Using the dashboard

A brand-new account lands on a short setup wizard, not an empty dashboard: it already provisioned one starter form for you, so the wizard walks through naming that form, copying its endpoint, and choosing where submissions should notify you - three steps, then straight into the real dashboard. Skip it any time; the form is already there either way.

The home screen and the Forms tab both list every form in the workspace: name, live endpoint (with a one-click copy button), active/paused state, and running totals for submissions and spam caught. New form creates one instantly with a working endpoint - no fields to declare up front, since the endpoint accepts whatever your HTML form or fetch call sends it. Click through to a form for its own four tabs: Inbox, Destinations, Deliveries, Settings.

The default tab on any form - every submission that landed on it, newest first, with the fields it actually contains (submissions aren't schema'd, so different messages can show different fields). Quarantined spam is filtered out of this view by default; switch to the spam filter to review what got caught, mark false positives as not-spam, or delete. The workspace-wide version of this list, across every form, is the sidebar's Submissions page, filterable by form, date range and spam/not-spam.

Where a form's submissions get delivered. Add destination opens a picker for Email, Slack, Discord, Telegram or Webhook, each with its own small config form (a webhook URL, a Slack incoming-webhook URL, a bot token and chat id for Telegram, and so on). A form can have several destinations of the same kind - two Slack channels, or Slack plus a webhook - and each one can be paused without deleting it, which stops delivery but keeps the configuration and history intact.

Email destinations only offer addresses your workspace has already verified, listed under Settings → Linked email addresses. Webhook URLs are checked against private and loopback addresses before they're saved, and any bot token or webhook secret you enter is write-only from then on - the dashboard never displays it back to you, only whether one is set.

The same page also holds routing rules for deciding which destinations a given submission actually reaches, on Pro and Agency.

Underneath the destinations list, on plans that include it: a reorderable list of rules, each with a plain-language condition builder (field, operator, value - combined with AND or OR) and a set of destinations it sends matching submissions to. Drag to reorder; a rule can be set to stop evaluation once it matches, so nothing below it also fires. The bottom rule is always the catch-all default and can't be removed, so a submission is never silently dropped because nothing else matched. Full condition syntax is on the routing rules page.

A log of every attempt to deliver a submission to a destination, independent of whether the submission itself was spam - status (delivered, pending, failed, retrying, given up), which destination, and the error message if one failed. This is the first place to look when "a submission came in but I never got the email/Slack message" - it shows whether WebForms tried and what the destination said back, rather than leaving you guessing between a delivery problem and a spam-filter problem.

Everything specific to one form, grouped into panels:

• DetailsName and description shown in the dashboard - purely internal, never seen by whoever fills out the form.
• StatusPause a form instantly - the endpoint starts refusing new submissions without deleting anything, then resume later with history and settings intact.
• Spam protectionThreshold, honeypot field name, time-trap minimum seconds, disposable-email handling, blocked domains and keywords - the knobs behind the scoring described on the spam protection page.
• After submittingWhere a browser submit redirects to, and the message shown if you'd rather show a success page than redirect. Redirect and message are free on every plan; a custom heading, a toggle to always respond with JSON, and custom key/value fields merged into that JSON on success or error are Pro and Agency.
• AutoresponderTurn on a confirmation email sent back to whoever submitted, with your own subject, body and from-name.
• File uploadsAllow attachments, and cap size and file types.
• Allowed domainsRestrict which sites the endpoint accepts submissions from - a plain hostname or a *.example.com wildcard. Pro and Agency.
• Notification emailWhich template renders the email you receive for a new submission - a built-in style, or one of your saved custom templates.

A workspace-wide analytics view, separate from the submission list itself: a chart of clean vs. quarantined submissions over a chosen date range, the overall spam rate, and a breakdown of which signal is doing the catching (honeypot, time trap, disposable email, AI classifier, and so on) - the page to check whether the defences are earning their keep, with one click through to the filtered submission list for the messages themselves.

Describe the form in plain language - "a job application form with resume upload and a cover letter field" - and get back working code (HTML, React, or a few other stacks) wired to a real WebForms endpoint, ready to paste into your site. It creates the form for you as part of generating the code, on plans that include it, with a monthly cap on generations shown right on the page. Purely a convenience for a human in a browser - an agent that already knows what fields it wants can just call POST /v1/forms directly instead.

Workspace-and-account level, not per-form:

• ProfileYour display name.
• PasswordChange it, or set one for the first time if you signed up via a linked account.
• WorkspaceRename the workspace or change its slug.
• Linked email addressesVerify additional "from" addresses email destinations and autoresponders can send as, beyond the one you signed up with.
• TeamInvite people by email and role (admin or member) - the only way to send an invite, deliberately kept out of the write API - see who's pending, change a member's role, or remove them. The workspace owner can't be changed or removed here.
• API keysCreate scoped keys for the Submissions API and write API, see when each was last used, revoke one instantly. See the write API page for what each scope grants.
• Plan & usageCurrent plan, this period's submission count against your quota, and the upgrade path.
• Custom email templatesIts own page under Settings: write your own notification email in HTML, or describe what you want and have AI draft a starting point, on plans that include it.

Current plan and renewal date, a one-click upgrade/downgrade that hands off to a hosted checkout page (no card details touch WebForms directly), and a link to the customer portal for updating payment methods, viewing invoices, or cancelling. Add-ons live here too when your plan supports them: white label (remove WebForms branding from autoresponder emails and the success page), extra storage for uploads, and extra linked email addresses beyond your plan's included count.

Three roles: owner (exactly one per workspace, can't be changed or removed through the dashboard or the API), admin (everything an owner can do except touch the owner's own membership), and member (can see and use forms, submissions and destinations, but can't change billing, invite people, or edit workspace settings). The same role check backs the dashboard's buttons and the write API's members:write scope, so a member can't get around a dashboard restriction by switching to an API key. Billing stays a dashboard-only action for every role, including the owner - there is no API path to it at all.

Forms, destinations, routing, templates, workspace settings, and managing existing team members (role changes, removal) are all reachable from the write API with a scoped key, so a script or an AI agent can do most of what's described above without opening a browser. Three things stay dashboard-only on purpose: a single person's own account (password, display name, email verification - there's no "current user" for an API key to be), sending a new team invitation, since that's a write action that emails someone, and billing - starting a checkout or opening the customer portal is not something an API key can do, at all.