---
title: "Read the real contents of one page of replies (audited)"
method: POST
path: "/stats/forms/{id}/submissions/reveal"
tags: ["Stats"]
---

# Read the real contents of one page of replies (audited)

`POST /stats/forms/{id}/submissions/reveal`

## Request

- Base URL: `https://api.nippy.host`
- URL: `https://api.nippy.host/stats/forms/{id}/submissions/reveal`
- Auth: `bearer` (a scheme the document does not define)

Returns the same page unredacted, and records a `form.replies_revealed` activity naming the acting admin, the site, the form, how many replies were read and the reason given. A POST rather than a query flag because it is a recorded action with a required body, and because a justification does not belong in a URL that lands in access logs. One page per record, so the audit trail stays proportionate to what was actually read.

## Path parameters

- `id` string, required

## Request body

- RevealFormSubmissionsDto
  - `reason` string, required: Why these replies need reading — an abuse investigation, a support escalation, an erasure request. Recorded verbatim in the admin activity feed and not editable afterwards.
  - `limit` number: Replies to reveal.
  - `offset` number: Rows to skip.

## Response `200`

- APIAdminFormSubmissionsResponse
  - `form` APIAdminForm, required
    - `id` string, required: Form UUID
    - `siteId` string, required: Site UUID the form was found on
    - `subdomain` string, required: Site subdomain
    - `siteUrl` string, required: Public URL of the site
    - `siteStatus` 'pending' | 'awaiting_verification' | 'live' | 'inactive' | 'suspended', required: Lifecycle state of the site
    - `accountId` string, required: Owning account UUID
    - `accountName` string, nullable, required: Owning account name, or null
    - `ownerEmail` string, nullable, required: Email of the user who created the site, or null
    - `plan` 'free' | 'basic' | 'pro' | 'max', required: The account's plan tier (`free` when unsubscribed)
    - `ownerUnlocked` boolean, required: Whether the account's plan includes reading reply contents. False means the owner is looking at masked rows in their own dashboard.
    - `name` string, required: Display name of the form
    - `pagePath` string, required: Path of the page the form appears on
    - `fieldLabels` string[], required: Field labels as last seen, in the order they appear
    - `captureEnabled` boolean, required: Whether replies to this form are being stored
    - `siteCaptureEnabled` boolean, required: Whether the site-wide capture switch is on
    - `submissionCount` number, required: Number of replies stored for this form
    - `lastSubmissionAt` string, nullable, required: ISO timestamp of the most recent reply, or null
    - `createdAt` string, required: ISO timestamp the form was first seen
  - `submissions` APIAdminFormSubmission[], required
    - `id` string, required: Submission UUID
    - `formId` string, required: Form UUID
    - `submittedAt` string, required: ISO timestamp the reply was submitted
    - `pagePath` string, required: Path of the page the reply came from
    - `country` string, required: Visitor's country (ISO alpha-2), or empty
    - `fields` APIFormSubmissionField[], required
      - `label` string, required: Resolved field label
      - `value` string, required: The submitted value, or a redacted form of it when locked.
      - `length` number, required: Character count of the real value
  - `total` number, required: Total replies stored for this form
  - `revealed` boolean, required: False on the default listing — every value is redacted. True only on the response to an audited reveal, where the values are the real ones and a `form.replies_revealed` activity has been recorded.

## Other responses

- `400`: Invalid body — a reason of 12–500 characters is required
- `403`: Admin access required
- `404`: Form not found

---

[API](https://skmtc.dev/nippy/apis/nippy-backend-api.md) · [All operations](https://skmtc.dev/nippy/apis/nippy-backend-api/llms.txt) · [OpenAPI document](https://skmtc.dev/nippy/apis/nippy-backend-api/revisions/7ab23f040a55?raw)