Forms API

Dashboard → Audience → Forms → create contact or subscribe. Copy the access key from Manage. Keys are public by design; spam controls are honeypot, optional Origins, and rate limits.

POST https://asuito.com/api/forms/submit accepts application/x-www-form-urlencoded, multipart, or application/json. CORS reflects allowed Origins when configured.

access_key (required) — form public key.

kind — contact (default) or subscribe (must match the key).

email, name, message — subscribe requires email; contact needs message and/or email.

botcheck — honeypot; leave empty / hidden. If filled, the API returns ok without storing.

Useful for custom UIs. Subscribe returns { ok: true } after queuing the confirm email when needed.

curl -X POST https://asuito.com/api/forms/submit \
  -H "Content-Type: application/json" \
  -d '{
    "access_key": "YOUR_ACCESS_KEY",
    "kind": "contact",
    "name": "Ada",
    "email": "ada@example.com",
    "message": "Hello"
  }'

After a successful submit you may fire window.spx('form_submit', { kind: 'contact' }). Never put the visitor’s email in analytics properties.

Subscribe confirmation links hit https://asuito.com/api/audience/confirm?token=…. Unsubscribe links use /api/audience/unsubscribe. Those routes are for email links, not for your embed.