← Kind

Kind API

Send a contact inquiry from an approved site. Form keys and origin allowlists are configured server-side.

POST /v1/forms/:formKey/inquiries

fetch("https://api.example.com/v1/forms/your-form-key/inquiries", {
  method: "POST", headers: { "Content-Type": "application/json" },
  body: JSON.stringify({ name: "Maya Chen", email: "maya@example.com", message: "Hello!", turnstileToken, website: "" })
})

Request fields

name, email, message

Required. Email must be syntactically valid.

subject, sourceUrl

Optional, bounded strings.

turnstileToken

Required Turnstile token; Kind validates it on the server.

website

Hidden honeypot field. Always leave blank.

Responses

201 { "ok": true, "id": "…" }
400 { "error": "invalid_json" }
403 { "error": "origin_not_allowed" }
403 { "error": "verification_failed" }
415 { "error": "unsupported_media_type" }
422 { "error": "json_object_required" }
422 { "error": "name_email_message_required" }
429 { "error": "too_many_requests" }

Privacy

Inquiries belong to the organization that owns the form. Default retention is 90 days after an organization is closed; set a 30–365 day policy before collecting data.