ClientCasa
API

Form Attachments

Fetch a file a visitor attached to a form answer. A form submission's fileUpload answers carry the attachment id, filename, MIME type and size; this endpoint turns that id into a short-lived direct download link. Same scope as submissions — form-submissions:read.

A form attachment is a file someone attached to a form submission through a fileUpload question — a floor plan, an inspiration photo, a signed PDF. The submission's answers[].attachments array carries each file's id, filename, mimeType and filesize; this endpoint turns an id into the bytes.

The response is a short-lived direct download link, not the file itself. Fetch downloadUrl promptly and stream it wherever it belongs — it expires at expiresAt (15 minutes), and it is not an identifier: do not store it, cache it, or hand it to a user. If you need the file again later, request the attachment again and you get a fresh link.

The scope is form-submissions:read, the same scope that lists the submission the file belongs to — an attachment exists only as the answer to a form question, so a token that may read the submission may read its files.

The link always downloads rather than rendering in the browser. These bytes were uploaded by an anonymous visitor through a public form, so we never serve them as inline, renderable content.

An attachment id that belongs to another organization — or to nothing — answers 404 not_found, the same as any other resource: the API never confirms that a record you cannot read exists.

GET
/api/v1/form-attachments/{id}

Authorization

x-api-key<token>

In: header

Path Parameters

id*string

UUID v4

Formatuuid

Response Body

application/json

application/json

application/json

application/json

application/json

application/json

curl -X GET "https://www.clientcasa.com/api/v1/form-attachments/550e8400-e29b-41d4-a716-446655440000"
{
  "id": "550e8400-e29b-41d4-a716-446655440000",
  "filename": "string",
  "mimeType": "string",
  "filesize": 0,
  "downloadUrl": "http://example.com",
  "expiresAt": "2019-08-24T14:15:22Z"
}
{
  "error": {
    "code": "unauthorized",
    "message": "string",
    "requestId": "string",
    "details": {
      "code": "archived_record_read_only",
      "property1": null,
      "property2": null
    }
  }
}
{
  "error": {
    "code": "unauthorized",
    "message": "string",
    "requestId": "string",
    "details": {
      "code": "archived_record_read_only",
      "property1": null,
      "property2": null
    }
  }
}
{
  "error": {
    "code": "unauthorized",
    "message": "string",
    "requestId": "string",
    "details": {
      "code": "archived_record_read_only",
      "property1": null,
      "property2": null
    }
  }
}
{
  "error": {
    "code": "unauthorized",
    "message": "string",
    "requestId": "string",
    "details": {
      "code": "archived_record_read_only",
      "property1": null,
      "property2": null
    }
  }
}
{
  "error": {
    "code": "unauthorized",
    "message": "string",
    "requestId": "string",
    "details": {
      "code": "archived_record_read_only",
      "property1": null,
      "property2": null
    }
  }
}

Form Submissions

Read completed form submissions. One row is one submission — it carries the form, kind, contact, status, and submittedAt. The normalized answers come back on a single GET; the list omits them. Submissions are created by the public forms, so the v1 API is read-only — ideal for syncing new leads and their answers into another system.

Inquiries (Lead Capture)

Submit a lead from your own website into a ClientCasa organization. A named-field endpoint — no form-field ids — that creates the lead, seeds the inbox, and sends the owner alert and visitor confirmation, exactly like a hosted ClientCasa form. The one write endpoint in the lead-capture flow; read the results back via Form Submissions.