Built like the rest of your stack.
Postbox is built on a simple premise: a form is a contract. The schema defines the terms. The endpoint is the signature. Everything else — validation, spam filtering, translation, routing — is enforcement. Here's how it fits together.
A form is a contract.
Most form tools give you a UI with a POST
endpoint bolted on the back. Postbox inverts that. You define the
schema
(fields, types, rules) and get back an endpoint URL. Browser form, curl
script, autonomous agent — every client holds the same contract and gets
the same validation, spam protection, and routing.
One URL. Two audiences. Same contract.
Every Postbox endpoint knows what it is. GET
it with Accept: application/json
and it tells you its schema. With Accept: text/html
it renders human-readable docs. POST
to it and you submit data. No SDK, no docs lookup, no syncing field
changes — when the contract changes, the documentation already has.
{
"name": "Contact",
"method": "POST",
"fields": [
"email",
"message"
]
}
Schemas evolve. Old URLs never break.
Every schema change produces a new endpoint URL. The old one keeps working forever, validated against the schema it was born with. Add a required field without breaking the mobile app that still sends the old payload. No migration scripts. No deprecation emails. No 3am pages.
What happens after submit is the actual product.
Most form tools stop at "data received." Every Postbox submission runs through an async pipeline — validation, spam detection, translation, smart replies drafted from your knowledge base, routing — while the submitter gets an instant 201. Each stage is toggleable per form. Configure it once, and every submission flows through.
Submissions are not data. They're a conversation.
Data sitting in a dashboard waits for you to do the reading. Connect our MCP server to your agent and just ask. What's the feedback looking like? What are people complaining about? Draft a reply to the angry one. No CSV exports. No dashboards. The submissions read themselves back.
Spam traps that trap spam, not your agents.
Honeypot fields are old magic: invisible inputs that bots fill and humans don't. Mark a field as a honeypot in the schema and it's validated on submission but omitted from the discovery endpoint. Agents asking what the form accepts never see it. Bots blindly filling every field still do. No CAPTCHAs, no JavaScript, no friction.
Retry-safe by default.
Every submission endpoint accepts an
Idempotency-Key
header. Include one (typically a UUID) and if you retry the same submission, you get the original result instead of a duplicate. Safe networks are rare. Retries happen. Duplicate submissions shouldn't.
The work nobody wants to write twice.
Submissions fan out wherever you need them. Webhooks with HMAC-SHA256 signatures and exponential-backoff retries. Discord rich embeds. Slack Block Kit messages. If a destination keeps failing, Postbox pauses it and emails you instead of hammering a broken endpoint. The boilerplate every form tool reinvents, written once, done properly.
The details that matter.
Does Postbox host the form UI for me? +
Accept: text/html.