Other form tools

The request Carescale accepts from any form tool or website code, with keys, limits, campaign tracking and file uploads.

Any form tool that can send a webhook with a custom header can create Carescale leads. Examples are a form builder’s webhook setting, a serverless function or your own site code. This page is the full contract.

You need the Endpoint address and the secret from the facility’s Carescale admin.

The request

Method	POST
Address	The Endpoint address, exactly as Carescale shows it. Carescale never redirects, so don’t send to a variant of it.
Header	Authorization: Bearer <secret>
Body	A JSON object, Content-Type: application/json. A form-encoded body is also accepted.
Size	At most 256 KB
Rate	20 a minute per endpoint, with short bursts allowed. Extra requests get 429 with Retry-After.

Send the request from a server, never from the visitor’s browser, so the secret stays private.

Carescale stores the submission and answers 200 at once, then creates or updates the lead within seconds. Every other answer means the submission was refused and not stored. See Troubleshooting.

The body

Send one flat JSON object. Each key is one form question, and its value is the answer.

• Keys become labels. first_name reads “First name” and bestTimeToReach reads “Best time to reach”. Carescale matches each label to a lead field, so plain words work best.
• Values are strings or numbers. A list of strings works for a question with several answers. An empty string counts as unanswered. Nested objects are ignored.
• Unmatched answers are kept. Carescale keeps every answer on the lead, word for word, even when it can’t match it to a lead field.

These optional keys describe the submission instead of answering a question:

Key	Meaning
form_id	A stable ID for the form. Without it, Carescale tells forms apart by their set of keys.
form_title or form_name	The form’s name, shown to staff, for example “Verify insurance”.
entry_id or id	Your ID for this submission. A second request with the same ID is ignored, which makes retries safe.
date_created	When the person submitted, in UTC as YYYY-MM-DD HH:MM:SS, or ISO 8601 with an offset. A late delivery keeps this time.
source_url	The page the form is on. Carescale uses its host to name the site and to allow file downloads.
status	Leave it out. Any value other than active is treated as spam and creates no lead.

Example

curl -X POST "https://your-endpoint-address-from-carescale" \
  -H "Authorization: Bearer wfs_your_secret_here" \
  -H "Content-Type: application/json" \
  -d '{
    "form_id": "contact-us",
    "form_title": "Contact us",
    "entry_id": "1001",
    "date_created": "2026-10-12T15:04:05Z",
    "source_url": "https://www.example.com/contact/",
    "first_name": "Avery",
    "last_name": "Collins",
    "phone": "[phone]",
    "email": "[e-mail]",
    "who_for": "Myself",
    "preferred_contact": "Text message",
    "message": "I would like to learn about your programs.",
    "utm_source": "google",
    "utm_campaign": "fall-search"
  }'

A 200 answer reads Received.

Who the inquiry is for

When someone fills in a form for a loved one or a client, send both people. Carescale makes the person the inquiry is about the lead, and records the person who filled in the form as the caller.

• who_for: “Myself”, “A loved one” or “A client I’m referring”.
• first_name, last_name, phone, email: the person the inquiry is about.
• your_first_name, your_last_name, your_phone, your_email, relationship: the person filling in the form.

Campaign tracking

Send these keys, usually from hidden fields filled from the landing page’s address, and Carescale records them on the new lead’s referral history:

utm_source, utm_medium, utm_campaign, utm_term, utm_content, gclid, landing_page

Any spelling of these works, such as UTM Source or utmSource. Values are capped at 2,000 characters.

File uploads

Send an insurance card photo as its URL under insurance_card_front or insurance_card_back. Carescale links those keys to the lead’s insurance card and downloads each file in the background:

• HTTPS only, from the same host as source_url, with no port and no login.
• JPEG, PNG, WebP, HEIC or PDF, at most 20 MB.
• At most 3 redirects, each on the same host.
• A busy or unreachable site is tried again 10 and then 50 minutes later.
• At most 10 files from one submission. Any more show on the lead as not retrieved.

A photo fills the lead’s empty insurance card slot, and anything else goes to the lead’s Documents. A file Carescale couldn’t download shows on the lead, so staff know to ask for it.

Other URLs are kept on the lead as answers and aren’t downloaded. The Gravity Forms snippet is different: it marks every upload field, so all of its uploads are downloaded.

The files must stay downloadable for about an hour. Delete them from your site after a day. See the privacy checklist.