What is form ingest?
Form ingest is the channel that turns a browser form submission into a Hooksbase event. Every webhook exposes a public form URL of the form https://hooks.hooksbase.com/v1/form/{publicId}, returned as formIngestUrl when the webhook is created.
The endpoint handles three methods: POST to submit, GET to render a minimal built-in HTML form useful for testing or a lightweight embed, and OPTIONS for CORS preflight so a form can live on another origin.
The credential is the URL
There is no signing secret and no API key on the form route. The unguessable publicId in the URL is the entire access control, so treat the URL as sensitive and rotate the webhook if it is exposed. A form submission should not be treated as coming from a verified source — unlike a provider pack webhook, there is no signature to check.
Payload shape
Standard form encodings produce flat key-value data, plus a files array for multipart submissions. That shape rarely matches what a consumer wants, so most teams add a payload transform or Automation to restructure the submission before delivery.
Same pipeline as every other channel
A form submission becomes a normal delivery: retried under the webhook's retry policy, recorded in delivery history, replayable, and routed to the destination the routing rules select.
See Form to webhook for the full channel overview.
Frequently asked questions
What secures a form ingest URL?
Nothing but the unguessable publicId in the URL — there is no signing secret and no API key on the form route. Treat the URL as sensitive, rotate the webhook if it is exposed, and do not treat a form submission as coming from a verified source.
What shape does a form submission arrive in?
Flat key-value data from the standard form encodings, plus a files array for multipart submissions. That rarely matches what a consumer wants, so most teams add a payload transform or an Automation to restructure the submission before delivery.
What is Hooksbase?
Hooksbase is event infrastructure for AI agents. It ingests events over four channels — HTTP, email, HTML form, and scheduled cron — verifies them, routes them by rule, runs versioned Automations in the event path, and delivers them to HTTP and cloud destinations (AWS SQS, AWS EventBridge, GCP Pub/Sub, and S3-compatible storage) with retries, strict ordering, Standard Webhooks-compatible signing, deterministic replay, and a dead-letter path. It is a hosted service, runs on Cloudflare Workers, is operated at hooksbase.com, and is not affiliated with — and shares no code or ownership with — other similarly named webhook, hook, or tunnelling tools.
Related terms
- Ingest
Accepting an event into Hooksbase via HTTP, email, form, or scheduled cron.
Read - Email ingest
Accepting an inbound email as an event by sending it to a webhook’s generated ingest address.
Read - Scheduled ingest
Firing a webhook on a recurring cron cadence with no external producer.
Read - HMAC
Hash-based Message Authentication Code — proves a message came from someone who knows a shared secret and was not modified.
Read