Dbrij Forms Documentation

Dbrij Forms builds forms whose answers become work: a task with an owner, a lead, a ticket, a candidate. Forms take files, payments, signatures and approvals, confirm who is answering, collect with no signal in the mobile app, and speak more than one language.

This reference covers everything that touches a form from outside the dashboard: its public link and prefill, embedding it in your own site, the public API the form page itself uses, spam protection, webhooks, the live spreadsheet feed, exports, custom domains and the limits of each plan.

The public API needs no key: it is what the hosted page and the embed call for somebody with no account. JSON responses come inside an envelope, { "success": true, "data": … }; errors come as { "success": false, "statusCode": 400, "message": "…" }, and the message is written to be shown to the person answering. The spreadsheet feed is plain CSV.

Every published form has a public address, /f/<slug> on Dbrij, such as https://app.dbrij.com/f/job-application. Copy the exact link from the form's Share panel. A form that has closed (past its closing time, or full) still opens and says why, so somebody holding a printed flyer is not told the company does not exist. A form that has never been published answers 404.

Prefill with query parameters

Add a question's key as a query parameter and the question starts with that answer. The key is shown on each question in the editor.

https://app.dbrij.com/f/job-application?full_name=Ada%20Obi&role=engineer&skills=design,research&ref=newsletter

• Visible questions take a value from the link only while the form allows prefill, which it does unless you turn it off in the form's settings.
• Hidden fields always read the parameter named in their own "prefill from" setting, whatever the prefill setting says. Use them for campaign tags and referral codes.
• A choice question takes only one of its own options. A question with several answers takes them comma separated, keeping only the ones it offers.
• Consent, matrix, ranking, file, signature and calculated questions are never filled from a link. Text is cut to 2,000 characters.
• A prefilled value never replaces something the person has already typed, and answers brought back by a resume link win over the link's values.

Embedded view

?embed=1 drops the page's outer chrome for use inside a frame, and makes the form tell its parent page how tall it is (see Embedding).

Finish later

When a form has save and resume switched on, the person can save their answers and come back from a link, /f/<slug>?resume=<token>, optionally sent to their email. A draft can be finished for 30 days after its last save. Drafts are never counted, routed or billed as responses. Anyone with the link can see the saved answers, so the email says to keep it private.

Password protected forms

A form with a password shows its name and who is asking, and none of its questions, until the password is given. The page trades the password for an access token that lasts six hours (see POST /:slug/unlock) and keeps it in the browser. An integration passes the token as ?access=<token> when reading the form and as accessToken when saving or submitting.

Paste one script tag where the form should appear. By default it renders a button; pressing it opens the form over your page in a centred window. The form itself loads only when somebody asks for it. The Share panel gives you the tag with your form's slug filled in.

<script src="https://app.dbrij.com/forms-embed.js" data-form="job-application" data-label="Apply now" async></script>

<script src="https://app.dbrij.com/forms-embed.js" data-form="job-application" data-mode="inline" data-height="720" async></script>

The tag is small and has no dependencies: no globals, inline styles only, and every element it adds is prefixed dbrij-form. Several tags on one page each render their own form, and each tag runs once. The window closes on Escape, on a click outside it, on its close button, and on a close message from the form.

Messages the form posts

Framed with ?embed=1, the form page posts messages to its parent with postMessage. The embed believes a message only when it comes from its own script's origin and from the frame it made, so another frame on your page cannot resize or close it. Check both too if you listen yourself.

<iframe id="dbrij-form-job-application" src="https://app.dbrij.com/f/job-application?embed=1" title="Job application"
  style="width:100%;height:640px;border:0" loading="lazy"></iframe>
<script>
window.addEventListener("message", function (e) {
  var f = document.getElementById("dbrij-form-job-application");
  if (!f || e.origin !== "https://app.dbrij.com" || e.source !== f.contentWindow) return;
  if (e.data && e.data.type === "dbrij-form-height" && e.data.height > 0) f.style.height = e.data.height + "px";
});
</script>

These are the calls the hosted page and the embed make. Use them to put a form behind your own interface. No key is needed; each route has its own limit of requests a minute from one address, and going over it answers 429.

{
  "slug": "job-application",
  "name": "Job application",
  "description": "Tell us about yourself.",
  "companyName": "Acme",
  "schema": { "pages": [ { "id": "p1", "fields": [ { "key": "full_name", "type": "short_text", "label": "Your name", "required": true } ] } ] },
  "settings": { "allowPrefill": true, "saveAndResume": true, "welcome": null, "thankYou": null, "translations": {}, "quiz": null },
  "passwordRequired": false,
  "captchaSiteKey": null,
  "requireVerification": false,
  "verificationChannel": "email",
  "payment": null,
  "resumed": null,
  "badge": true,
  "closedReason": null
}

{ "password": "spring-intake" }

{ "accessToken": "…" }

{ "resumeToken": "9f2c…", "resumeUrl": "https://app.dbrij.com/f/job-application?resume=9f2c…", "emailed": true }

{
  "answers": { "full_name": "Ada Obi", "email": "ada@example.com", "role": "engineer", "cv": "https://…/forms/…/a1b2c3.pdf" },
  "clientId": "6f1d0c2a-attempt-1",
  "elapsedMs": 48210,
  "website": ""
}

{
  "responseId": "3c9e…",
  "status": "complete",
  "message": "Thank you. We will be in touch.",
  "paymentUrl": null
}

{ "identity": "ada@example.com" }

{ "channel": "email", "sentTo": "a••@example.com", "expiresIn": 600 }

{ "identity": "ada@example.com", "code": "481920" }

{ "verificationToken": "…" }

{ "fieldKey": "cv", "ext": "pdf" }

{ "putUrl": "https://…", "fileKey": "forms/…/a1b2c3.pdf", "url": "https://…/forms/…/a1b2c3.pdf" }

await fetch(ticket.putUrl, { method: 'PUT', body: file, headers: { 'Content-Type': file.type || 'application/octet-stream' } });
answers.cv = ticket.url;

Every form has two quiet checks, and can add a third.

A submission caught by the hidden field or the timing check is thanked and dropped: it gets an ordinary looking success with a random response id, and nothing is stored. The script learns nothing it could tune itself against. Answers collected offline skip the timing check.

The human check

When a form asks for one, the form view carries captchaSiteKey. Render the check with that key and send its token as captchaToken; a failed check answers 400 "Please finish the check that shows you are a person, then send again." If the checker itself cannot be reached, the answer goes through rather than being lost. The check runs only on Dbrij's own address: on a custom domain the form view carries no key and the hidden field and timing check stand alone.

Other guards

• Each public route has its own limit of requests a minute from one address (see Public form API).
• A form that confirms who is answering takes one response per proven email address or phone number.
• Dbrij can pause a company's submissions or set a daily ceiling to stop abuse. A submission past the ceiling answers 429, "This form has taken all the answers it can today."

Send every response to your own system. Add a connection from the form's Connect panel: a webhook (your own https address) or a team chat channel (paste the incoming webhook URL your team chat app gives you for that channel). A form sends to up to 10 places. A webhook address must start with https:// and be on the public internet.

A delivery goes out when a response is complete. A response held for payment, approval or a signature goes out once it is through, never before. Each webhook gets a signing secret, whsec_…, shown once when you create it: keep it then.

The request

POST /your/endpoint
content-type: application/json
x-dbrij-event: form.response
x-dbrij-signature: sha256=<hex>
x-dbrij-signature-v2: t=<unix seconds>,sha256=<hex>

{
  "type": "form.response",
  "form": { "id": "f1a2…", "name": "Job application", "slug": "job-application" },
  "response": {
    "id": "3c9e…",
    "submittedAt": "2026-11-03T09:14:22.000Z",
    "answers": { "full_name": "Ada Obi", "role": "engineer" },
    "readable": { "Your name": "Ada Obi", "Role": "Engineer" },
    "score": null,
    "maxScore": null,
    "language": null
  }
}

answers is keyed by question key, exactly as stored. readable is the same answers as people read them, keyed by the question's words, with empty answers left out.

Verify the signature

Both signatures are an HMAC SHA256 of the raw request body with your secret. Prefer the second: it signs the timestamp with the body, so a captured delivery cannot be replayed later. Compute over the exact bytes you received, before any JSON parsing.

import { createHmac, timingSafeEqual } from 'node:crypto';

const same = (a, b) => a.length === b.length && timingSafeEqual(Buffer.from(a), Buffer.from(b));

// x-dbrij-signature-v2: "t=1767430462,sha256=…"
function verifyV2(rawBody, header, secret, toleranceSec = 300) {
  const [tPart, sigPart] = header.split(',');
  const t = tPart.slice(2);
  if (Math.abs(Date.now() / 1000 - Number(t)) > toleranceSec) return false;
  const expected = 'sha256=' + createHmac('sha256', secret).update(t + '.' + rawBody).digest('hex');
  return same(sigPart, expected);
}

// x-dbrij-signature: "sha256=…"
function verify(rawBody, header, secret) {
  const expected = 'sha256=' + createHmac('sha256', secret).update(rawBody).digest('hex');
  return same(header, expected);
}

Retries and switching off

• Any answer other than 2xx, or no answer within 10 seconds, is a failure.
• A failed delivery is tried up to 5 times in all, waiting longer each time from 30 seconds.
• Each failed try counts. After 20 failures in a row the connection switches itself off, and the panel shows why. A success sets the count back to zero, and switching the connection on again does too.
• The Connect panel shows each connection's last status and error, and can send a test: a sample response, with id test, built from the form's questions.

Team chat

A team chat connection posts a message with the form's name, up to 12 answers and a link to the response in Dbrij. It is not signed.

Email

A form can also email up to 10 people at the company for each new response, and send the person who answered a confirmation from the company, with their answers if you choose. Both are set in the form's settings.

Turn on the live spreadsheet link in the form's Connect panel and you get a secret address that always answers with the latest responses as CSV. Spreadsheet apps can import it from the web (with an IMPORTDATA formula, or a data import from a web address) and refresh it on their own schedule.

Columns

Response id, Submitted (ISO 8601, UTC), Status, Respondent (the confirmed email or phone, when the form confirms who is answering), Collected offline, Arrived late, then Score on a quiz and Language when anyone answered in a translation, then one column per question, headed with the question's words. Several answers to one question are joined with ; .

Response id,Submitted,Status,Respondent,Collected offline,Arrived late,Your name,Role
3c9e…,2026-11-03T09:14:22.000Z,complete,,no,no,Ada Obi,engineer

From a form's responses in the dashboard you can download:

• CSV of every response.
• Spreadsheet (.xlsx) of every response.
• PDF of a single response: the questions as they were when it was answered, the answers, who answered and when.

The CSV, the .xlsx file and the live spreadsheet feed are written from one table, so their columns always match (see Live spreadsheet feed).

Serve your forms from your own domain, https://forms.yourcompany.com/<slug>, instead of Dbrij's address. Custom domains come with the Starter plan and up. A company can use up to 5, a domain can belong to one company only, and Dbrij's own domains cannot be used.

Set one up

Add the domain from a form's Share panel, then publish two records at your DNS host. The panel shows the exact values for your domain.

_dbrij-forms.forms.yourcompany.com.  TXT    "dbrij-forms=4b1e…"
forms.yourcompany.com.               CNAME  forms.dbrij.com.

Then choose Verify. The TXT record is checked first, then the CNAME, and the message says which one is missing. Records can take a few minutes to appear. Once verified, the domain serves your company's forms at /<slug> and a certificate is issued for it on the first visit; a domain never serves another company's form.

On a custom domain the human check is not offered; the hidden field and the timing check still apply (see Spam protection).

Forms is billed per company, monthly or yearly; a year costs ten months. The limits below are the ones the server enforces.

How each limit behaves

• Responses a month count across every form the company owns, per calendar month (UTC). Drafts saved to finish later never count. Past the allowance a submission answers 400, "This form has stopped taking answers."
• Live forms are checked when you publish. Drafts never count.
• File storage is measured on the stored files. When it is full, upload tickets are refused and the form stops taking files.
• Answers collected offline are never refused, for any limit, window or cap: they already exist. One that arrives after the form closed is kept and marked as arriving late.
• A subscription that lapses keeps its plan through a three day grace period, then drops to Free. Forms keep collecting.

Fixed limits