How do I reply to someone who used the contact form?
Open the submission in the inbox and use the reply link. It opens a pre-addressed message in your own mail client, so the reply comes from your address and stays in your sent mail.
A contact form API that gets the reply back to the sender
A contact form is only finished when someone answers it. This endpoint validates the address before accepting the message, keeps the thread in a private inbox, opens the reply in your own mail client, and can email you the moment one arrives.
The contact fields, and what is enforced
A contact form usually collects a name, an address, and a message. Only two of those are enforced, because the address is what makes a reply possible.
{
"name": "Ada Lovelace",
"email": "ada@example.com",
"company": "Analytical Engines",
"message": "Could you send availability for a short call?"
}| Field | Rule |
|---|---|
| Required. Must contain a name, an @, and a dotted domain. | |
| message | Required. At least 3 characters after trimming. |
| Any other field | Optional. Stored as sent, trimmed, up to 5,000 characters. |
| website, _gotcha | Honeypots. If either is filled the submission is accepted and discarded. |
| _redirect | Optional. A URL on the submitting origin or the allow-list to return the browser to. |
The address is checked on the server, so a page that skips the type="email" attribute still cannot store an unreachable address. A message shorter than 3 characters is refused for the same reason: a contact form that captures "hi" and no way to answer is worse than one that captures nothing.
Replying to a contact submission
The reply comes from you, not from the form product, so it lands in the sender's inbox as an ordinary message with your address on it.
- Reply from your own mail client
- Every submission in the inbox opens a pre-addressed reply to the address that was submitted. Your thread history stays where the rest of your mail is.
- Get notified when one arrives
- Set a notification address on the project and each stored submission is emailed to it with the fields laid out. The submission response reports whether that email was sent, so a silent failure is visible.
- Only from a sender we own
- Notifications are sent from the product's own configured sender, never spoofed from your visitor's address. That keeps the mail authenticated and out of a spam folder.
Restricting the endpoint to your own site
A contact endpoint is a public URL. The allow-list decides which sites a browser may post to it from.
https://example.com
https://www.example.comWith the list set, a post from any other site is refused with 403 before validation runs. Leave it empty while you are testing, then fill it in before you publish the form.
Be clear about what this does and does not do: browsers send an Origin header on cross-site form posts, so the list stops another site from using your endpoint. It is not authentication, and a direct server-to-server request that sends no Origin is not blocked by it.
Delivery behaviour, stated plainly
A submission is stored first and notified second. If the notification cannot be sent, the submission is still in the inbox and the response says notificationSent: false — you never lose the message because an email failed.
If storage itself fails the endpoint answers 503 and says so, rather than returning a success for something it did not keep.
Nothing here comes with a service level attached: availability is not guaranteed and neither is the arrival of a notification email. For anything urgent or safety-critical, publish a monitored address alongside the form.
| Response | Meaning | When you get it |
|---|---|---|
| 201 Created | Accepted | The submission passed validation. The JSON body reports whether it was stored and includes an X-RateLimit-Remaining header. |
| 422 Unprocessable Content | Validation failed | A field limit was exceeded, a field name was unusable, or email and message did not pass their checks. The error string is safe to show a visitor. |
| 503 Service Unavailable | Storage unavailable | The submission was valid but the configuration lookup or the write did not complete. Nothing was silently dropped. |
A contact form should always say something back. Show the error sentence for a 422, ask the visitor to try again shortly for a 429 or 503, and thank them for anything else.
What SubmitHarbor does not do
Worth reading before you build on it. These limits apply today.
- The shared signed-out demo validates and echoes a preview; durable endpoints, storage, and notifications require a configured signed-in project.
- SubmitHarbor does not promise an uptime SLA, attachments, CAPTCHA providers, webhooks, CRM integrations, or unlimited submissions.
- Origin checks and honeypots reduce common abuse but do not replace a complete security and privacy review for sensitive forms.
Questions about contact form api
Can I be emailed when a contact form is submitted?
Yes. Set a notification address on the project and each stored submission is emailed to it. The submission response reports whether that email actually went.
Can I stop other sites using my contact endpoint?
Add your site's origins to the project allow-list. Browser posts from any other origin are refused with 403. It restricts sites, not servers — a request with no Origin header is not blocked.