Basin

Delete a form webhook via DELETE /api/v1/form_webhooks/{id}. Remove a form webhook permanently. Submissions to its form stop being delivered to that URL from the next submission onwards; already-delivered payloads are unaffected. KEY SCOPE: Basin documents the reach of its two key types by resource (forms and domains under the account key, submissions under either) and says nothing about this resource, and no Agentic Fabriq account exists at a paying tier to measure it. An account-scoped key is documented as reaching everything the account can see, so it is the safe choice; a form-scoped key may answer 403 here. IRREVERSIBLE: Basin publishes no endpoint that restores this record. There is no undo. PLAN GATE: Basin includes API access on the Growth, Pro and Agency plans only -- on a Free or Starter account every Basin action fails, and no Agentic Fabriq setting changes that. A missing or wrong API key answers HTTP 400, not 401 (measured 2026-09-23: no key -> 400 'No API key was provided or no user session exists'; a bogus key -> 400 'Bad API key or user does not exist'). Basin's own troubleshooting page says 401; the measured status is 400, so a 400 carrying either of those bodies is a credential problem and not a malformed request. A 403 has two causes on Basin and they need different fixes: the account's plan does not include API access (upgrade to Growth, Pro or Agency), or a form-scoped API key was used against a resource belonging to another form (reconnect with an account-scoped key). Neither is fixed by re-pasting the same key.

Delete a form via DELETE /api/v1/forms/{id}. Destroy a form. KEY SCOPE: Basin's Authentication guide lists this under the ACCOUNT API key ('CRUD forms', 'Listing domains'). A form-scoped API key is documented as reaching one form only, so this action is expected to fail on one -- connect an account key (Account Settings -> API Settings) for it. Deleting a form takes its endpoint out of service: visitor posts to https://usebasin.com/f/<uuid> stop being accepted, and the submissions collected under it stop being reachable through this integration. Check 'List submissions' for that form first. IRREVERSIBLE: Basin publishes no endpoint that restores this record. There is no undo. PLAN GATE: Basin includes API access on the Growth, Pro and Agency plans only -- on a Free or Starter account every Basin action fails, and no Agentic Fabriq setting changes that. A missing or wrong API key answers HTTP 400, not 401 (measured 2026-09-23: no key -> 400 'No API key was provided or no user session exists'; a bogus key -> 400 'Bad API key or user does not exist'). Basin's own troubleshooting page says 401; the measured status is 400, so a 400 carrying either of those bodies is a credential problem and not a malformed request. A 403 has two causes on Basin and they need different fixes: the account's plan does not include API access (upgrade to Growth, Pro or Agency), or a form-scoped API key was used against a resource belonging to another form (reconnect with an account-scoped key). Neither is fixed by re-pasting the same key.

Delete a mail template via DELETE /api/v1/mail_templates/{id}. Remove a mail template permanently; Basin answers 204 with no body. Forms still pointing at it through notification_mail_template_id, auto_response_mail_template_id or confirmation_mail_template_id should be repointed first. KEY SCOPE: Basin documents the reach of its two key types by resource (forms and domains under the account key, submissions under either) and says nothing about this resource, and no Agentic Fabriq account exists at a paying tier to measure it. An account-scoped key is documented as reaching everything the account can see, so it is the safe choice; a form-scoped key may answer 403 here. IRREVERSIBLE: Basin publishes no endpoint that restores this record. There is no undo. PLAN GATE: Basin includes API access on the Growth, Pro and Agency plans only -- on a Free or Starter account every Basin action fails, and no Agentic Fabriq setting changes that. A missing or wrong API key answers HTTP 400, not 401 (measured 2026-09-23: no key -> 400 'No API key was provided or no user session exists'; a bogus key -> 400 'Bad API key or user does not exist'). Basin's own troubleshooting page says 401; the measured status is 400, so a 400 carrying either of those bodies is a credential problem and not a malformed request. A 403 has two causes on Basin and they need different fixes: the account's plan does not include API access (upgrade to Growth, Pro or Agency), or a form-scoped API key was used against a resource belonging to another form (reconnect with an account-scoped key). Neither is fixed by re-pasting the same key.

Delete a project via DELETE /api/v1/projects/{id}. Destroy a project. A project owns forms and mail templates, so this is the widest-reaching delete in the integration -- list its forms first. KEY SCOPE: Basin documents the reach of its two key types by resource (forms and domains under the account key, submissions under either) and says nothing about this resource, and no Agentic Fabriq account exists at a paying tier to measure it. An account-scoped key is documented as reaching everything the account can see, so it is the safe choice; a form-scoped key may answer 403 here. IRREVERSIBLE: Basin publishes no endpoint that restores this record. There is no undo. PLAN GATE: Basin includes API access on the Growth, Pro and Agency plans only -- on a Free or Starter account every Basin action fails, and no Agentic Fabriq setting changes that. A missing or wrong API key answers HTTP 400, not 401 (measured 2026-09-23: no key -> 400 'No API key was provided or no user session exists'; a bogus key -> 400 'Bad API key or user does not exist'). Basin's own troubleshooting page says 401; the measured status is 400, so a 400 carrying either of those bodies is a credential problem and not a malformed request. A 403 has two causes on Basin and they need different fixes: the account's plan does not include API access (upgrade to Growth, Pro or Agency), or a form-scoped API key was used against a resource belonging to another form (reconnect with an account-scoped key). Neither is fixed by re-pasting the same key.

Delete a submission via DELETE /api/v1/submissions/{id}. Destroy one submission. Basin answers 404 when the submission belongs to another user and 422 when the destroy fails. KEY SCOPE: Basin's Authentication guide lists submissions under BOTH key types -- an account key reaches every form's submissions, a form-scoped key reaches its own form's. With a form key, a submission belonging to another form answers 403 or 404 rather than succeeding quietly. To make this reversible, use 'Update a submission' with trash: true instead: Basin's own submission filter has a 'trash' state, so trashing keeps the record and can be undone, while this action destroys it. Submissions cannot be CREATED through this API -- Basin supports index, show, update and destroy only. A visitor's submission arrives at the unauthenticated public form endpoint POST https://usebasin.com/f/<uuid>, which is not part of this integration. Tags cannot be assigned at submission time either; lead tags and rules are configured in the Basin dashboard. IRREVERSIBLE: Basin publishes no endpoint that restores this record. There is no undo. PLAN GATE: Basin includes API access on the Growth, Pro and Agency plans only -- on a Free or Starter account every Basin action fails, and no Agentic Fabriq setting changes that. A missing or wrong API key answers HTTP 400, not 401 (measured 2026-09-23: no key -> 400 'No API key was provided or no user session exists'; a bogus key -> 400 'Bad API key or user does not exist'). Basin's own troubleshooting page says 401; the measured status is 400, so a 400 carrying either of those bodies is a credential problem and not a malformed request. A 403 has two causes on Basin and they need different fixes: the account's plan does not include API access (upgrade to Growth, Pro or Agency), or a form-scoped API key was used against a resource belonging to another form (reconnect with an account-scoped key). Neither is fixed by re-pasting the same key.

List sending domains via GET /api/v1/domains. List the custom email sending domains available to the connected Basin account, for use as a form's `domain_id`. Read-only: Basin documents no create, update or delete for a domain, and verifying one is done in the dashboard. The optional `query` filter searches by id and name. KEY SCOPE: Basin's Authentication guide lists this under the ACCOUNT API key ('CRUD forms', 'Listing domains'). A form-scoped API key is documented as reaching one form only, so this action is expected to fail on one -- connect an account key (Account Settings -> API Settings) for it. PLAN GATE: Basin includes API access on the Growth, Pro and Agency plans only -- on a Free or Starter account every Basin action fails, and no Agentic Fabriq setting changes that. A missing or wrong API key answers HTTP 400, not 401 (measured 2026-09-23: no key -> 400 'No API key was provided or no user session exists'; a bogus key -> 400 'Bad API key or user does not exist'). Basin's own troubleshooting page says 401; the measured status is 400, so a 400 carrying either of those bodies is a credential problem and not a malformed request. A 403 has two causes on Basin and they need different fixes: the account's plan does not include API access (upgrade to Growth, Pro or Agency), or a form-scoped API key was used against a resource belonging to another form (reconnect with an account-scoped key). Neither is fixed by re-pasting the same key.

List legacy form views via GET /api/v1/form_views. List the account's legacy Form Builder (Form.io) form views. The optional `query` filter searches by id, uuid, form id and form uuid. KEY SCOPE: Basin documents the reach of its two key types by resource (forms and domains under the account key, submissions under either) and says nothing about this resource, and no Agentic Fabriq account exists at a paying tier to measure it. An account-scoped key is documented as reaching everything the account can see, so it is the safe choice; a form-scoped key may answer 403 here. LEGACY, AND NOT FORM STUDIO: Basin's API reference states that /api/v1/form_views exposes read-only records from the legacy Form Builder (Form.io), and that 'a legacy form_view schema is not a Form Studio schema'. There is no public endpoint that returns a Form Studio field schema, and Form Studio fields cannot be created or edited through any API -- those are dashboard-only. PLAN GATE: Basin includes API access on the Growth, Pro and Agency plans only -- on a Free or Starter account every Basin action fails, and no Agentic Fabriq setting changes that. A missing or wrong API key answers HTTP 400, not 401 (measured 2026-09-23: no key -> 400 'No API key was provided or no user session exists'; a bogus key -> 400 'Bad API key or user does not exist'). Basin's own troubleshooting page says 401; the measured status is 400, so a 400 carrying either of those bodies is a credential problem and not a malformed request. A 403 has two causes on Basin and they need different fixes: the account's plan does not include API access (upgrade to Growth, Pro or Agency), or a form-scoped API key was used against a resource belonging to another form (reconnect with an account-scoped key). Neither is fixed by re-pasting the same key.

Get a legacy form view via GET /api/v1/form_views/{id}. Retrieve one legacy Form Builder (Form.io) form view by its id. KEY SCOPE: Basin documents the reach of its two key types by resource (forms and domains under the account key, submissions under either) and says nothing about this resource, and no Agentic Fabriq account exists at a paying tier to measure it. An account-scoped key is documented as reaching everything the account can see, so it is the safe choice; a form-scoped key may answer 403 here. LEGACY, AND NOT FORM STUDIO: Basin's API reference states that /api/v1/form_views exposes read-only records from the legacy Form Builder (Form.io), and that 'a legacy form_view schema is not a Form Studio schema'. There is no public endpoint that returns a Form Studio field schema, and Form Studio fields cannot be created or edited through any API -- those are dashboard-only. PLAN GATE: Basin includes API access on the Growth, Pro and Agency plans only -- on a Free or Starter account every Basin action fails, and no Agentic Fabriq setting changes that. A missing or wrong API key answers HTTP 400, not 401 (measured 2026-09-23: no key -> 400 'No API key was provided or no user session exists'; a bogus key -> 400 'Bad API key or user does not exist'). Basin's own troubleshooting page says 401; the measured status is 400, so a 400 carrying either of those bodies is a credential problem and not a malformed request. A 403 has two causes on Basin and they need different fixes: the account's plan does not include API access (upgrade to Growth, Pro or Agency), or a form-scoped API key was used against a resource belonging to another form (reconnect with an account-scoped key). Neither is fixed by re-pasting the same key.

List form webhooks via GET /api/v1/form_webhooks. List the webhooks Basin fires when a submission arrives, with each one's target URL, payload format, enabled flag, spam-trigger flag and delivery-failure counters. The optional `query` filter searches by name, id, url and associated form_id. KEY SCOPE: Basin documents the reach of its two key types by resource (forms and domains under the account key, submissions under either) and says nothing about this resource, and no Agentic Fabriq account exists at a paying tier to measure it. An account-scoped key is documented as reaching everything the account can see, so it is the safe choice; a form-scoped key may answer 403 here. PLAN GATE: Basin includes API access on the Growth, Pro and Agency plans only -- on a Free or Starter account every Basin action fails, and no Agentic Fabriq setting changes that. A missing or wrong API key answers HTTP 400, not 401 (measured 2026-09-23: no key -> 400 'No API key was provided or no user session exists'; a bogus key -> 400 'Bad API key or user does not exist'). Basin's own troubleshooting page says 401; the measured status is 400, so a 400 carrying either of those bodies is a credential problem and not a malformed request. A 403 has two causes on Basin and they need different fixes: the account's plan does not include API access (upgrade to Growth, Pro or Agency), or a form-scoped API key was used against a resource belonging to another form (reconnect with an account-scoped key). Neither is fixed by re-pasting the same key.

Get a form webhook via GET /api/v1/form_webhooks/{id}. Retrieve one form webhook by its id, including its delivery failure count and the time of its last failure. KEY SCOPE: Basin documents the reach of its two key types by resource (forms and domains under the account key, submissions under either) and says nothing about this resource, and no Agentic Fabriq account exists at a paying tier to measure it. An account-scoped key is documented as reaching everything the account can see, so it is the safe choice; a form-scoped key may answer 403 here. PLAN GATE: Basin includes API access on the Growth, Pro and Agency plans only -- on a Free or Starter account every Basin action fails, and no Agentic Fabriq setting changes that. A missing or wrong API key answers HTTP 400, not 401 (measured 2026-09-23: no key -> 400 'No API key was provided or no user session exists'; a bogus key -> 400 'Bad API key or user does not exist'). Basin's own troubleshooting page says 401; the measured status is 400, so a 400 carrying either of those bodies is a credential problem and not a malformed request. A 403 has two causes on Basin and they need different fixes: the account's plan does not include API access (upgrade to Growth, Pro or Agency), or a form-scoped API key was used against a resource belonging to another form (reconnect with an account-scoped key). Neither is fixed by re-pasting the same key.

List forms via GET /api/v1/forms. List the forms the connected account can see, with each one's configuration and its inbox, spam and trash counts. The optional `query` filter searches by id, name, uuid and project_id. KEY SCOPE: Basin's Authentication guide lists this under the ACCOUNT API key ('CRUD forms', 'Listing domains'). A form-scoped API key is documented as reaching one form only, so this action is expected to fail on one -- connect an account key (Account Settings -> API Settings) for it. Agentic Fabriq replaces `turnstile_secret` with a withheld marker in every Basin reply, at any depth: it is the form owner's Cloudflare Turnstile SECRET key, and a tool result reaches the model's context and the audit log. It can still be SET through this action; it cannot be read back. PLAN GATE: Basin includes API access on the Growth, Pro and Agency plans only -- on a Free or Starter account every Basin action fails, and no Agentic Fabriq setting changes that. A missing or wrong API key answers HTTP 400, not 401 (measured 2026-09-23: no key -> 400 'No API key was provided or no user session exists'; a bogus key -> 400 'Bad API key or user does not exist'). Basin's own troubleshooting page says 401; the measured status is 400, so a 400 carrying either of those bodies is a credential problem and not a malformed request. A 403 has two causes on Basin and they need different fixes: the account's plan does not include API access (upgrade to Growth, Pro or Agency), or a form-scoped API key was used against a resource belonging to another form (reconnect with an account-scoped key). Neither is fixed by re-pasting the same key.

Get a form via GET /api/v1/forms/{id}. Retrieve one form's full configuration: its endpoint uuid, project, timezone, redirect and branding, notification and autoresponse settings, spam protection, retention and counts. KEY SCOPE: Basin's Authentication guide lists this under the ACCOUNT API key ('CRUD forms', 'Listing domains'). A form-scoped API key is documented as reaching one form only, so this action is expected to fail on one -- connect an account key (Account Settings -> API Settings) for it. Agentic Fabriq replaces `turnstile_secret` with a withheld marker in every Basin reply, at any depth: it is the form owner's Cloudflare Turnstile SECRET key, and a tool result reaches the model's context and the audit log. It can still be SET through this action; it cannot be read back. Form Studio field definitions are NOT part of this: Basin states that adding, removing or reordering Form Studio fields, editing themes and survey structure, and publishing hosted embeds are dashboard-only. This action reaches the form RECORD -- routing, notifications, spam settings, branding and retention. PLAN GATE: Basin includes API access on the Growth, Pro and Agency plans only -- on a Free or Starter account every Basin action fails, and no Agentic Fabriq setting changes that. A missing or wrong API key answers HTTP 400, not 401 (measured 2026-09-23: no key -> 400 'No API key was provided or no user session exists'; a bogus key -> 400 'Bad API key or user does not exist'). Basin's own troubleshooting page says 401; the measured status is 400, so a 400 carrying either of those bodies is a credential problem and not a malformed request. A 403 has two causes on Basin and they need different fixes: the account's plan does not include API access (upgrade to Growth, Pro or Agency), or a form-scoped API key was used against a resource belonging to another form (reconnect with an account-scoped key). Neither is fixed by re-pasting the same key.

List mail templates via GET /api/v1/mail_templates. List the custom email templates belonging to one project. `project_id` is REQUIRED -- mail templates are addressed per project, and Basin answers 404 when the project is not accessible. `page_size` is capped by Basin at 20. KEY SCOPE: Basin documents the reach of its two key types by resource (forms and domains under the account key, submissions under either) and says nothing about this resource, and no Agentic Fabriq account exists at a paying tier to measure it. An account-scoped key is documented as reaching everything the account can see, so it is the safe choice; a form-scoped key may answer 403 here. PLAN GATE: Basin includes API access on the Growth, Pro and Agency plans only -- on a Free or Starter account every Basin action fails, and no Agentic Fabriq setting changes that. A missing or wrong API key answers HTTP 400, not 401 (measured 2026-09-23: no key -> 400 'No API key was provided or no user session exists'; a bogus key -> 400 'Bad API key or user does not exist'). Basin's own troubleshooting page says 401; the measured status is 400, so a 400 carrying either of those bodies is a credential problem and not a malformed request. A 403 has two causes on Basin and they need different fixes: the account's plan does not include API access (upgrade to Growth, Pro or Agency), or a form-scoped API key was used against a resource belonging to another form (reconnect with an account-scoped key). Neither is fixed by re-pasting the same key.

Get a mail template via GET /api/v1/mail_templates/{id}. Retrieve one mail template by its numeric id. Basin answers 404 when the template is not accessible to this key. KEY SCOPE: Basin documents the reach of its two key types by resource (forms and domains under the account key, submissions under either) and says nothing about this resource, and no Agentic Fabriq account exists at a paying tier to measure it. An account-scoped key is documented as reaching everything the account can see, so it is the safe choice; a form-scoped key may answer 403 here. PLAN GATE: Basin includes API access on the Growth, Pro and Agency plans only -- on a Free or Starter account every Basin action fails, and no Agentic Fabriq setting changes that. A missing or wrong API key answers HTTP 400, not 401 (measured 2026-09-23: no key -> 400 'No API key was provided or no user session exists'; a bogus key -> 400 'Bad API key or user does not exist'). Basin's own troubleshooting page says 401; the measured status is 400, so a 400 carrying either of those bodies is a credential problem and not a malformed request. A 403 has two causes on Basin and they need different fixes: the account's plan does not include API access (upgrade to Growth, Pro or Agency), or a form-scoped API key was used against a resource belonging to another form (reconnect with an account-scoped key). Neither is fixed by re-pasting the same key.

List projects via GET /api/v1/projects. List the projects the connected account can see. A project groups forms and owns their mail templates. The optional `query` filter searches by id and name. KEY SCOPE: Basin documents the reach of its two key types by resource (forms and domains under the account key, submissions under either) and says nothing about this resource, and no Agentic Fabriq account exists at a paying tier to measure it. An account-scoped key is documented as reaching everything the account can see, so it is the safe choice; a form-scoped key may answer 403 here. PLAN GATE: Basin includes API access on the Growth, Pro and Agency plans only -- on a Free or Starter account every Basin action fails, and no Agentic Fabriq setting changes that. A missing or wrong API key answers HTTP 400, not 401 (measured 2026-09-23: no key -> 400 'No API key was provided or no user session exists'; a bogus key -> 400 'Bad API key or user does not exist'). Basin's own troubleshooting page says 401; the measured status is 400, so a 400 carrying either of those bodies is a credential problem and not a malformed request. A 403 has two causes on Basin and they need different fixes: the account's plan does not include API access (upgrade to Growth, Pro or Agency), or a form-scoped API key was used against a resource belonging to another form (reconnect with an account-scoped key). Neither is fixed by re-pasting the same key.

Get a project via GET /api/v1/projects/{id}. Retrieve one project by its id. KEY SCOPE: Basin documents the reach of its two key types by resource (forms and domains under the account key, submissions under either) and says nothing about this resource, and no Agentic Fabriq account exists at a paying tier to measure it. An account-scoped key is documented as reaching everything the account can see, so it is the safe choice; a form-scoped key may answer 403 here. PLAN GATE: Basin includes API access on the Growth, Pro and Agency plans only -- on a Free or Starter account every Basin action fails, and no Agentic Fabriq setting changes that. A missing or wrong API key answers HTTP 400, not 401 (measured 2026-09-23: no key -> 400 'No API key was provided or no user session exists'; a bogus key -> 400 'Bad API key or user does not exist'). Basin's own troubleshooting page says 401; the measured status is 400, so a 400 carrying either of those bodies is a credential problem and not a malformed request. A 403 has two causes on Basin and they need different fixes: the account's plan does not include API access (upgrade to Growth, Pro or Agency), or a form-scoped API key was used against a resource belonging to another form (reconnect with an account-scoped key). Neither is fixed by re-pasting the same key.

List submissions via GET /api/v1/submissions. List submissions, newest first by default. `form_id` is the id in the form's endpoint URL (in https://usebasin.com/f/FORM_ID, the FORM_ID); omit it to query every form the key reaches. `filter_by` takes 'new', 'spam', 'trash' or 'all'; `order_by` takes 'date_asc', 'date_desc', 'email_asc' or 'email_desc'; `date_range` is 'YYYY-MM-DD+to+YYYY-MM-DD' and is read in the queried form's timezone, or the account timezone for a global query. Submissions carry whatever the visitor typed, so a reply may contain personal data. KEY SCOPE: Basin's Authentication guide lists submissions under BOTH key types -- an account key reaches every form's submissions, a form-scoped key reaches its own form's. With a form key, a submission belonging to another form answers 403 or 404 rather than succeeding quietly. Submissions cannot be CREATED through this API -- Basin supports index, show, update and destroy only. A visitor's submission arrives at the unauthenticated public form endpoint POST https://usebasin.com/f/<uuid>, which is not part of this integration. Tags cannot be assigned at submission time either; lead tags and rules are configured in the Basin dashboard. PLAN GATE: Basin includes API access on the Growth, Pro and Agency plans only -- on a Free or Starter account every Basin action fails, and no Agentic Fabriq setting changes that. A missing or wrong API key answers HTTP 400, not 401 (measured 2026-09-23: no key -> 400 'No API key was provided or no user session exists'; a bogus key -> 400 'Bad API key or user does not exist'). Basin's own troubleshooting page says 401; the measured status is 400, so a 400 carrying either of those bodies is a credential problem and not a malformed request. A 403 has two causes on Basin and they need different fixes: the account's plan does not include API access (upgrade to Growth, Pro or Agency), or a form-scoped API key was used against a resource belonging to another form (reconnect with an account-scoped key). Neither is fixed by re-pasting the same key.

Get a submission via GET /api/v1/submissions/{id}. Retrieve one submission by its numeric id, with its payload, spam/read/trash state, the submitting IP, referrer and user agent, and any attachments. The payload is whatever the visitor typed, so a reply may contain personal data. KEY SCOPE: Basin's Authentication guide lists submissions under BOTH key types -- an account key reaches every form's submissions, a form-scoped key reaches its own form's. With a form key, a submission belonging to another form answers 403 or 404 rather than succeeding quietly. Submissions cannot be CREATED through this API -- Basin supports index, show, update and destroy only. A visitor's submission arrives at the unauthenticated public form endpoint POST https://usebasin.com/f/<uuid>, which is not part of this integration. Tags cannot be assigned at submission time either; lead tags and rules are configured in the Basin dashboard. PLAN GATE: Basin includes API access on the Growth, Pro and Agency plans only -- on a Free or Starter account every Basin action fails, and no Agentic Fabriq setting changes that. A missing or wrong API key answers HTTP 400, not 401 (measured 2026-09-23: no key -> 400 'No API key was provided or no user session exists'; a bogus key -> 400 'Bad API key or user does not exist'). Basin's own troubleshooting page says 401; the measured status is 400, so a 400 carrying either of those bodies is a credential problem and not a malformed request. A 403 has two causes on Basin and they need different fixes: the account's plan does not include API access (upgrade to Growth, Pro or Agency), or a form-scoped API key was used against a resource belonging to another form (reconnect with an account-scoped key). Neither is fixed by re-pasting the same key.

Update a submission via PATCH /api/v1/submissions/{id}. Change a submission's state or captured values. Basin documents the state fields as `spam`, `read` and `trash`; `email` and `payload_params` carry the captured values. Setting trash: true is the reversible alternative to deleting a submission. KEY SCOPE: Basin's Authentication guide lists submissions under BOTH key types -- an account key reaches every form's submissions, a form-scoped key reaches its own form's. With a form key, a submission belonging to another form answers 403 or 404 rather than succeeding quietly. Submissions cannot be CREATED through this API -- Basin supports index, show, update and destroy only. A visitor's submission arrives at the unauthenticated public form endpoint POST https://usebasin.com/f/<uuid>, which is not part of this integration. Tags cannot be assigned at submission time either; lead tags and rules are configured in the Basin dashboard. PLAN GATE: Basin includes API access on the Growth, Pro and Agency plans only -- on a Free or Starter account every Basin action fails, and no Agentic Fabriq setting changes that. A missing or wrong API key answers HTTP 400, not 401 (measured 2026-09-23: no key -> 400 'No API key was provided or no user session exists'; a bogus key -> 400 'Bad API key or user does not exist'). Basin's own troubleshooting page says 401; the measured status is 400, so a 400 carrying either of those bodies is a credential problem and not a malformed request. A 403 has two causes on Basin and they need different fixes: the account's plan does not include API access (upgrade to Growth, Pro or Agency), or a form-scoped API key was used against a resource belonging to another form (reconnect with an account-scoped key). Neither is fixed by re-pasting the same key.

Create a form webhook via POST /api/v1/form_webhooks. Register a webhook Basin fires when a submission arrives on the form named by `form_id`. Basin answers 401 rather than 403 when the key may not create a webhook on that form, and 422 when the body is rejected -- this is the one operation in the integration whose spec documents a 401. KEY SCOPE: Basin documents the reach of its two key types by resource (forms and domains under the account key, submissions under either) and says nothing about this resource, and no Agentic Fabriq account exists at a paying tier to measure it. An account-scoped key is documented as reaching everything the account can see, so it is the safe choice; a form-scoped key may answer 403 here. PLAN GATE: Basin includes API access on the Growth, Pro and Agency plans only -- on a Free or Starter account every Basin action fails, and no Agentic Fabriq setting changes that. A missing or wrong API key answers HTTP 400, not 401 (measured 2026-09-23: no key -> 400 'No API key was provided or no user session exists'; a bogus key -> 400 'Bad API key or user does not exist'). Basin's own troubleshooting page says 401; the measured status is 400, so a 400 carrying either of those bodies is a credential problem and not a malformed request. A 403 has two causes on Basin and they need different fixes: the account's plan does not include API access (upgrade to Growth, Pro or Agency), or a form-scoped API key was used against a resource belonging to another form (reconnect with an account-scoped key). Neither is fixed by re-pasting the same key.

Create a form via POST /api/v1/forms. Create a form under a project the account owns or administers, and receive the endpoint uuid visitors post to. Basin answers 422 when the body is rejected. KEY SCOPE: Basin's Authentication guide lists this under the ACCOUNT API key ('CRUD forms', 'Listing domains'). A form-scoped API key is documented as reaching one form only, so this action is expected to fail on one -- connect an account key (Account Settings -> API Settings) for it. Agentic Fabriq replaces `turnstile_secret` with a withheld marker in every Basin reply, at any depth: it is the form owner's Cloudflare Turnstile SECRET key, and a tool result reaches the model's context and the audit log. It can still be SET through this action; it cannot be read back. Form Studio field definitions are NOT part of this: Basin states that adding, removing or reordering Form Studio fields, editing themes and survey structure, and publishing hosted embeds are dashboard-only. This action reaches the form RECORD -- routing, notifications, spam settings, branding and retention. The custom sending-domain fields (domain_id, domain_email) need Pro or above -- a plan boundary inside the Growth-and-up API gate. PLAN GATE: Basin includes API access on the Growth, Pro and Agency plans only -- on a Free or Starter account every Basin action fails, and no Agentic Fabriq setting changes that. A missing or wrong API key answers HTTP 400, not 401 (measured 2026-09-23: no key -> 400 'No API key was provided or no user session exists'; a bogus key -> 400 'Bad API key or user does not exist'). Basin's own troubleshooting page says 401; the measured status is 400, so a 400 carrying either of those bodies is a credential problem and not a malformed request. A 403 has two causes on Basin and they need different fixes: the account's plan does not include API access (upgrade to Growth, Pro or Agency), or a form-scoped API key was used against a resource belonging to another form (reconnect with an account-scoped key). Neither is fixed by re-pasting the same key.

Create a mail template via POST /api/v1/mail_templates. Create a custom email template in a project. The body is wrapped in a `mail_template` object, and `name` and `project_id` are both required inside it. `body` is raw HTML, capped by Basin at 262144 bytes; a blank body is accepted. KEY SCOPE: Basin documents the reach of its two key types by resource (forms and domains under the account key, submissions under either) and says nothing about this resource, and no Agentic Fabriq account exists at a paying tier to measure it. An account-scoped key is documented as reaching everything the account can see, so it is the safe choice; a form-scoped key may answer 403 here. PLAN GATE: Basin includes API access on the Growth, Pro and Agency plans only -- on a Free or Starter account every Basin action fails, and no Agentic Fabriq setting changes that. A missing or wrong API key answers HTTP 400, not 401 (measured 2026-09-23: no key -> 400 'No API key was provided or no user session exists'; a bogus key -> 400 'Bad API key or user does not exist'). Basin's own troubleshooting page says 401; the measured status is 400, so a 400 carrying either of those bodies is a credential problem and not a malformed request. A 403 has two causes on Basin and they need different fixes: the account's plan does not include API access (upgrade to Growth, Pro or Agency), or a form-scoped API key was used against a resource belonging to another form (reconnect with an account-scoped key). Neither is fixed by re-pasting the same key.

Create a project via POST /api/v1/projects. Create a project to group forms under. Basin answers 422 when the body is rejected. KEY SCOPE: Basin documents the reach of its two key types by resource (forms and domains under the account key, submissions under either) and says nothing about this resource, and no Agentic Fabriq account exists at a paying tier to measure it. An account-scoped key is documented as reaching everything the account can see, so it is the safe choice; a form-scoped key may answer 403 here. PLAN GATE: Basin includes API access on the Growth, Pro and Agency plans only -- on a Free or Starter account every Basin action fails, and no Agentic Fabriq setting changes that. A missing or wrong API key answers HTTP 400, not 401 (measured 2026-09-23: no key -> 400 'No API key was provided or no user session exists'; a bogus key -> 400 'Bad API key or user does not exist'). Basin's own troubleshooting page says 401; the measured status is 400, so a 400 carrying either of those bodies is a credential problem and not a malformed request. A 403 has two causes on Basin and they need different fixes: the account's plan does not include API access (upgrade to Growth, Pro or Agency), or a form-scoped API key was used against a resource belonging to another form (reconnect with an account-scoped key). Neither is fixed by re-pasting the same key.

Re-fire webhooks for one submission via POST /api/v1/submissions/{id}/refire_webhooks. Queue every enabled webhook on the submission's form to fire again for that one submission -- the repair for a webhook target that was down. The receiving system sees a second delivery of the same submission, so it must tolerate duplicates. Basin answers 404 when the submission belongs to another user. KEY SCOPE: Basin's Authentication guide lists submissions under BOTH key types -- an account key reaches every form's submissions, a form-scoped key reaches its own form's. With a form key, a submission belonging to another form answers 403 or 404 rather than succeeding quietly. This is the one Basin operation whose documentation names the form-key consequence directly: a 403 here means the submission does not belong to the form whose API key was used. Submissions cannot be CREATED through this API -- Basin supports index, show, update and destroy only. A visitor's submission arrives at the unauthenticated public form endpoint POST https://usebasin.com/f/<uuid>, which is not part of this integration. Tags cannot be assigned at submission time either; lead tags and rules are configured in the Basin dashboard. PLAN GATE: Basin includes API access on the Growth, Pro and Agency plans only -- on a Free or Starter account every Basin action fails, and no Agentic Fabriq setting changes that. A missing or wrong API key answers HTTP 400, not 401 (measured 2026-09-23: no key -> 400 'No API key was provided or no user session exists'; a bogus key -> 400 'Bad API key or user does not exist'). Basin's own troubleshooting page says 401; the measured status is 400, so a 400 carrying either of those bodies is a credential problem and not a malformed request. A 403 has two causes on Basin and they need different fixes: the account's plan does not include API access (upgrade to Growth, Pro or Agency), or a form-scoped API key was used against a resource belonging to another form (reconnect with an account-scoped key). Neither is fixed by re-pasting the same key.

Re-fire webhooks for several submissions via POST /api/v1/submissions/refire_webhooks. Queue webhooks to fire again for a list of submissions named by `submission_ids`, which is required. Every receiving system sees a second delivery of each submission, so this is a bulk re-delivery and not a read. Basin answers 422 when no submission_ids are supplied. KEY SCOPE: Basin's Authentication guide lists submissions under BOTH key types -- an account key reaches every form's submissions, a form-scoped key reaches its own form's. With a form key, a submission belonging to another form answers 403 or 404 rather than succeeding quietly. Submissions cannot be CREATED through this API -- Basin supports index, show, update and destroy only. A visitor's submission arrives at the unauthenticated public form endpoint POST https://usebasin.com/f/<uuid>, which is not part of this integration. Tags cannot be assigned at submission time either; lead tags and rules are configured in the Basin dashboard. PLAN GATE: Basin includes API access on the Growth, Pro and Agency plans only -- on a Free or Starter account every Basin action fails, and no Agentic Fabriq setting changes that. A missing or wrong API key answers HTTP 400, not 401 (measured 2026-09-23: no key -> 400 'No API key was provided or no user session exists'; a bogus key -> 400 'Bad API key or user does not exist'). Basin's own troubleshooting page says 401; the measured status is 400, so a 400 carrying either of those bodies is a credential problem and not a malformed request. A 403 has two causes on Basin and they need different fixes: the account's plan does not include API access (upgrade to Growth, Pro or Agency), or a form-scoped API key was used against a resource belonging to another form (reconnect with an account-scoped key). Neither is fixed by re-pasting the same key.

Update a form webhook via PUT /api/v1/form_webhooks/{id}. Change a form webhook's name, target url, payload format, enabled state, spam-trigger behaviour or the form it belongs to. Basin replaces the fields the body carries; omitted fields are left as they were. KEY SCOPE: Basin documents the reach of its two key types by resource (forms and domains under the account key, submissions under either) and says nothing about this resource, and no Agentic Fabriq account exists at a paying tier to measure it. An account-scoped key is documented as reaching everything the account can see, so it is the safe choice; a form-scoped key may answer 403 here. PLAN GATE: Basin includes API access on the Growth, Pro and Agency plans only -- on a Free or Starter account every Basin action fails, and no Agentic Fabriq setting changes that. A missing or wrong API key answers HTTP 400, not 401 (measured 2026-09-23: no key -> 400 'No API key was provided or no user session exists'; a bogus key -> 400 'Bad API key or user does not exist'). Basin's own troubleshooting page says 401; the measured status is 400, so a 400 carrying either of those bodies is a credential problem and not a malformed request. A 403 has two causes on Basin and they need different fixes: the account's plan does not include API access (upgrade to Growth, Pro or Agency), or a form-scoped API key was used against a resource belonging to another form (reconnect with an account-scoped key). Neither is fixed by re-pasting the same key.

Update a form via PUT /api/v1/forms/{id}. Change a form's configuration. The notification recipient fields follow Basin's own three-way rule: OMIT the field to leave the current recipients unchanged, send an empty string to remove them all, or send a comma-separated list to replace them -- and a newly added address must be verified before it receives anything. Basin answers 422 when a confirmation mail template belongs to another account. KEY SCOPE: Basin's Authentication guide lists this under the ACCOUNT API key ('CRUD forms', 'Listing domains'). A form-scoped API key is documented as reaching one form only, so this action is expected to fail on one -- connect an account key (Account Settings -> API Settings) for it. Agentic Fabriq replaces `turnstile_secret` with a withheld marker in every Basin reply, at any depth: it is the form owner's Cloudflare Turnstile SECRET key, and a tool result reaches the model's context and the audit log. It can still be SET through this action; it cannot be read back. Form Studio field definitions are NOT part of this: Basin states that adding, removing or reordering Form Studio fields, editing themes and survey structure, and publishing hosted embeds are dashboard-only. This action reaches the form RECORD -- routing, notifications, spam settings, branding and retention. The custom sending-domain fields (domain_id, domain_email) need Pro or above -- a plan boundary inside the Growth-and-up API gate. PLAN GATE: Basin includes API access on the Growth, Pro and Agency plans only -- on a Free or Starter account every Basin action fails, and no Agentic Fabriq setting changes that. A missing or wrong API key answers HTTP 400, not 401 (measured 2026-09-23: no key -> 400 'No API key was provided or no user session exists'; a bogus key -> 400 'Bad API key or user does not exist'). Basin's own troubleshooting page says 401; the measured status is 400, so a 400 carrying either of those bodies is a credential problem and not a malformed request. A 403 has two causes on Basin and they need different fixes: the account's plan does not include API access (upgrade to Growth, Pro or Agency), or a form-scoped API key was used against a resource belonging to another form (reconnect with an account-scoped key). Neither is fixed by re-pasting the same key.

Update a mail template via PUT /api/v1/mail_templates/{id}. Change a mail template's name or HTML body. The body is wrapped in a `mail_template` object. `body` is raw HTML, capped by Basin at 262144 bytes; a blank body is accepted. Optional `if_match` carries an RFC 7232 strong ETag as the `If-Match` request header; Basin answers 409 when the stored template has moved on. Omit it and the update is last-write-wins, which is Basin's documented default. Agentic Fabriq refuses a value that is not an ETag rather than escaping it, because this is the one place a caller-chosen value reaches a header position. KEY SCOPE: Basin documents the reach of its two key types by resource (forms and domains under the account key, submissions under either) and says nothing about this resource, and no Agentic Fabriq account exists at a paying tier to measure it. An account-scoped key is documented as reaching everything the account can see, so it is the safe choice; a form-scoped key may answer 403 here. PLAN GATE: Basin includes API access on the Growth, Pro and Agency plans only -- on a Free or Starter account every Basin action fails, and no Agentic Fabriq setting changes that. A missing or wrong API key answers HTTP 400, not 401 (measured 2026-09-23: no key -> 400 'No API key was provided or no user session exists'; a bogus key -> 400 'Bad API key or user does not exist'). Basin's own troubleshooting page says 401; the measured status is 400, so a 400 carrying either of those bodies is a credential problem and not a malformed request. A 403 has two causes on Basin and they need different fixes: the account's plan does not include API access (upgrade to Growth, Pro or Agency), or a form-scoped API key was used against a resource belonging to another form (reconnect with an account-scoped key). Neither is fixed by re-pasting the same key.

Update a project via PUT /api/v1/projects/{id}. Rename a project. `name` is the only field Basin accepts here. KEY SCOPE: Basin documents the reach of its two key types by resource (forms and domains under the account key, submissions under either) and says nothing about this resource, and no Agentic Fabriq account exists at a paying tier to measure it. An account-scoped key is documented as reaching everything the account can see, so it is the safe choice; a form-scoped key may answer 403 here. PLAN GATE: Basin includes API access on the Growth, Pro and Agency plans only -- on a Free or Starter account every Basin action fails, and no Agentic Fabriq setting changes that. A missing or wrong API key answers HTTP 400, not 401 (measured 2026-09-23: no key -> 400 'No API key was provided or no user session exists'; a bogus key -> 400 'Bad API key or user does not exist'). Basin's own troubleshooting page says 401; the measured status is 400, so a 400 carrying either of those bodies is a credential problem and not a malformed request. A 403 has two causes on Basin and they need different fixes: the account's plan does not include API access (upgrade to Growth, Pro or Agency), or a form-scoped API key was used against a resource belonging to another form (reconnect with an account-scoped key). Neither is fixed by re-pasting the same key.