Developers
Validations
Reject invalid submissions before they're ever stored, with field-level rules.
How validation works
Validations reject a bad submission before it's ever stored — a missing required field, a malformed email, a value out of range. Rules run per form, right after the honeypot spam check and before duplicate/burst detection, so a bot never learns that validation exists (it still gets a silent fake success), while a real visitor sees exactly what to fix.
Validations are free on every plan — no module or premium tier required.
For safety, each form can have up to five custom regex rules. Patterns are limited to 256 characters, and regex checks are time-bounded; values longer than 10,000 characters fail regex validation.
Validation kinds
| Kind | Parameter | Fails when |
|---|---|---|
| required | — | the field is empty |
| — | the value doesn't look like an email address | |
| min_length | a number | the value is shorter than the minimum (empty values pass — pair with required) |
| max_length | a number | the value is longer than the maximum |
| regex | a pattern | the value doesn't match the pattern |
| number_range | min,max | the value isn't a number in range |
Adding a validation rule
- Open the form: go to the form's detail page and select the Connections tab, then the Validations panel.
- Name the field: use the exact field name the form submits, e.g. email or phone_number.
- Pick a kind and parameter: kinds needing a parameter (min_length, max_length, regex, number_range) show a second input.
- Write the message: shown to the visitor when this rule fails.
curl -X POST https://api.tryembedio.com/v1/forms/frm_xxxxxxxxxx/validations \
-H "Authorization: Bearer sk_live_..." \
-H "Content-Type: application/json" \
-d '{"field": "email", "kind": "email", "param": null, "message": "Enter a valid email address."}'What happens when validation fails
Every failing rule is collected, not just the first — a JS-embedded form gets every error at once instead of a frustrating one-at-a-time reveal. The submission is rejected with a 422 status.
| Request | Response |
|---|---|
| fetch/AJAX (Accept: application/json) | 422 { "error": "validation_failed", "fields": [{ "field": "email", "message": "..." }] } |
| Plain HTML form post | 422, a rendered error page telling the visitor to go back and try again |
Related documents