Build with Forms.

POST https://forms.inversify.live/api/v1/forms/frm_7x2k9p/submissions
Authorization: Bearer frmk_live_3a8f...
Content-Type: application/json

{
  "answers": {
    "fld_name":   "Ada Lovelace",
    "fld_email":  "ada@analytical.engine",
    "fld_rating": 9,
    "fld_notes":  "Loved the conversational flow."
  }
}

HTTP/1.1 201 Created
Content-Type: application/json

{
  "id":          "res_01HX9M2KQ4",
  "formId":      "frm_7x2k9p",
  "completedAt": "2026-04-21T17:42:08.314Z"
}

• response.createdFired immediately when any response is saved (form, chat, or API).
• response.analyzedFired after open-text answers have been themed and sentiment-scored.

{
  "event":    "response.created",
  "formId":   "frm_7x2k9p",
  "deliveryId": "dlv_01HX9M...",
  "timestamp": "2026-04-21T17:42:08.314Z",
  "data": {
    "id":      "res_01HX9M2KQ4",
    "answers": { "fld_name": "Ada Lovelace", "fld_rating": 9 },
    "source":  "api"
  }
}

import crypto from "node:crypto";

export function verify(rawBody: string, signature: string, secret: string) {
  const expected = crypto
    .createHmac("sha256", secret)
    .update(rawBody)
    .digest("hex");

  // timing-safe compare
  const a = Buffer.from(expected, "hex");
  const b = Buffer.from(signature, "hex");
  return a.length === b.length && crypto.timingSafeEqual(a, b);
}

// in your handler:
const raw = await req.text();
const sig = req.headers.get("x-inversify-signature") ?? "";
if (!verify(raw, sig, process.env.FORM_WEBHOOK_SECRET!)) {
  return new Response("bad signature", { status: 401 });
}