# Forms Tools

Source: [Forms Tools](https://typeroll.com/docs/tools/forms/)

> Server-backed contact, booking and multi-step forms — HMAC-protected, rate-limited, honeypot-guarded.

See [tr-forms](https://typeroll.com/docs/skills/tr-forms/) for the full recipe.

## How a form is stored

[Section titled “How a form is stored”](https://typeroll.com/docs/tools/forms/#how-a-form-is-stored)

A form is a list of **steps**. Each step is a group of field blocks shown together, so a one-page contact form is simply a form with a single step, and a multi-step funnel is the same structure with more of them.

You rarely need to think about that. Ask for the form you want and the AI agent builds the right shape:

```plaintext
Create a contact form with name, email, phone (optional) and message.
Recipient: hej@acme.se
```

```plaintext
Build a three-step quote request: first the property type,
then square metres and timeframe, then contact details.
```

Multi-step forms save partial answers as the visitor advances, so a drop-off after step one still tells you something.

## `create_form`

[Section titled “create\_form”](https://typeroll.com/docs/tools/forms/#create_form)

Creates a form. Give it fields and a recipient email, and the AI agent wraps them in a single step for you. For a funnel, describe the steps and it builds them out.

## `read_form`

[Section titled “read\_form”](https://typeroll.com/docs/tools/forms/#read_form)

Returns the form definition and a fresh `submit_token` (HMAC-signed, 24h TTL). The AI agent fetches this when embedding the form on a page.

## `update_form`

[Section titled “update\_form”](https://typeroll.com/docs/tools/forms/#update_form)

Updates the definition — add or remove fields, reorder steps, change the success message or recipient.

## `list_forms`

[Section titled “list\_forms”](https://typeroll.com/docs/tools/forms/#list_forms)

Returns all forms defined for this site.

## `delete_form`

[Section titled “delete\_form”](https://typeroll.com/docs/tools/forms/#delete_form)

Deletes a form. Any embed referencing it stops accepting submissions.

## Submissions

[Section titled “Submissions”](https://typeroll.com/docs/tools/forms/#submissions)

`list_form_submissions` reads what visitors sent; `delete_form_submission` removes a single entry (useful for clearing spam or a test submission).

## Email notifications

[Section titled “Email notifications”](https://typeroll.com/docs/tools/forms/#email-notifications)

A form can email you on every submission. Connect a provider (Postmark or plain SMTP) per site under **Settings → Email** in the portal. Credentials are encrypted at rest and deliberately kept off the agent surface — the AI agent can author the form and its email action, but cannot read or set your provider credentials.

## Rendering

[Section titled “Rendering”](https://typeroll.com/docs/tools/forms/#rendering)

Forms render through the `core/form` block: styled inputs, client-side validation, and the submit token wired in. You don’t hand-write form HTML.

## Protection

[Section titled “Protection”](https://typeroll.com/docs/tools/forms/#protection)

Every submission passes three checks before it’s accepted:

* **HMAC token** — signed when the form is saved, so only your own forms can post
* **Honeypot field** — invisible to humans, filled in by naive bots
* **Rate limit** — per IP, to blunt floods

## Token expiry

[Section titled “Token expiry”](https://typeroll.com/docs/tools/forms/#token-expiry)

The `submit_token` embedded in the form HTML expires after 24 hours. For forms on long-cached static pages, the AI agent can fetch a fresh token and redeploy. On the hosted plan, token refresh is automatic.