---
title: "Documentation — PageWeave"
---

> For the full documentation index, see [PageWeave Documentation](https://pageweave.dev/docs) or fetch [llms.txt](https://pageweave.dev/llms.txt).

# Forms

Versioned forms with email notifications, webhooks, spam protection, and file uploads. Managed via the `list_forms` / `create_form` / `update_form` MCP tools.

## Creating a Form

`create_form` takes a `fields` array plus `notification_email` (setting or changing it triggers a verification email — notifications activate once the owner clicks the link).

Field types: `text`, `email`, `textarea`, `select`, `checkbox`, `radio`, `number`, `url`, `tel`, `search`, `range`, `color`, `date`, `datetime-local`, `time`, `month`, `week`, `hidden`, `file`.

## File Fields

`file` fields accept visitor uploads:

- `multiple: true` — allow several files
- `accept` — allowed extensions, e.g. `["pdf", "png", "jpg"]`
- `max_size_mb` — per-file cap, 1–25 MB
- `max_files` — per-field cap, 1–10 (needs `multiple`)

Platform ceilings (identical on free and Pro): **25 MB per file, 10 files per field, 100 MB per request**. Field settings may tighten, never exceed, these ceilings.

Allowed types: images (jpg, jpeg, png, gif, webp, avif), documents (pdf, doc, docx, xls, xlsx, ppt, pptx, txt, csv, rtf). ZIP archives and SVG are deliberately rejected — uploads are judged by sniffed content, not by extension, so a renamed file gets no free pass.

## Submission Flow

Public forms POST multipart to the form's `submit_url` (`/f/<id>`). Any plain input name works — the renderer rewrites file inputs to bracketed names at serve time and multiple files accumulate. Requests over 100 MB are rejected with 413 before parsing.

Every submission passes spam protection (honeypot + ALTCHA proof-of-work, three escalating tiers — see [Security](/docs/security)). Discarded spam never persists files; quarantined submissions keep theirs for owner review.

## Delivery

- **Email** — the notification carries download links, never attachments. Links are permanent capability URLs (unguessable, no expiry) and stop working when the submission is deleted. A submission with files from more than one file field groups them under field-name headings.
- **Webhook** — `form.submission.created` payloads include a `files` array with `field`, `filename`, `size` (bytes), `content_type`, `checksum_md5` (hex), and `url` per file. Every dispatch also carries a `spam` block (`verdict`, `score`, `signals`). Test deliveries mirror the real schema, including a `files` sample.
- **Dashboard** — the form's inbox lists submissions with inline download links; the spam tab holds quarantined submissions with their files.