> ## Documentation Index > Fetch the complete documentation index at: https://cactal.ai/docs/llms.txt > Use this file to discover all available pages before exploring further. # List form submissions > Returns submissions newest first as a cursor-paginated page. Filter by `form` name, `status` (`inbox` by default, or `spam`), and `source` (`published` for real visitors, `draft` for test submissions from the draft preview). Items carry the fields in submitted order, the inferred submitter email and name, page, spam signals, classifier verdict, and notification state. Submission data is personal information: never render it on the public website. ## OpenAPI ````yaml /api-reference/openapi.json get /websites/{websiteId}/forms/submissions openapi: 3.1.0 info: title: Cactal API version: 1.0.0 description: >- The Cactal public API. Create, edit, publish, and operate websites programmatically. Authenticate every request with an API key sent as `Authorization: Bearer `. servers: - url: https://api.cactal.ai/v1 security: - apiKey: [] tags: - name: Documentation description: >- Search and read the Cactal product documentation for concepts, guides, agent workflows, platform behavior, and API operations. - name: Feedback description: >- Submit free-form product feedback from users and agents to the Cactal feedback inbox. - name: Websites description: >- Create and manage websites — the top-level resource that owns source code, content, assets, domains, and analytics. - name: Website editors description: >- Grant, list, and revoke website-scoped editor access, and invite collaborators to a single website by email. - name: API keys description: >- Create, scope, rotate, and revoke the API keys that authenticate programmatic and agent access. - name: Source code description: >- Read and edit the framework source files of a website draft. Mutations require an edit lease. - name: Publishing description: Validate, build, publish, and roll back website versions. - name: CMS collections description: >- Define the content model: collections of structured content owned by a website. - name: CMS fields description: Manage the typed fields that make up a collection schema. - name: CMS items description: >- Create, query, publish, and organize the content entries inside a collection. - name: Domains description: >- Manage platform subdomains and custom domains, including DNS verification and the primary domain. - name: Assets description: Upload and manage website files and images served from the Cactal CDN. - name: Media generation description: >- Generate reference-guided website images that are stored as ordinary Cactal CDN assets. - name: Web research description: >- Look at the public web for a website's work: screenshots and measurements of external pages, a business's own pages read into profiles, and many images at once on numbered contact sheets. - name: Project Context description: >- Upload private durable reference material that the website agent can search, read, and inspect. - name: Analytics description: >- Read first-party traffic analytics for a website and export datasets as CSV. - name: Forms description: >- Read and triage website form submissions, manage notification recipients, and configure per-form settings. Visitors submit to `POST /_cactal/forms/{name}` on the website itself. - name: Server functions description: >- Inspect a website's server function runs and run its `http` functions on the draft. Visitors call `http` functions with `POST /_framework/server/{name}` on the website itself. - name: Secrets description: >- Manage a website's write-only secrets, which its server functions read from `env`. Values can be set and deleted but are never returned. - name: Organizations description: Manage organizations, members, and organization-wide invitations. - name: Audit log description: >- Read the immutable record of actions performed in an organization by users and API keys. - name: Billing description: >- Read billing state and manage plans, site capacity, and prepaid usage balance. Every billing operation requires the organization owner role, which API keys cannot hold — today these operations are performed from the dashboard, return 403 for API-key callers, and are hidden from MCP tool lists. paths: /websites/{websiteId}/forms/submissions: get: tags: - Forms summary: List form submissions description: >- Returns submissions newest first as a cursor-paginated page. Filter by `form` name, `status` (`inbox` by default, or `spam`), and `source` (`published` for real visitors, `draft` for test submissions from the draft preview). Items carry the fields in submitted order, the inferred submitter email and name, page, spam signals, classifier verdict, and notification state. Submission data is personal information: never render it on the public website. operationId: websiteForms.submissions.list parameters: - name: websiteId in: path required: true schema: type: string minLength: 1 - name: form in: query required: false schema: description: Only submissions of this form name. type: string - name: status in: query required: false schema: description: '`inbox` (default) or `spam`.' type: string enum: - inbox - spam - name: source in: query required: false schema: description: >- `published` for real visitors, `draft` for test submissions from the draft preview. type: string enum: - published - draft - name: cursor in: query required: false schema: type: string - name: limit in: query required: false schema: default: 20 type: integer minimum: 1 maximum: 100 responses: '200': description: A page of submissions and the next cursor. content: application/json: schema: type: object properties: items: type: array items: type: object properties: id: type: string formName: type: string status: type: string enum: - inbox - spam source: type: string enum: - published - draft data: type: array items: type: object properties: name: type: string value: anyOf: - type: string - type: array items: type: string required: - name - value additionalProperties: false description: Fields in submitted order. submitterEmail: type: - string - 'null' submitterName: type: - string - 'null' pagePath: type: - string - 'null' country: type: - string - 'null' flags: type: array items: type: string classification: anyOf: - type: object properties: verdict: type: string enum: - lead - spam confidence: type: number model: type: string at: type: string required: - verdict - confidence - model - at additionalProperties: false - type: 'null' notifiedAt: type: - string - 'null' notificationError: type: - string - 'null' createdAt: type: string required: - id - formName - status - source - data - submitterEmail - submitterName - pagePath - country - flags - classification - notifiedAt - notificationError - createdAt additionalProperties: false nextCursor: description: >- Opaque cursor for the next page. Pass it as the `cursor` parameter on the next request. `null` when this is the last page. type: - string - 'null' required: - items - nextCursor additionalProperties: false '400': description: >- Validation failed. The response `message` names the first invalid field. content: application/json: schema: $ref: '#/components/schemas/ServiceError' '401': description: Missing, invalid, expired, or revoked API key. content: application/json: schema: $ref: '#/components/schemas/ServiceError' '403': description: The authenticated principal lacks the required capability. content: application/json: schema: $ref: '#/components/schemas/ServiceError' '404': description: >- The resource does not exist or is outside the principal’s access scope. content: application/json: schema: $ref: '#/components/schemas/ServiceError' '429': description: >- Rate limit exceeded. Retry after the number of seconds in the `Retry-After` header. content: application/json: schema: $ref: '#/components/schemas/ServiceError' components: schemas: ServiceError: type: object required: - kind - message description: >- Canonical error body returned by every non-2xx response. Extra fields carry error-specific details. properties: kind: type: string enum: - validation - unauthorized - forbidden - not_found - conflict - rate_limited - internal description: Stable, machine-readable error category. message: type: string description: Human-readable explanation of the failure. suggestion: type: string description: >- What to do next when the failure has a known fix; may name the exact operation to call. validValues: type: array items: type: string description: The acceptable values for the failing field, when the set is closed. additionalProperties: true securitySchemes: apiKey: type: http scheme: bearer description: >- Cactal API key. Create one in the dashboard or via `POST /apiKeys`. The plaintext key is shown once at creation. ```` This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.