BarakoCMS.Forms
4.2.0
dotnet add package BarakoCMS.Forms --version 4.2.0
NuGet\Install-Package BarakoCMS.Forms -Version 4.2.0
<PackageReference Include="BarakoCMS.Forms" Version="4.2.0" />
<PackageVersion Include="BarakoCMS.Forms" Version="4.2.0" />
<PackageReference Include="BarakoCMS.Forms" />
paket add BarakoCMS.Forms --version 4.2.0
#r "nuget: BarakoCMS.Forms, 4.2.0"
#:package BarakoCMS.Forms@4.2.0
#addin nuget:?package=BarakoCMS.Forms&version=4.2.0
#tool nuget:?package=BarakoCMS.Forms&version=4.2.0
BarakoCMS.Forms
Lets a public visitor submit a form. The form is a content type: its fields, types and required flags are the form, and a submission is an ordinary entry of that type. A widget reads the form definition and draws the inputs, and a workflow on Created for the type sends the notification.
Install
dotnet add package BarakoCMS.Forms
builder.Services.AddBarakoCMS(builder.Configuration);
var app = builder.Build();
app.UseBarakoCMS();
The package reference plus a restart is the install. BarakoCMS:Modules:Enabled decides which
modules run (BarakoCMS__Modules__Enabled=Forms). To name it by hand, put
modules.Add(new BarakoCMS.Forms.FormsModule()) in the AddBarakoCMS callback. See MODULES.md
in the repository.
Making a content type a form
Create the type as usual, then mark it:
PUT /api/forms/contact-request
Authorization: Bearer <token with manage_forms>
{ "enabled": true }
{ "enabled": false } turns it off again. GET /api/forms lists the types that accept
submissions. Admin is granted manage_forms when the module seeds.
A visitor can fill in a field only when it is Public and its type is one of string, text,
int, decimal, money, bool, date, datetime, time, email or url (and their aliases).
A field named slug is never submittable. Enabling a type is refused with 400 when a required field
is not submittable, or when the type is a singleton.
Endpoints
| Method | Route | Who | Purpose |
|---|---|---|---|
| GET | /api/public/forms/{slug} |
anyone | the fields a widget draws |
| POST | /api/public/forms/{slug} |
anyone, rate limited | submit |
| PUT | /api/forms/{contentType} |
manage_forms |
mark a type as a form, or unmark it |
| GET | /api/forms |
manage_forms |
list forms, paged |
The slug is the content type name. A type that is not marked as a form answers 404 on both public routes.
Submit
{
"data": { "name": "Ana", "email": "ana@example.com", "message": "Hello" },
"honeypot": "",
"turnstileToken": null
}
- 202
{ "accepted": true }. The entry is stored as Draft, document sensitivity Sensitive, with no owner, so the delivery API never serves it. Nothing in the request can change those three. - 400 ProblemDetails. A field failure is named
data.<field>; an unknown or non-submittable field is refused with the same message either way. A failed Turnstile check is namedturnstileToken. - 404 the slug is not a form.
- 429 too many submissions from this client IP.
A non-empty honeypot gets the same 202 and nothing is stored.
Definition
{
"slug": "contact-request",
"displayName": "Contact request",
"description": "",
"fields": [
{ "name": "email", "displayName": "Email", "type": "email", "required": true, "validationRules": {} }
]
}
Configuration
Section Modules:Forms:
| Key | Default | Meaning |
|---|---|---|
PermitLimit |
5 |
submissions per client IP per window, across every form |
WindowSeconds |
600 |
the window |
MaxFieldLength |
10000 |
the longest string a field may hold |
Turnstile:Enabled |
false |
require a Cloudflare Turnstile token |
Turnstile:SecretKey |
none | the Turnstile secret; set it through the environment |
With Turnstile enabled and no secret set, every submission is refused and an error is logged.
Notification
Not this module's job. Add a workflow on Created for the form's content type with an Email
action. The submission is written through IContentWriter like any other entry, so the workflow
fires for it.
If barakoCMS is useful to you, a star on the repository helps other people find it.
| Product | Versions Compatible and additional computed target framework versions. |
|---|---|
| .NET | net10.0 is compatible. net10.0-android was computed. net10.0-browser was computed. net10.0-ios was computed. net10.0-maccatalyst was computed. net10.0-macos was computed. net10.0-tvos was computed. net10.0-windows was computed. |
-
net10.0
- AspNetCore.HealthChecks.Npgsql (>= 9.0.0)
- AspNetCore.HealthChecks.System (>= 9.0.0)
- AspNetCore.HealthChecks.UI (>= 9.0.0)
- AspNetCore.HealthChecks.UI.Client (>= 9.0.0)
- AspNetCore.HealthChecks.UI.InMemory.Storage (>= 9.0.0)
- BarakoCMS (>= 4.2.0)
- BCrypt.Net-Next (>= 4.2.0)
- FastEndpoints (>= 8.3.0)
- FastEndpoints.Security (>= 8.3.0)
- FastEndpoints.Swagger (>= 8.3.0)
- IdentityModel (>= 7.0.0)
- JasperFx (>= 2.56.0)
- KubernetesClient (>= 18.0.13)
- Marten (>= 9.30.0)
- Microsoft.Extensions.DependencyModel (>= 10.0.11)
- Microsoft.Extensions.Http.Resilience (>= 10.9.0)
- Microsoft.IdentityModel.JsonWebTokens (>= 8.22.0)
- Otp.NET (>= 1.4.1)
- prometheus-net.AspNetCore (>= 8.2.1)
- Serilog.AspNetCore (>= 10.0.0)
- Serilog.Sinks.Console (>= 6.1.1)
- Serilog.Sinks.File (>= 7.0.0)
- System.IdentityModel.Tokens.Jwt (>= 8.22.0)
NuGet packages
This package is not used by any NuGet packages.
GitHub repositories
This package is not used by any popular GitHub repositories.
| Version | Downloads | Last Updated |
|---|---|---|
| 4.2.0 | 39 | 9/18/2026 |