Built by Engineers,
For High-Performance Teams
Integrate dynamic form capture, trigger transactional emails, verify custom sender domains, and ingest real-time webhook streams with sub-10ms Redis execution.
curl -X POST https://api.codxbot.com/v1/api/forms/submit/form_live_88019 \
-H "Content-Type: application/json" \
-H "x-api-key: cx_live_99a812b7..." \
-d '{
"name": "Sarah Connor",
"email": "sarah@cyberdyne.io",
"company": "Cyberdyne Systems",
"metadata": {
"trafficSource": "paid_search",
"region": "us-west"
}
}'
Core REST Endpoints
All requests must be made over HTTPS with API Key authentication.
Submits dynamic form payload with honeypot spam scoring and automatic webhook execution.
Dispatches transactional email via BullMQ queue with custom DKIM signature signing.
Triggers instantaneous authoritative DNS queries for SPF, DKIM, and DMARC TXT/CNAME records.
Directly ingests and enriches a lead contact record into project audience groups.
Cryptographic HMAC Webhook Security
Every webhook dispatched by CodxBot contains an x-codxbot-signature header computed using
HMAC SHA-256 with your webhook secret key. Verify message authenticity with zero trust.
submission.created — Fired on
clean form submissionemail.delivered — Fired when
email reaches inbox (SMTP 250)domain.verified — Fired on
successful SPF/DKIM DNS checkimport crypto from 'crypto';
export function verifyCodxbotWebhook(rawBody: string, signature: string, secret: string): boolean {
const expectedSignature = crypto
.createHmac('sha256', secret)
.update(rawBody)
.digest('hex');
return crypto.timingSafeEqual(
Buffer.from(signature),
Buffer.from(expectedSignature)
);
}
forms:write (Ingest submissions)email:send (Trigger transactional mail)domains:read (Inspect DNS status)billing:manage (Restricted to Owner)Scoped API Keys & Role Governance
Generate separate API keys for development, staging, and production environments. Limit permissions so keys used in client-side code can only submit forms without exposing lead database records.
-
Pass via HTTP header:
x-api-key: cx_live_... - Instant token revocation and rotation from the Control Panel
- TLS 1.3 encryption enforced on all incoming connections
Predictable Behavior
Standardized HTTP Status Codes
Request processed successfully. Form ingested or email enqueued in BullMQ.
Automated honeypot field filled or disposable IP blacklist detected.
Monthly request quota or per-second sliding window limit reached.
Plan API Quotas & Burst Allowances
Every plan includes dedicated monthly API request quotas backed by Redis sliding window rate limiters.
Starter
Burst allowance: 10 req / sec. Perfect for staging and hobby sites.
Professional
Burst allowance: 100 req / sec. High-speed Redis queue priority.
Enterprise
Burst allowance: 1,000 req / sec. Dedicated VIP Redis pool.
SDK Ecosystem
Official Open-Source Client Libraries
Global Edge Node Latency Benchmarks
Measured across 14 global edge clusters handling production form submissions and BullMQ handoffs.
Frequently Answered Questions
http://localhost:3000 without CORS restrictions. For
local webhook receipt, tools like ngrok or Cloudflare Tunnel forward live webhooks straight to your local
server.