REST API v1 • OpenAPI 3.0 Ready

Built by Engineers,
For High-Performance Teams

Integrate dynamic form capture, trigger transactional emails, verify custom sender domains, and ingest real-time webhook streams with sub-10ms Redis execution.

POST /v1/api/forms/submit/:formId
curl -X POST https://api.codxbot.com/v1/api/forms/submit/form_live_88019 \
  -H "Content-Type: application/json" \
  -H "x-api-key: cx_live_99a812b7..." \
  -d '{
    "name": "Sarah Connor",
    "email": "sarah@cyberdyne.io",
    "company": "Cyberdyne Systems",
    "metadata": {
      "trafficSource": "paid_search",
      "region": "us-west"
    }
  }'
API Reference

Core REST Endpoints

All requests must be made over HTTPS with API Key authentication.

POST /v1/api/forms/submit/:formId

Submits dynamic form payload with honeypot spam scoring and automatic webhook execution.

Rate Limit: 100 req/sec
POST /v1/api/email/send

Dispatches transactional email via BullMQ queue with custom DKIM signature signing.

Sub-10ms Latency
GET /v1/api/domains/verify/:domainId

Triggers instantaneous authoritative DNS queries for SPF, DKIM, and DMARC TXT/CNAME records.

Real-time DNS
POST /v1/api/leads

Directly ingests and enriches a lead contact record into project audience groups.

CRM Ingestion
Event Streaming

Cryptographic HMAC Webhook Security

Every webhook dispatched by CodxBot contains an x-codxbot-signature header computed using HMAC SHA-256 with your webhook secret key. Verify message authenticity with zero trust.

⚡ submission.created — Fired on clean form submission
⚡ email.delivered — Fired when email reaches inbox (SMTP 250)
⚡ domain.verified — Fired on successful SPF/DKIM DNS check
webhook-verifier.ts
import crypto from 'crypto';

export function verifyCodxbotWebhook(rawBody: string, signature: string, secret: string): boolean {
  const expectedSignature = crypto
    .createHmac('sha256', secret)
    .update(rawBody)
    .digest('hex');

  return crypto.timingSafeEqual(
    Buffer.from(signature),
    Buffer.from(expectedSignature)
  );
}
Scoped API Key Token Permission Scopes
Token: cx_live_prod_898a12bc9001
✓ forms:write (Ingest submissions)
✓ email:send (Trigger transactional mail)
✓ domains:read (Inspect DNS status)
✗ billing:manage (Restricted to Owner)
Authentication

Scoped API Keys & Role Governance

Generate separate API keys for development, staging, and production environments. Limit permissions so keys used in client-side code can only submit forms without exposing lead database records.

  • Pass via HTTP header: x-api-key: cx_live_...
  • Instant token revocation and rotation from the Control Panel
  • TLS 1.3 encryption enforced on all incoming connections

Predictable Behavior

Standardized HTTP Status Codes

200 / 201 OK

Request processed successfully. Form ingested or email enqueued in BullMQ.

422 Spambot Trapped

Automated honeypot field filled or disposable IP blacklist detected.

429 Rate Exceeded

Monthly request quota or per-second sliding window limit reached.

Rate Limits

Plan API Quotas & Burst Allowances

Every plan includes dedicated monthly API request quotas backed by Redis sliding window rate limiters.

Starter

700 Req / mo

Burst allowance: 10 req / sec. Perfect for staging and hobby sites.

Professional

35,000 Req / mo

Burst allowance: 100 req / sec. High-speed Redis queue priority.

Enterprise

350,000 Req / mo

Burst allowance: 1,000 req / sec. Dedicated VIP Redis pool.

SDK Ecosystem

Official Open-Source Client Libraries

React & Next.js npm i @codxbot/react
Node.js / TS npm i @codxbot/node
Python Client pip install codxbot
Vanilla JS CDN <script src="...">
Live Telemetry

Global Edge Node Latency Benchmarks

Measured across 14 global edge clusters handling production form submissions and BullMQ handoffs.

US-East (N. Virginia)
2.1ms
p50 Queue Time
EU-Central (Frankfurt)
3.4ms
p50 Queue Time
AP-South (Mumbai)
4.2ms
p50 Queue Time
Developer FAQ

Frequently Answered Questions

Yes. You can submit forms directly from http://localhost:3000 without CORS restrictions. For local webhook receipt, tools like ngrok or Cloudflare Tunnel forward live webhooks straight to your local server.
Yes. Once your domain's DKIM 2048-bit CNAME or TXT record is verified in your project workspace, all outgoing emails dispatched through the REST API or BullMQ queue are automatically cryptographically signed with your domain.
Instant Setup in Under 3 Minutes

Ready to Scale Your Lead & Delivery Pipeline?

Join high-growth engineering and revenue teams deploying CodxBot for spam-free form capture, verified custom domains, and sub-10ms transactional emails.

✓ No credit card required • ✓ 14-day Pro trial included • ✓ Cancel anytime