Nevision Forms accepts submissions from any HTML form and relays them to your confirmed recipients by email, with spam filtered out and the full history kept in a dashboard inbox. There is no backend to write and no database to run.

If the Nevision recorder is installed on the same site, each submission is also linked to the session replay of the visit that produced it.

1. Create a form

In the dashboard, open Forms and create one against the site it belongs to. You get an endpoint of the form https://api.nevision.app/f/YOUR_FORM_ID.

2. Confirm a recipient

Add the addresses that should receive submissions. Each one is sent a confirmation link and receives nothing until it is clicked — an endpoint that emails unconfirmed addresses on an anonymous POST is a spam relay. Members of your Nevision account are pre-confirmed and skip this step.

Submissions are stored whether or not anyone is confirmed, so nothing is lost while an address is pending.

3. Point your form at it

<form action="https://api.nevision.app/f/YOUR_FORM_ID" method="POST">
  <label>Email <input type="email" name="email" required></label>
  <label>Message <textarea name="message" required></textarea></label>

  <!-- Spam trap: keep this hidden and leave it empty -->
  <input type="text" name="_gotcha" style="display:none" tabindex="-1" autocomplete="off">

  <button type="submit">Send</button>
</form>

Who is allowed to submit

A form only accepts submissions from the domains configured on its site. That allowlist is the endpoint's only authentication — it is what stops someone pasting your endpoint onto their own page. Requests arriving with no Origin and no Referer are rejected, which is why server-side calls must set Origin explicitly.

Reserved fields

These field names are inputs, never stored data. They are read and then stripped, so they can never appear in your inbox as visitor content.

_next — where to send the visitor after a successful submission. Must be on one of the site's own domains; anything else is ignored and the hosted thank-you page is used instead, so the endpoint cannot be turned into an open redirect.
_subject — overrides the notification email's subject.
_replyto — sets Reply-To. Defaults to the submission's own email field when there is one.
_ts — milliseconds since the epoch when the form rendered. Plain HTML cannot set this; the script examples above do. A form submitted implausibly fast scores as spam.
_gotcha — the honeypot. Keep it hidden and empty. Anything in it is decisive spam on its own.
_nvsession — added automatically by the recorder to link the submission to a session replay. Only forms whose action points at Nevision are linked.

Responses

Send Accept: application/json to get JSON on both success and failure. Without it, a browser is redirected — to your thank-you page on success, and to a hosted error page otherwise.

200 — accepted, with submissionId. Spam is answered identically on purpose, so a bot learns nothing from the response. A 200 therefore does not by itself mean the submission was emailed.
403 — the Origin or Referer is not on the site's allowlist, or the form is turned off.
404 — no form with that id.
413 — too many fields, or the payload is over the limit.
422 — a required field was empty. The message names it.
429 — rate limited, or the monthly submission quota is used up.

File uploads

Available on paid plans. Enable uploads on the form, then submit as ordinary multipart/form-data — a plain <input type="file"> is enough. Up to 5 files and 4 MB per submission. Attachments are downloadable from the inbox.

If storing an attachment fails, the submission is still saved without it rather than rejected. Losing a lead is worse than losing a file.

Spam filtering

Signals are weighted rather than absolute: submit timing, links and keyword patterns in the content, bot fingerprints, IP reputation, and repeated identical payloads all contribute to one score. The honeypot is the single exception and is decisive on its own.

Spam is stored so you can audit the filter rather than trust it, is never emailed, and never counts against your monthly quota. Suspicious submissions are delivered and flagged rather than withheld.

Limits

Up to 100 fields, 50,000 characters each, 256 KB in total.
60 submissions per minute per site.
Monthly submissions and retention depend on your plan — see pricing.

Test before you publish

Open a form in the dashboard and use Send test submission. It runs the real path — stored, scored, and emailed to your confirmed recipients — and reports the spam verdict, exactly who could be emailed, and where visitors will land. It does not count against your quota.

Accept form submissions