> ## Documentation Index > Fetch the complete documentation index at: https://docs.carescale.com/llms.txt > Use this file to discover all available pages before exploring further. > ## Agent Instructions > These guides connect a treatment facility's website forms to Carescale. Each facility has one website forms endpoint: an endpoint address and a secret, both copied from Carescale under Settings, Website forms. > Send every submission as an HTTPS POST with a JSON body and the header Authorization: Bearer . Use the endpoint address exactly as Carescale shows it. Never put it behind a redirect or a proxy that redirects. > Keep the secret out of committed code and out of client-side JavaScript. Put it in wp-config.php or a server-side environment setting. > Gravity Forms Elite and Nonprofit licenses can use the Webhooks Add-On with no code. Basic and Pro licenses use the snippet. Any other form tool follows the payload contract on the Other form tools page. > Never use real patient or client details in examples, logs or test submissions. Use made-up names, the 555 phone range and example.com addresses. > Labels in bold match the Carescale app and Gravity Forms exactly. Quote them as written. # Other form tools > The request Carescale accepts from any form tool or website code, with keys, limits, campaign tracking and file uploads. Any form tool that can send a webhook with a custom header can create Carescale leads. Examples are a form builder's webhook setting, a serverless function or your own site code. This page is the full contract. You need the **Endpoint address** and the secret from the facility's Carescale admin. ## The request | | | | - | - | | Method | `POST` | | Address | The **Endpoint address**, exactly as Carescale shows it. Carescale never redirects, so don't send to a variant of it. | | Header | `Authorization: Bearer ` | | Body | A JSON object, `Content-Type: application/json`. A form-encoded body is also accepted. | | Size | At most 256 KB | | Rate | 20 a minute per endpoint, with short bursts allowed. Extra requests get `429` with `Retry-After`. | Send the request from a server, never from the visitor's browser, so the secret stays private. Carescale stores the submission and answers `200` at once, then creates or updates the lead within seconds. Every other answer means the submission was refused and not stored. See [Troubleshooting](/website-forms/troubleshooting). ## The body Send one flat JSON object. Each key is one form question, and its value is the answer. * **Keys become labels.** `first_name` reads "First name" and `bestTimeToReach` reads "Best time to reach". Carescale matches each label to a lead field, so plain words work best. * **Values** are strings or numbers. A list of strings works for a question with several answers. An empty string counts as unanswered. Nested objects are ignored. * **Unmatched answers are kept.** Carescale keeps every answer on the lead, word for word, even when it can't match it to a lead field. These optional keys describe the submission instead of answering a question: | Key | Meaning | | - | - | | `form_id` | A stable ID for the form. Without it, Carescale tells forms apart by their set of keys. | | `form_title` or `form_name` | The form's name, shown to staff, for example "Verify insurance". | | `entry_id` or `id` | Your ID for this submission. A second request with the same ID is ignored, which makes retries safe. | | `date_created` | When the person submitted, in UTC as `YYYY-MM-DD HH:MM:SS`, or ISO 8601 with an offset. A late delivery keeps this time. | | `source_url` | The page the form is on. Carescale uses its host to name the site and to allow file downloads. | | `status` | Leave it out. Any value other than `active` is treated as spam and creates no lead. | ## Example ```bash theme={null} curl -X POST "https://your-endpoint-address-from-carescale" \ -H "Authorization: Bearer wfs_your_secret_here" \ -H "Content-Type: application/json" \ -d '{ "form_id": "contact-us", "form_title": "Contact us", "entry_id": "1001", "date_created": "2026-10-12T15:04:05Z", "source_url": "https://www.example.com/contact/", "first_name": "Avery", "last_name": "Collins", "phone": "(512) 555-0100", "email": "avery.collins@example.com", "who_for": "Myself", "preferred_contact": "Text message", "message": "I would like to learn about your programs.", "utm_source": "google", "utm_campaign": "fall-search" }' ``` A `200` answer reads `Received.` ## Who the inquiry is for When someone fills in a form for a loved one or a client, send both people. Carescale makes the person the inquiry is about the lead, and records the person who filled in the form as the caller. * `who_for`: "Myself", "A loved one" or "A client I'm referring". * `first_name`, `last_name`, `phone`, `email`: the person the inquiry is about. * `your_first_name`, `your_last_name`, `your_phone`, `your_email`, `relationship`: the person filling in the form. ## Campaign tracking Send these keys, usually from hidden fields filled from the landing page's address, and Carescale records them on the new lead's referral history: `utm_source`, `utm_medium`, `utm_campaign`, `utm_term`, `utm_content`, `gclid`, `landing_page` Any spelling of these works, such as `UTM Source` or `utmSource`. Values are capped at 2,000 characters. ## File uploads Send an insurance card photo as its URL under `insurance_card_front` or `insurance_card_back`. Carescale links those keys to the lead's insurance card and downloads each file in the background: * HTTPS only, from the same host as `source_url`, with no port and no login. * JPEG, PNG, WebP, HEIC or PDF, at most 20 MB. * At most 3 redirects, each on the same host. * A busy or unreachable site is tried again 10 and then 50 minutes later. * At most 10 files from one submission. Any more show on the lead as not retrieved. A photo fills the lead's empty insurance card slot, and anything else goes to the lead's Documents. A file Carescale couldn't download shows on the lead, so staff know to ask for it. Other URLs are kept on the lead as answers and aren't downloaded. The Gravity Forms snippet is different: it marks every upload field, so all of its uploads are downloaded. The files must stay downloadable for about an hour. Delete them from your site after a day. See the [privacy checklist](/website-forms/privacy-checklist). This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.