> ## Documentation Index > Fetch the complete documentation index at: https://docs.meshqu.com/llms.txt > Use this file to discover all available pages before exploring further. # Create form > Creates a new attested manual check form derived from a policy. ## OpenAPI ````yaml /api/openapi.json post /v1/forms openapi: 3.1.0 info: title: MeshQu API description: >- Governance infrastructure for policy-aware AI decisions. MeshQu does not run tools. It governs decisions about them. version: 1.9.0 contact: name: MeshQu Support email: support@meshqu.com license: name: Proprietary servers: - url: https://api.meshqu.com description: Deployed environment security: - apiKey: [] tenantId: [] tags: - name: Operations description: Health, readiness, metrics, and signing keys - name: Policies description: Policy management - name: Policy Groups description: Policy group management - name: Decisions description: Policy evaluation and recording - name: Chains description: Decision chain verification and sealing - name: Receipts description: Public receipt and bundle retrieval - name: Forms description: Attestation forms and public submission - name: Alerts description: Alert management and webhooks - name: Audit description: Audit log retrieval and verification - name: API Keys description: API key administration - name: Admin description: Tenant and platform administration - name: Dashboard description: Console dashboard data - name: Metrics description: Decision and overview metrics - name: Fields description: Field catalogue - name: Settings description: Tenant settings - name: Rule Creation Logs description: Rule authoring telemetry paths: /v1/forms: post: tags: - Forms summary: Create form description: Creates a new attested manual check form derived from a policy. operationId: postV1Forms requestBody: required: true content: application/json: schema: type: object properties: policy_id: format: uuid description: Policy to derive the form from type: string policy_version: description: Specific policy version (null = always latest) anyOf: - minimum: 1 type: integer - type: 'null' scope: default: policy description: >- Evaluation scope: policy = linked policy only, decision_type = all policies for the decision type anyOf: - type: string enum: - policy - type: string enum: - decision_type access_mode: default: open description: Access control mode anyOf: - type: string enum: - open - type: string enum: - token - type: string enum: - password - type: string enum: - console password: minLength: 8 maxLength: 128 description: Password for password mode (will be hashed) type: string token_expires_at: format: date-time description: >- ISO 8601 expiry for token-mode access (defaults to 7 days from creation) type: string token_max_uses: minimum: 1 description: Maximum number of submissions allowed via token type: integer branding: type: object properties: label: maxLength: 200 type: string description: maxLength: 2000 type: string logo_url: format: uri maxLength: 500 type: string identifier_config: type: object properties: label: minLength: 1 maxLength: 200 type: string placeholder: maxLength: 200 type: string helper_text: maxLength: 500 type: string required: - label is_published: default: false type: boolean required: - policy_id responses: '201': description: Default Response content: application/json: schema: type: object properties: form_id: format: uuid type: string tenant_id: format: uuid type: string policy_id: format: uuid type: string policy_version: anyOf: - type: integer - type: 'null' is_frozen: type: boolean scope: type: string access_mode: type: string branding: anyOf: - type: object properties: label: maxLength: 200 type: string description: maxLength: 2000 type: string logo_url: format: uri maxLength: 500 type: string - type: 'null' identifier_config: anyOf: - type: object properties: label: minLength: 1 maxLength: 200 type: string placeholder: maxLength: 200 type: string helper_text: maxLength: 500 type: string required: - label - type: 'null' is_published: type: boolean token_expires_at: anyOf: - type: string - type: 'null' token_max_uses: anyOf: - type: integer - type: 'null' token_use_count: type: integer token_secret: description: >- Token secret — only returned on create/regenerate (one-time reveal) type: string created_at: type: string updated_at: type: string required: - form_id - tenant_id - policy_id - policy_version - is_frozen - scope - access_mode - branding - identifier_config - is_published - token_expires_at - token_max_uses - token_use_count - created_at - updated_at '400': description: Default Response content: application/json: schema: type: object properties: error: type: object properties: code: description: Error code type: string message: description: Human-readable message type: string details: description: Additional error details required: - code - message correlation_id: description: Request correlation ID type: string required: - error '404': description: Default Response content: application/json: schema: type: object properties: error: type: object properties: code: description: Error code type: string message: description: Human-readable message type: string details: description: Additional error details required: - code - message correlation_id: description: Request correlation ID type: string required: - error components: securitySchemes: apiKey: type: http scheme: bearer bearerFormat: mqu_ description: >- MeshQu API key passed as a bearer token: `Authorization: Bearer mqu_…`. Mint one in the console (Settings → API keys). tenantId: type: apiKey name: X-MeshQu-Tenant-Id in: header description: >- Tenant UUID for multi-tenant isolation. Required on all authenticated routes — validated before authentication (middleware/tenant.ts), so a missing or non-UUID header returns 400 (MISSING_TENANT_ID / INVALID_TENANT_ID) before the API key is checked. ````