Forms

Every form in the account that is not archived, with submission_count and last_submission_at. Returned in one page — the collection is small and is not cursored. Each row carries slug, which is the key the public endpoints are addressed by (/_q/f/{slug}), and allowed_origins: when that list is non-empty the form accepts submissions ONLY from those exact origins, so an integration rendering the form should check its own site origin against it and warn rather than fail silently at submit time.

One form, including its full fields array of contact and consent bindings. This is the definition the embed is generated from; the public, unauthenticated GET /_q/f/{slug}/config returns the subset a browser needs and is what forms.js reads at render time.

The generated <form> markup plus the forms.js script tag, rendered from the form's current bindings — the same generator the app's snippet modal uses. tracking_domain is the host chosen for the script tag, picked against the form's allowed_origins; it is null when the account has no live tracking host, in which case the script tag is emitted relative and the caller should treat the snippet as not yet installable. The markup can also be inserted after page load, for example in a popup or an AJAX-loaded section, or cloned: forms.js initializes forms added later on its own, and window.RadarSendForms.scan(root) initializes one explicitly.