Skip to main content
POST
Create form

Authorizations

Authorization
string
header
required

MeshQu API key passed as a bearer token: Authorization: Bearer mqu_…. Mint one in the console (Settings → API keys).

X-MeshQu-Tenant-Id
string
header
required

Tenant UUID for multi-tenant isolation. Required on all authenticated routes — validated before authentication (middleware/tenant.ts), so a missing or non-UUID header returns 400 (MISSING_TENANT_ID / INVALID_TENANT_ID) before the API key is checked.

Body

application/json
policy_id
string<uuid>
required

Policy to derive the form from

policy_version
integer | null

Specific policy version (null = always latest)

Required range: x >= 1
scope
default:policy

Evaluation scope: policy = linked policy only, decision_type = all policies for the decision type

Available options:
policy
access_mode
default:open

Access control mode

Available options:
open
password
string

Password for password mode (will be hashed)

Required string length: 8 - 128
token_expires_at
string<date-time>

ISO 8601 expiry for token-mode access (defaults to 7 days from creation)

token_max_uses
integer

Maximum number of submissions allowed via token

Required range: x >= 1
branding
object
identifier_config
object
is_published
boolean
default:false

Response

Default Response

form_id
string<uuid>
required
tenant_id
string<uuid>
required
policy_id
string<uuid>
required
policy_version
integer | null
required
is_frozen
boolean
required
scope
string
required
access_mode
string
required
branding
object | null
required
identifier_config
object | null
required
is_published
boolean
required
token_expires_at
string | null
required
token_max_uses
integer | null
required
token_use_count
integer
required
created_at
string
required
updated_at
string
required
token_secret
string

Token secret — only returned on create/regenerate (one-time reveal)