Export a form’s submissions as CSV

import app from '@adonisjs/core/services/app'
import { SiteClient } from '@fetchski/attract-cms-sdk'

const site = await app.container.make(SiteClient)
const formSubmissionExport = await site.formSubmissions().exportFormSubmissions({ formId: 'clx8m2k4p0000a1b2c3d4e5f6' })

{
  "filename": "Acme_Contact_Submissions_2026-10-01.csv",
  "csv": "Example csv",
  "rows": 1,
  "total": 1,
  "truncated": true
}

In your app

A controller answers a route on your app: it calls exportFormSubmissions() and returns the answer.

Add the controller

app/controllers/export_form_submissions_controller.ts

import { inject } from '@adonisjs/core'
import { SiteClient } from '@fetchski/attract-cms-sdk'

@inject()
export default class ExportFormSubmissionsController {
  constructor(protected site: SiteClient) {}

  async handle() {
    return this.site.formSubmissions().exportFormSubmissions({ formId: 'clx8m2k4p0000a1b2c3d4e5f6' })
  }
}

The other values are the example’s: take yours from the request, a form or your database.

Add the route

start/routes.ts

import router from '@adonisjs/core/services/router'

const ExportFormSubmissionsController = () => import('#controllers/export_form_submissions_controller')

router.get('/form-submission/export', [ExportFormSubmissionsController])

Call it

Terminal

curl http://localhost:3333/form-submission/export

With node ace serve running, it prints its answer as JSON.

A signed-in user also needs the form-submissions:export permission: one holding only form-submissions:view gets 403 (data.permission names it).

Required parameters

One object, e.g. exportFormSubmissions({ formId }); leave out the optional fields.

string

required

Required. The form: its document ID, in either form (<aposDocId> or <aposDocId>:<locale>:<mode>), from the forms list.

Returns

A FormSubmissionExport. The CSV. Read its properties (formSubmissionExport.filename): each says whether the site always sends it.

string

Always sent.

string

Always sent. The CSV (UTF-8 with a byte-order mark, CRLF lines): Submitted, Visitor ID (only when a row has one), then every field. A cell starting =, +, -, @ or a tab is prefixed with ' so a spreadsheet never runs it.

number

Always sent. Rows in csv.

number

Always sent. Submissions the form has.

boolean

Always sent. True when rows < total: the newest 10,000 only.

Errors

Nothing to catch: the SDK retries what is safe, and throws the rest as the classes below. Your exception handler turns them into your app’s own answers, once for every call (see Map SDK errors to responses); catch only what you want to react to here.

400

The request is not valid; the message says which part and how to fix it.Retried first: No. Read: errors (field → messages), siteMessage.

401

The API key is missing, malformed, unknown, disabled, expired or archived, or a request its signing mode requires to be signed is not.Retried first: No. Read: siteMessage, errorName, data.

403

The API key lacks the scope this route needs (the message names it) or is used from outside its allowlist; or, on a route that answers 403 to everyone it refuses, the caller may not use it.Retried first: No. Read: siteMessage, errorName, data.

404

Nothing matches the identifier, or the caller may not use this route at all (it is not advertised).Retried first: No. Read: siteMessage, errorName, data.

429

The key used up its per-minute limit. Still, after the client’s own waits and retries.Retried first: Yes: the client waits Retry-After (1 s when absent; over 60 s it gives up at once) and retries, up to retries times (2 by default). Read: retryAfter (seconds, or null), siteMessage.

5xx

The site failed (or something in front of it did). Its logs say why.Retried first: A 502, 503 or 504: yes, after 0.5 s then 1 s. A 500: no. Read: siteMessage, errorName, data.

no answer

No answer: DNS, a refused connection, TLS, or the timeout (15 s per attempt by default).Retried first: Yes, after 0.5 s then 1 s. Read: reason, neverConnected.

not sent

The client refused to send it (e.g. a path segment of ..); the site never saw it.Retried first: No. Read: reason (what to change).

any other

Any other status, or a success whose JSON doesn’t match this SDK version’s types (update the SDK).Retried first: No. Read: reason, status.

setup

sites.forSite('acme') named a slug config/attract.ts doesn’t list (with the keys in the database: no row in attract_api_keys).Retried first: No: nothing was sent. Read: message, slug.

setup

The site’s entry is wrong: a malformed baseUrl or key, a key filed under another slug, or no default site. node ace attract:check names the fix.Retried first: No: nothing was sent. Read: message (what to fix).

Behavior

Access: an API key with forms:read, or forms:all, or admin:all, or a signed-in user holding the form-submissions:view permission. Other callers get 404.
Rate limit: the key’s own reads-per-minute limit, set when the key is created (default 600); over it, 429 with Retry-After. The client waits and retries for you; you see RateLimited only if that runs out.
Retries: a read is safe to repeat: the client retries it on no answer, a 502/503/504 and a 429.
Timeout: 15 s per attempt by default; raise timeout (milliseconds) in config/attract.ts for longer.

Test it

It calls the controller above with the SDK faked: fakeAttract() puts the fake in the container for this one test, and it answers every call with a valid example, so nothing leaves your machine and no key is read. Save it as tests/unit/form_submissions_export_form_submissions.spec.ts, then run your tests:

tests/unit/form_submissions_export_form_submissions.spec.ts

import { test } from '@japa/runner'
import app from '@adonisjs/core/services/app'
import { fakeAttract } from '@fetchski/attract-cms-adonis/testing'
import ExportFormSubmissionsController from '#controllers/export_form_submissions_controller'

test('formSubmissions.exportFormSubmissions', async () => {
  const site = fakeAttract()

  const controller = await app.container.make(ExportFormSubmissionsController)
  await controller.handle()

  site.assertCalled('formSubmissions.exportFormSubmissions')
})

Terminal

node ace test

Answer with your own values: fake formSubmissions.exportFormSubmissions with factories.FormSubmissionExport({...}), the fields you give over a valid example.

tests/unit/form_submissions_export_form_submissions_answers.spec.ts

import { test } from '@japa/runner'
import { factories, fakeAttract } from '@fetchski/attract-cms-adonis/testing'

test('formSubmissions.exportFormSubmissions answers your values', async ({ assert }) => {
  const site = fakeAttract({
    'formSubmissions.exportFormSubmissions': factories.FormSubmissionExport({ filename: 'Your value' }),
  })

  const formSubmissionExport = await site.formSubmissions().exportFormSubmissions({ formId: 'clx8m2k4p0000a1b2c3d4e5f6' })
  assert.containSubset(formSubmissionExport, { filename: 'Your value' })
})

List forms and their submission counts

site.formSubmissions().listSubmissionForms()

List a form’s submissions

site.formSubmissions().listFormSubmissions()

GET /form-submission/export

The endpoint this calls, in the API reference: the HTTP request and answer, and every rule the site checks.

Get started

Using the SDK

Going further

Pages & Site

Content

Media

Forms

Ads & Conversions

Analytics

Export a form’s submissions as CSV

In your app

Behavior

Test it

List forms and their submission counts

List a form’s submissions

GET /form-submission/export

In your app

Behavior

Test it

Related

List forms and their submission counts

List a form’s submissions

GET /form-submission/export