Homepage

Form

Last edit: Oct 13, 2026

Form (app/forms): defines which attributes of a resource can be submitted, how
they are validated and what happens after a successful submission. Deprecated,
use pages with GraphQL mutations instead

type Form implements AdminSharedAttributesInterface {
  api_call_notifications: [ApiCallNotification!]
  async_callback_actions: String
  async_callback_delay: String
  async_callback_max_attempts: Int
  async_callback_priority: AsyncCallbackPriority
  authorization_policies: [AuthorizationPolicy!]
  callback_actions: String
  configuration: HashObject
  created_at: JSONDate!
  default_payload: String
  email_notifications: [EmailNotification!]
  fields: HashObject
  flash_alert: String
  flash_notice: String
  id: ID!
  liquid_body: String
  manually_managed: Boolean
  metadata: HashObject
  name: String!
  physical_file_path: String
  redirect_to: String
  resource: String!
  resource_owner: String!
  response_headers: String
  sms_notifications: [SmsNotification!]
  spam_protection: HashObject
  updated_at: JSONDate!
}

Fields

api_call_notifications (ApiCallNotification)

API calls sent after a successful submission

async_callback_actions (String)

Same as callback_actions, but run in a background job after the request. Recommended for performance

async_callback_delay (String)

Liquid that evaluates to the number of minutes to delay the
async_callback_actions job, for example to run it 1 hour before an event (the
time_diff filter helps to calculate it)

async_callback_max_attempts (Int)

Number of retries of the async_callback_actions job when it fails. Usually there is no need to change it

async_callback_priority (AsyncCallbackPriority)

Priority of the async_callback_actions background job

authorization_policies (AuthorizationPolicy)

Authorization policies checked on submission; all must pass

callback_actions (String)

Liquid run right after the submission is saved, during the request. Prefer async_callback_actions

configuration (HashObject)

Deprecated, use fields instead

created_at (JSONDate)

Timestamp of when the object was created, set automatically by the system

default_payload (String)

Liquid that evaluates to JSON merged into (and overwriting) the submitted data
before validation, for example to store context.current_user.id without
letting the user change it

email_notifications (EmailNotification)

Emails sent after a successful submission

fields (HashObject)

Whitelist of the attributes that can be submitted and saved, with their
validations. Submitted values are available in callbacks and notifications
through the form variable, for example fields: { properties: { my_var } } as
form.properties.my_var

flash_alert (String)

Liquid that evaluates to the message shown when the submission fails validation, available as context.flash.alert

flash_notice (String)

Liquid that evaluates to the message shown after a successful submission, available as context.flash.notice

id (ID)

Unique identifier of the object

liquid_body (String)

Liquid that renders the form HTML, with access to the form_builder variable and the form tag

manually_managed (Boolean)

When true, the resource is managed outside of files: pos-cli deploy and sync never overwrite or delete it

metadata (HashObject)

Free-form data attached to the resource with the metadata key of its file (or the metadata argument of an admin mutation)

name (String)

Name of the form, used to render it and in the form_name argument of mutations

physical_file_path (String)

Path of the file the resource comes from, relative to the app directory, for
example views/pages/index.liquid or
modules/my_module/public/views/partials/header.liquid. Identifies the resource
in deploy, sync and admin mutations

redirect_to (String)

Liquid that evaluates to the path or URL the user is redirected to after a successful submission

resource (String)

Resource the form saves, for example User, Session or the name of a table

resource_owner (String)

Who can submit the form: creator (the default; the user who created the
record), self (for the User resource, the user themselves) or anyone. When set
to anyone, protect the form with authorization_policies

response_headers (String)

Liquid that evaluates to a JSON object of headers added to the response of a submission

sms_notifications (SmsNotification)

SMS notifications sent after a successful submission

spam_protection (HashObject)

Spam protection strategy (recaptcha_v2, recaptcha_v3 or hcaptcha) as the key, with its settings as the value

updated_at (JSONDate)

Timestamp of when the object was last updated, set automatically by the system

Interfaces

AdminSharedAttributesInterface

Attributes shared by resources that can be deployed from files with pos-cli
(pages, partials, layouts, notifications, authorization policies, schemas, assets etc.)

Questions?

We are always happy to help with any questions you may have.

contact us