)

<?php

$curl = curl_init();

curl_setopt_array($curl, [
    CURLOPT_URL => 'https://api.cornerspot.net/c/api/v1/form_domains',
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_CUSTOMREQUEST => 'GET',
    CURLOPT_HTTPHEADER => [
        'Authorization: Bearer YOUR_API_KEY',
    ],
]);

$response = curl_exec($curl);
curl_close($curl);

$data = json_decode($response, true);
print_r($data);

Responses

STATUS	DESCRIPTION
`200` OK	a page of form domains
`401` Unauthorized	missing or invalid API key
`402` Payment Required	the team's plan doesn't include the Forms module
`403` Forbidden	the key lacks the form_domains_read scope

Create a form domain

POST /c/api/v1/form_domains

Adds a hostname to the team's form-embedding allowlist. Requires form_domains_write.

Request body

FIELD	TYPE	DESCRIPTION
`form_domain`	object
`form_domain.hostname`	string · required	Required — bare hostname to allow (no scheme, no path, no trailing slash).
`form_domain.include_subdomains`	boolean	When true, all subdomains are also allowed. Defaults to false.
`form_domain.enabled`	boolean	Whether this entry is active. Defaults to true.
`form_domain.note`	string	Optional human-readable note.

Code samples

curl --request POST \
  --url 'https://api.cornerspot.net/c/api/v1/form_domains' \
  --header 'Content-Type: application/json' \
  --header 'Authorization: Bearer YOUR_API_KEY' \
  --data '{
  "form_domain": {
    "hostname": "string",
    "include_subdomains": true,
    "enabled": true,
    "note": "string"
  }
}'

const response = await fetch('https://api.cornerspot.net/c/api/v1/form_domains', {
  method: 'POST',
  headers: {
    'Content-Type': 'application/json',
    'Authorization': 'Bearer YOUR_API_KEY'
  },
  body: JSON.stringify({
    "form_domain": {
      "hostname": "string",
      "include_subdomains": true,
      "enabled": true,
      "note": "string"
    }
  })
});

const data = await response.json();
console.log(data);

// Node.js 18+ (native fetch)
const response = await fetch('https://api.cornerspot.net/c/api/v1/form_domains', {
  method: 'POST',
  headers: {
    'Content-Type': 'application/json',
    'Authorization': 'Bearer YOUR_API_KEY'
  },
  body: JSON.stringify({
    "form_domain": {
      "hostname": "string",
      "include_subdomains": true,
      "enabled": true,
      "note": "string"
    }
  })
});

if (!response.ok) {
  throw new Error(`Request failed: ${response.status}`);
}

const data = await response.json();
console.log(data);

import json
import urllib.request

url = "https://api.cornerspot.net/c/api/v1/form_domains"
payload = json.dumps({
  "form_domain": {
    "hostname": "string",
    "include_subdomains": true,
    "enabled": true,
    "note": "string"
  }
}).encode("utf-8")
headers = {
    "Content-Type": "application/json",
    "Authorization": "Bearer YOUR_API_KEY",
}

request = urllib.request.Request(url, data=payload, headers=headers, method="POST")

with urllib.request.urlopen(request) as response:
    data = json.loads(response.read().decode("utf-8"))
    print(data)

require "json"
require "net/http"

uri = URI("https://api.cornerspot.net/c/api/v1/form_domains")

request = Net::HTTP::Post.new(uri)
request["Content-Type"] = "application/json"
request["Authorization"] = "Bearer YOUR_API_KEY"
request.body = JSON.generate({
  "form_domain": {
    "hostname": "string",
    "include_subdomains": true,
    "enabled": true,
    "note": "string"
  }
})

response = Net::HTTP.start(uri.hostname, uri.port, use_ssl: uri.scheme == "https") do |http|
  http.request(request)
end

puts JSON.parse(response.body)

<?php

$curl = curl_init();

curl_setopt_array($curl, [
    CURLOPT_URL => 'https://api.cornerspot.net/c/api/v1/form_domains',
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_CUSTOMREQUEST => 'POST',
    CURLOPT_HTTPHEADER => [
        'Content-Type: application/json',
        'Authorization: Bearer YOUR_API_KEY',
    ],
    CURLOPT_POSTFIELDS => json_encode([
    'form_domain' => [
        'hostname' => 'string',
        'include_subdomains' => true,
        'enabled' => true,
        'note' => 'string',
    ],
]),
]);

$response = curl_exec($curl);
curl_close($curl);

$data = json_decode($response, true);
print_r($data);

Responses

STATUS	DESCRIPTION
`201` Created	created
`401` Unauthorized	missing or invalid API key
`402` Payment Required	the team's plan doesn't include the Forms module
`403` Forbidden	the key lacks the form_domains_write scope
`422` Unprocessable Content	validation errors (e.g. invalid hostname format or duplicate)

Get a form domain

GET /c/api/v1/form_domains/{id}

Path parameters

FIELD	TYPE	DESCRIPTION
`id`	string · required	FormDomain id.

Code samples

curl --request GET \
  --url 'https://api.cornerspot.net/c/api/v1/form_domains/abc123' \
  --header 'Authorization: Bearer YOUR_API_KEY'

const response = await fetch('https://api.cornerspot.net/c/api/v1/form_domains/abc123', {
  method: 'GET',
  headers: {
    'Authorization': 'Bearer YOUR_API_KEY'
  }
});

const data = await response.json();
console.log(data);

// Node.js 18+ (native fetch)
const response = await fetch('https://api.cornerspot.net/c/api/v1/form_domains/abc123', {
  method: 'GET',
  headers: {
    'Authorization': 'Bearer YOUR_API_KEY'
  }
});

if (!response.ok) {
  throw new Error(`Request failed: ${response.status}`);
}

const data = await response.json();
console.log(data);

import json
import urllib.request

url = "https://api.cornerspot.net/c/api/v1/form_domains/abc123"
headers = {
    "Authorization": "Bearer YOUR_API_KEY",
}

request = urllib.request.Request(url, headers=headers, method="GET")

with urllib.request.urlopen(request) as response:
    data = json.loads(response.read().decode("utf-8"))
    print(data)

require "json"
require "net/http"

uri = URI("https://api.cornerspot.net/c/api/v1/form_domains/abc123")

request = Net::HTTP::Get.new(uri)
request["Authorization"] = "Bearer YOUR_API_KEY"

response = Net::HTTP.start(uri.hostname, uri.port, use_ssl: uri.scheme == "https") do |http|
  http.request(request)
end

puts JSON.parse(response.body)

<?php

$curl = curl_init();

curl_setopt_array($curl, [
    CURLOPT_URL => 'https://api.cornerspot.net/c/api/v1/form_domains/abc123',
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_CUSTOMREQUEST => 'GET',
    CURLOPT_HTTPHEADER => [
        'Authorization: Bearer YOUR_API_KEY',
    ],
]);

$response = curl_exec($curl);
curl_close($curl);

$data = json_decode($response, true);
print_r($data);

Responses

STATUS	DESCRIPTION
`200` OK	the form domain
`404` Not Found	no such form domain in this team

Update a form domain

PATCH /c/api/v1/form_domains/{id}

Updates an existing allowlist entry. Requires form_domains_write.

Path parameters

FIELD	TYPE	DESCRIPTION
`id`	string · required	FormDomain id.

Request body

FIELD	TYPE	DESCRIPTION
`form_domain`	object
`form_domain.hostname`	string
`form_domain.include_subdomains`	boolean
`form_domain.enabled`	boolean
`form_domain.note`	string

Code samples

curl --request PATCH \
  --url 'https://api.cornerspot.net/c/api/v1/form_domains/abc123' \
  --header 'Content-Type: application/json' \
  --header 'Authorization: Bearer YOUR_API_KEY' \
  --data '{
  "form_domain": {
    "hostname": "string",
    "include_subdomains": true,
    "enabled": true,
    "note": "string"
  }
}'

const response = await fetch('https://api.cornerspot.net/c/api/v1/form_domains/abc123', {
  method: 'PATCH',
  headers: {
    'Content-Type': 'application/json',
    'Authorization': 'Bearer YOUR_API_KEY'
  },
  body: JSON.stringify({
    "form_domain": {
      "hostname": "string",
      "include_subdomains": true,
      "enabled": true,
      "note": "string"
    }
  })
});

const data = await response.json();
console.log(data);

// Node.js 18+ (native fetch)
const response = await fetch('https://api.cornerspot.net/c/api/v1/form_domains/abc123', {
  method: 'PATCH',
  headers: {
    'Content-Type': 'application/json',
    'Authorization': 'Bearer YOUR_API_KEY'
  },
  body: JSON.stringify({
    "form_domain": {
      "hostname": "string",
      "include_subdomains": true,
      "enabled": true,
      "note": "string"
    }
  })
});

if (!response.ok) {
  throw new Error(`Request failed: ${response.status}`);
}

const data = await response.json();
console.log(data);

import json
import urllib.request

url = "https://api.cornerspot.net/c/api/v1/form_domains/abc123"
payload = json.dumps({
  "form_domain": {
    "hostname": "string",
    "include_subdomains": true,
    "enabled": true,
    "note": "string"
  }
}).encode("utf-8")
headers = {
    "Content-Type": "application/json",
    "Authorization": "Bearer YOUR_API_KEY",
}

request = urllib.request.Request(url, data=payload, headers=headers, method="PATCH")

with urllib.request.urlopen(request) as response:
    data = json.loads(response.read().decode("utf-8"))
    print(data)

require "json"
require "net/http"

uri = URI("https://api.cornerspot.net/c/api/v1/form_domains/abc123")

request = Net::HTTP::Patch.new(uri)
request["Content-Type"] = "application/json"
request["Authorization"] = "Bearer YOUR_API_KEY"
request.body = JSON.generate({
  "form_domain": {
    "hostname": "string",
    "include_subdomains": true,
    "enabled": true,
    "note": "string"
  }
})

response = Net::HTTP.start(uri.hostname, uri.port, use_ssl: uri.scheme == "https") do |http|
  http.request(request)
end

puts JSON.parse(response.body)

<?php

$curl = curl_init();

curl_setopt_array($curl, [
    CURLOPT_URL => 'https://api.cornerspot.net/c/api/v1/form_domains/abc123',
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_CUSTOMREQUEST => 'PATCH',
    CURLOPT_HTTPHEADER => [
        'Content-Type: application/json',
        'Authorization: Bearer YOUR_API_KEY',
    ],
    CURLOPT_POSTFIELDS => json_encode([
    'form_domain' => [
        'hostname' => 'string',
        'include_subdomains' => true,
        'enabled' => true,
        'note' => 'string',
    ],
]),
]);

$response = curl_exec($curl);
curl_close($curl);

$data = json_decode($response, true);
print_r($data);

Responses

STATUS	DESCRIPTION
`200` OK	updated
`404` Not Found	no such form domain in this team
`422` Unprocessable Content	validation errors

Delete a form domain

DELETE /c/api/v1/form_domains/{id}

Permanently removes a hostname from the team's form-embedding allowlist. Requires form_domains_write.

Path parameters

FIELD	TYPE	DESCRIPTION
`id`	string · required	FormDomain id.

Code samples

curl --request DELETE \
  --url 'https://api.cornerspot.net/c/api/v1/form_domains/abc123' \
  --header 'Authorization: Bearer YOUR_API_KEY'

const response = await fetch('https://api.cornerspot.net/c/api/v1/form_domains/abc123', {
  method: 'DELETE',
  headers: {
    'Authorization': 'Bearer YOUR_API_KEY'
  }
});

const data = await response.json();
console.log(data);

// Node.js 18+ (native fetch)
const response = await fetch('https://api.cornerspot.net/c/api/v1/form_domains/abc123', {
  method: 'DELETE',
  headers: {
    'Authorization': 'Bearer YOUR_API_KEY'
  }
});

if (!response.ok) {
  throw new Error(`Request failed: ${response.status}`);
}

const data = await response.json();
console.log(data);

import json
import urllib.request

url = "https://api.cornerspot.net/c/api/v1/form_domains/abc123"
headers = {
    "Authorization": "Bearer YOUR_API_KEY",
}

request = urllib.request.Request(url, headers=headers, method="DELETE")

with urllib.request.urlopen(request) as response:
    data = json.loads(response.read().decode("utf-8"))
    print(data)

require "json"
require "net/http"

uri = URI("https://api.cornerspot.net/c/api/v1/form_domains/abc123")

request = Net::HTTP::Delete.new(uri)
request["Authorization"] = "Bearer YOUR_API_KEY"

response = Net::HTTP.start(uri.hostname, uri.port, use_ssl: uri.scheme == "https") do |http|
  http.request(request)
end

puts JSON.parse(response.body)

<?php

$curl = curl_init();

curl_setopt_array($curl, [
    CURLOPT_URL => 'https://api.cornerspot.net/c/api/v1/form_domains/abc123',
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_CUSTOMREQUEST => 'DELETE',
    CURLOPT_HTTPHEADER => [
        'Authorization: Bearer YOUR_API_KEY',
    ],
]);

$response = curl_exec($curl);
curl_close($curl);

$data = json_decode($response, true);
print_r($data);

Responses

STATUS	DESCRIPTION
`204` No Content	deleted
`404` Not Found	no such form domain in this team

List form domains

Query parameters

Code samples

Responses

Create a form domain

Request body

Code samples

Responses

Get a form domain

Path parameters

Code samples

Responses

Update a form domain

Path parameters

Request body

Code samples

Responses

Delete a form domain

Path parameters

Code samples

Responses

Was this article helpful?