---
title: "Replies to one form, redacted"
method: GET
path: "/stats/forms/{id}/submissions"
tags: ["Stats"]
---

# Replies to one form, redacted

`GET /stats/forms/{id}/submissions`

## Request

- Base URL: `https://api.nippy.host`
- URL: `https://api.nippy.host/stats/forms/{id}/submissions`
- Auth: `bearer` (a scheme the document does not define)

Admin-only listing of the replies stored for a form, newest first, with every value redacted through the same masking the owner-facing paywall uses — labels, field counts, value lengths and leading characters survive, the contents do not. Enough to tell a genuine enquiry from bot spam during a moderation check without reading anyone's message. Use `POST .../reveal` when the contents genuinely have to be read.

## Path parameters

- `id` string, required

## Query parameters

- `limit` number
- `offset` number

## Response `200`

- APIAdminFormSubmissionsResponse
  - `form` APIAdminForm, required
    - `id` string, required: Form UUID
    - `siteId` string, required: Site UUID the form was found on
    - `subdomain` string, required: Site subdomain
    - `siteUrl` string, required: Public URL of the site
    - `siteStatus` 'pending' | 'awaiting_verification' | 'live' | 'inactive' | 'suspended', required: Lifecycle state of the site
    - `accountId` string, required: Owning account UUID
    - `accountName` string, nullable, required: Owning account name, or null
    - `ownerEmail` string, nullable, required: Email of the user who created the site, or null
    - `plan` 'free' | 'basic' | 'pro' | 'max', required: The account's plan tier (`free` when unsubscribed)
    - `ownerUnlocked` boolean, required: Whether the account's plan includes reading reply contents. False means the owner is looking at masked rows in their own dashboard.
    - `name` string, required: Display name of the form
    - `pagePath` string, required: Path of the page the form appears on
    - `fieldLabels` string[], required: Field labels as last seen, in the order they appear
    - `captureEnabled` boolean, required: Whether replies to this form are being stored
    - `siteCaptureEnabled` boolean, required: Whether the site-wide capture switch is on
    - `submissionCount` number, required: Number of replies stored for this form
    - `lastSubmissionAt` string, nullable, required: ISO timestamp of the most recent reply, or null
    - `createdAt` string, required: ISO timestamp the form was first seen
  - `submissions` APIAdminFormSubmission[], required
    - `id` string, required: Submission UUID
    - `formId` string, required: Form UUID
    - `submittedAt` string, required: ISO timestamp the reply was submitted
    - `pagePath` string, required: Path of the page the reply came from
    - `country` string, required: Visitor's country (ISO alpha-2), or empty
    - `fields` APIFormSubmissionField[], required
      - `label` string, required: Resolved field label
      - `value` string, required: The submitted value, or a redacted form of it when locked.
      - `length` number, required: Character count of the real value
  - `total` number, required: Total replies stored for this form
  - `revealed` boolean, required: False on the default listing — every value is redacted. True only on the response to an audited reveal, where the values are the real ones and a `form.replies_revealed` activity has been recorded.

## Other responses

- `400`: Invalid query parameters
- `403`: Admin access required
- `404`: Form not found

---

[API](https://skmtc.dev/nippy/apis/nippy-backend-api.md) · [All operations](https://skmtc.dev/nippy/apis/nippy-backend-api/llms.txt) · [OpenAPI document](https://skmtc.dev/nippy/apis/nippy-backend-api/revisions/7ab23f040a55?raw)