> ## Documentation Index
> Fetch the complete documentation index at: https://docs.fetchski-attract.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Submit a form for review

> Submits the draft for review by someone who may publish it.

```php Laravel wrap theme={"dark"}
use Fetchski\AttractCmsLaravel\Facades\Attract;

$draftSubmission = Attract::forms()->submitForm(id: 'clx8m2k4p0000a1b2c3d4e5f6');
```

```json 200 wrap theme={"dark"}
{
  "by": "Example by",
  "byId": "clx8m2k4p0000a1b2c3d4e5f6",
  "at": "2026-10-24T09:30:00.000Z"
}
```

## In your app

A controller answers a route on your app: it calls `submitForm()` and returns the answer.

**1. Add the controller**

```php app/Http/Controllers/SubmitFormController.php theme={"dark"}
<?php

declare(strict_types=1);

namespace App\Http\Controllers;

use Fetchski\AttractCmsLaravel\Data\DraftSubmission;
use Fetchski\AttractCmsLaravel\Facades\Attract;

final class SubmitFormController
{
    public function __invoke(string $id): DraftSubmission
    {
        return Attract::forms()->submitForm(id: $id);
    }
}
```

**2. Add the route**

```php routes/web.php theme={"dark"}
use App\Http\Controllers\SubmitFormController;
use Illuminate\Support\Facades\Route;

Route::post('/form/{id}/submit', SubmitFormController::class)->middleware('auth');
```

It acts with your key’s access, so `auth` lets only your signed-in users reach it.

**3. Call it**

Your own page’s form or script sends `POST /form/clx8m2k4p0000a1b2c3d4e5f6/submit` (a form adds `@csrf`, as every web route checks it), and gets back its answer as JSON. Test it, below, calls it.

> [!TIP]
>
> To keep the call in an Action instead, this writes `app/Actions/Attract/SubmitForm.php` (an invokable Action that calls `submitForm()`) and its test under `tests/Feature/Actions/Attract/` (Pest when your app has it):
>
> ```bash Terminal theme={"dark"}
> php artisan make:attract-action forms.submitForm
> ```

## Call it from the terminal

```bash Terminal theme={"dark"}
php artisan attract:call forms.submitForm id=clx8m2k4p0000a1b2c3d4e5f6
```

It calls `submitForm()` on your default site and prints its answer as JSON. It writes, so it asks first: add `--force` to skip the question in a script. See [Call any method from the terminal](https://docs.fetchski-attract.com/call-command.md) for every argument type.

## Find the id

`id` is the document’s `_id`, from a list. Ask the list for only the fields you need: each row is a document’s `id` and those fields.

```php Laravel wrap theme={"dark"}
use Fetchski\AttractCmsLaravel\Facades\Attract;

$row = Attract::forms()->listFormsPick(fields: ['title', 'slug'])->firstWhere('slug', 'getting-started'); // ['id' => …, 'title' => …, 'slug' => …], or null
```

```bash Terminal theme={"dark"}
php artisan attract:call forms.listFormsPick fields=title,slug
```

Pass `$row['id']` as `id`. Drafts: list with `aposMode: 'draft'` to get the draft’s id ([Find an id](https://docs.fetchski-attract.com/find-an-id.md)).

> [accordion] Required parameters
>
> Named arguments, e.g. `submitForm(id: …)`; leave out the optional ones.
>
> **id** `string` *required*
>
> **Required.** The document’s `_id`: a full id names its own locale and mode (the draft’s `…:en:draft`, the published one’s `…:en:published`; no `aposMode` needed), a bare `aposDocId` takes the request’s (`aposLocale`, `aposMode`).

> [accordion] Returns
>
> A `DraftSubmission` (`Fetchski\AttractCmsLaravel\Data\DraftSubmission`). Who submitted the draft for review, and when. Read its properties (`$draftSubmission->byId`): each says whether the site always sends it.
>
> **byId** `string`
>
> **Always sent.** The submitter’s user `_id`.
>
> **at** `CarbonImmutable`
>
> **Always sent.** Format: an ISO 8601 date and time.
>
> **by** `?string`
>
> **Sometimes sent:** `null` when the site leaves it out. The submitter’s name.

> [accordion] Errors
>
> Nothing to catch: the SDK retries what is safe, and Laravel logs and renders the rest (see [Errors and testing](https://docs.fetchski-attract.com/laravel/errors.md)).
>
> **ValidationFailed** `400`
>
> The site refused what was sent: `errors()` lists each field’s problem, `siteMessage()` the first.
>
> **Retried first:** No. **Read:** `errors()` (field → messages), `siteMessage()`.
>
> **AuthenticationFailed** `401`
>
> The API key is missing or refused (malformed, revoked, expired), or a signature its signing mode needs is missing or stale.
>
> **Retried first:** No. **Read:** `siteMessage()`, `errorName()`, `data()`.
>
> **Forbidden** `403`
>
> The key may not do this: a scope it lacks, or an address outside its allowlist. `siteMessage()` names it.
>
> **Retried first:** No. **Read:** `siteMessage()`, `errorName()`, `data()`.
>
> **NotFound** `404`
>
> Nothing matches, or the caller may not see it.
>
> **Retried first:** No. **Read:** `siteMessage()`, `errorName()`, `data()`.
>
> **SiteError** `500`
>
> The site failed. Its logs say why.
>
> **Retried first:** No: a write may have landed. **Read:** `siteMessage()`, `errorName()`, `data()`.
>
> **SiteUnreachable** `no answer`
>
> No answer: DNS, a refused connection, TLS, or the timeout (15 s per attempt by default).
>
> **Retried first:** Only when nothing reached the site (`neverConnected()`); never after a timeout, when it may have landed. **Read:** `reason()`, `neverConnected()`.
>
> **RequestNotSent** `not sent`
>
> The client refused to send it (e.g. a path segment of `..`); the site never saw it.
>
> **Retried first:** No. **Read:** `reason()` (what to change).
>
> **SiteRequestFailed** `any other`
>
> Any other status, or a success whose JSON doesn’t match this SDK version’s types (update the SDK).
>
> **Retried first:** No. **Read:** `reason()`, `status()`.
>
> **UnknownSite** `setup`
>
> `Attract::site('acme')` named a slug that isn’t under `sites` in `config/fetchski-attract.php`.
>
> **Retried first:** No: nothing was sent. **Read:** `getMessage()`, `$e->slug`.
>
> **SiteConfigurationError** `setup`
>
> The site’s config entry is wrong: no `url`, a malformed `api_key`, a key filed under another slug, or no default site.
>
> **Retried first:** No: nothing was sent. **Read:** `getMessage()` (what to fix).

## Behavior

* **Access:** an API key with `content:forms:write` (or a master above it: `content:forms:all`, `content:all`, `admin:all`). A signed-in person may call it as far as their own permissions allow; anyone else gets 403.
* **Rate limit:** the key’s own writes-per-minute limit, set when the key is created (default 120); over it, 429 with `Retry-After`. The client waits and retries for you; you see `RateLimited` only if that runs out.
* **Retries:** a write is sent again only after a 429 (refused before it acted) or when it never reached the site. After a timeout or a 5xx it may have landed: check before you send it again.
* **Timeout:** 15 s per attempt by default; raise `timeout` in `config/fetchski-attract.php` for longer.

## Test it

It calls the route above with the SDK faked: the fake answers every call with a valid example, so nothing leaves your machine and no config or key is needed. Save it as `tests/Feature/SubmitFormTest.php`, then run your tests:

```php tests/Feature/SubmitFormTest.php theme={"dark"}
<?php

declare(strict_types=1);

namespace Tests\Feature;

use App\Models\User;
use Fetchski\AttractCmsLaravel\Facades\Attract;
use Illuminate\Foundation\Testing\RefreshDatabase;
use Tests\TestCase;

final class SubmitFormTest extends TestCase
{
    use RefreshDatabase;

    public function test_submit_form(): void
    {
        Attract::fake();

        $this->actingAs(User::factory()->create())
            ->postJson('/form/clx8m2k4p0000a1b2c3d4e5f6/submit')
            ->assertOk();

        Attract::assertCalled('forms.submitForm', fn (array $args): bool => $args['id'] === 'clx8m2k4p0000a1b2c3d4e5f6');
    }
}
```

```bash Terminal theme={"dark"}
php artisan test
```

**Answer with your own values:** fake `forms.submitForm` with `DraftSubmission::factory()->make([...])`, the fields you give over a valid example.

```php tests/Feature/SubmitFormAnswerTest.php theme={"dark"}
<?php

declare(strict_types=1);

namespace Tests\Feature;

use Fetchski\AttractCmsLaravel\Data\DraftSubmission;
use Fetchski\AttractCmsLaravel\Facades\Attract;
use Tests\TestCase;

final class SubmitFormAnswerTest extends TestCase
{
    public function test_submit_form_answers_your_values(): void
    {
        Attract::fake([
            'forms.submitForm' => DraftSubmission::factory()->make(['byId' => 'Your value']),
        ]);

        $draftSubmission = Attract::forms()->submitForm(id: 'clx8m2k4p0000a1b2c3d4e5f6');

        $this->assertSame('Your value', $draftSubmission->byId);
    }
}
```

## Related

> [card] [List a form’s locales](https://docs.fetchski-attract.com/laravel/reference/forms/get-form-locales.md)
>
> `Attract::forms()->getFormLocales()`

> [card] [List forms](https://docs.fetchski-attract.com/laravel/reference/forms/list-forms.md)
>
> `Attract::forms()->listForms()`

> [card] [Create a form](https://docs.fetchski-attract.com/laravel/reference/forms/create-form.md)
>
> `Attract::forms()->createForm()`

> [card] [Get a form](https://docs.fetchski-attract.com/laravel/reference/forms/get-form.md)
>
> `Attract::forms()->getForm()`

> [card] [Replace a form](https://docs.fetchski-attract.com/laravel/reference/forms/replace-form.md)
>
> `Attract::forms()->replaceForm()`

> [card] [Delete a form](https://docs.fetchski-attract.com/laravel/reference/forms/delete-form.md)
>
> `Attract::forms()->deleteForm()`

> [card] [POST /@apostrophecms/form/\{\_id}/submit](https://docs.fetchski-attract.com/api-reference/forms/submit-a-form-for-review.md)
>
> The endpoint this calls, in the API reference: the HTTP request and answer, and every rule the site checks.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.