Skip to main content
The Paubox Forms API lets you build, host, and process HIPAA compliant forms (patient intake, consent, surveys, waivers) directly inside your application. Submissions are stored on Paubox’s HITRUST certified infrastructure and visible in your Paubox Forms account. The Forms API is part of Paubox Forms, Paubox’s HIPAA compliant intake form product.

​
What you can build with it

Healthcare teams use the Paubox Forms API to:
  • Embed patient intake forms inside a portal or app and process responses without storing PHI on their own systems
  • Collect signed consent forms tied to appointments, onboarding, or treatment plans
  • Securely collect patient data with HIPAA compliant forms
  • Create, update, copy, and archive forms programmatically instead of clicking through the Paubox Forms app
  • Pull submissions into their own systems, or export them as CSV or PDF for records and reporting

​
Available endpoints

Base URL: https://api.paubox.com/v1/forms

​
Public endpoints

These endpoints are called by respondents loading and submitting forms from end user devices, so they require no API key. See the reference: Get form metadata and Submit a form response.

​
Management endpoints

These endpoints require an API key with the forms scope, sent as Authorization: Bearer YOUR_API_KEY. See Authentication. See the reference: List forms, Create a form, Get a form, Update a form, Copy a form, Archive a form, Unarchive a form, Get form statistics, List form submissions, Export submissions as CSV, Export a submission as CSV, and Export a submission as PDF.

​
How it handles HIPAA and security

The Paubox Forms API runs on the same HIPAA compliant infrastructure as the rest of the Paubox platform. Form definitions and submissions are stored in Paubox’s secure environment. Paubox signs a business associate agreement (BAA) with every customer. The two public endpoints are called by respondents loading and submitting forms from end user devices, where authentication wouldn’t be feasible. The form’s UUID acts as access control:
  • Form IDs are UUIDs, which makes them difficult to enumerate
  • Submissions are capped at 250 MB total, including form fields and any file attachments
All management endpoints require an API key with the forms scope, and a key can only access forms belonging to its own customer account. Paubox Forms is included with paid Paubox accounts, including Paubox Email Suite.

​
Authentication

The two public endpoints are intentionally unauthenticated. Respondents fill out forms from end user devices, so authentication happens at the form definition layer rather than the request layer. Management endpoints (listing, creating, updating, copying, archiving forms, and reading or exporting submissions) require a scoped API key generated in the Paubox dashboard. The key must carry the forms scope; a key without it receives a 401 Unauthorized response, and a valid key requesting another customer’s resources receives 403 Forbidden. See Authentication for details.

​
Get started

  1. Create a form in the Paubox Forms app, or generate an API key with the forms scope and create one with POST /api/forms.
  2. Copy the form’s UUID. This is the form_id you’ll pass to the endpoints.
  3. Use the public endpoints to render the form and accept submissions, and the management endpoints to read and export what comes in.

Get form metadata

Retrieve the form’s HTML, JSON schema, and CSS for rendering to a respondent.

Submit a form response

Post field values and file attachments to the submissions endpoint.

Authentication

Generate a scoped API key and authenticate to the management endpoints.

List form submissions

Retrieve submissions programmatically, or export them as CSV or PDF.

​
FAQs

Yes. Form definitions and submissions are stored on Paubox’s HITRUST certified, HIPAA compliant infrastructure. All data is encrypted in transit and at rest, and Paubox signs a business associate agreement (BAA) with every customer.
The two public endpoints are called by respondents loading and submitting forms from end user devices, where authentication wouldn’t be feasible. The form’s UUID acts as access control: each form has a unique UUID generated by Paubox when you create the form. All management endpoints require an API key with the forms scope.
Yes. Forms can be marked as signable. The signable and signature_confirmation_label fields on the form metadata indicate signature behavior, and a signature confirmation is recorded with the submission. PDF exports of submissions include the signature image.
Yes. The attachments array on POST /api/forms/{form_id}/submissions accepts file objects with a name and base64 encoded content. The maximum total submission size is 250 MB.
Submissions are stored in your Paubox Forms account and visible in the app. You can configure email notifications to designated recipients on each submission, retrieve submissions with GET /api/forms/{form_id}/submissions, or export them as CSV or PDF.
It depends on the endpoint. The public form fetch (GET /public/form_data/{form_id}), update, copy, list submissions, and both CSV export endpoints return 404 Not Found. The management GET /api/forms/{form_id}, the public submission endpoint, and the PDF export currently return 500 for an unknown form ID. The archive and unarchive endpoints do not verify that the form exists and return a 200 success response either way.
The form_data object on a submission accepts key-value pairs where keys match the field names defined in the form’s schema. Retrieve the schema by calling GET /public/form_data/{form_id} and reading the form_json field.
Test against any form in your Paubox Forms account. Deactivate or archive the form when you’re done testing to keep submission counts clean.

​
Community & support

Q&A

Ask usage questions in the Paubox Community.

Ideas

Propose features and improvements.
Never post PHI, recipient addresses, or message content in public threads. Account, billing, or anything sensitive goes to support@paubox.com.