File Uploads

Paid/manual forms can accept multipart file fields. The API enforces form-level upload enablement, maximum file count, maximum file size, MIME allowlists, and blocked executable/script-like filename extensions before notification delivery.

Multipart attachments

Direct multipart attachments use the configured count, size, MIME, and extension rules plus a limited signature check before email is queued. They do not use ClamAV and do not produce temporary download links. The accepted file is queued as an email attachment.

<form action="https://api.formsfort.com/submit" method="POST" enctype="multipart/form-data">
  <input type="hidden" name="access_key" value="YOUR_ACCESS_KEY" />
  <input type="file" name="attachment" />
  <button type="submit">Submit</button>
</form>

Advanced uploads

Advanced uploads reserve object storage keys through the public-CORS GET /upload endpoint, upload directly to storage, and require the upload scan worker to mark objects clean before a submission can consume them. Use the returned upload headers exactly; S3-compatible reservations bind the upload to the MIME type that passed validation. Upload reservations apply the same size, MIME, and blocked-extension checks as multipart uploads.

Submit the returned storage key in attachment or the original enhanced file field name; FormsFort atomically consumes each clean object so submitted storage keys are single-use, removes storage keys from forwarded custom data, and preserves the upload field name on attachment metadata.

The hosted advanced path sends object bytes through ClamAV. Only clean objects can be consumed by a submission.

The client helper includes FilePond-compatible theme hooks such as filepond--panel-root, filepond--drop-label, and filepond--label-action so advanced uploader theme snippets can be reused. Custom data-content labels preserve basic inline formatting such as the FilePond label-action span while stripping unsafe markup before rendering.

<form action="https://api.formsfort.com/submit" method="POST">
  <input type="hidden" name="access_key" value="YOUR_ACCESS_KEY" />
  <input
    type="file"
    name="attachment"
    data-advanced="true"
    multiple
    accept="image/*, application/pdf"
    data-max-files="3"
    data-max-file-size="5MB"
  />
  <button type="submit">Submit</button>
</form>
<script src="https://api.formsfort.com/client/script.js" async defer></script>

Delivery

Direct multipart files are queued as email attachments. Clean advanced object-storage files are delivered as temporary download links. Queued attachment content is redacted after successful email delivery.