Forms, workspaces & routing
Allowed origins and timezone
Each form can restrict which origins are allowed to submit to it (allowed_origins) and set a timezone for how dates display (time_zone) - both from the dashboard's Settings tab. Leave either unset and the form inherits its workspace's default instead; set your own value on the form to override it. The dashboard always shows the effective value actually in force (its own override if set, otherwise the inherited workspace default) - the section's icon ("+" versus a pencil) tells you at a glance whether the form has its own override or is inheriting.
allowed_origins entries are full origins such as https://you.github.io or http://localhost:5173: scheme, host and port, matched exactly (case-insensitive). No wildcards, so list each subdomain and port separately; any path in an entry is ignored. An empty list (the default) accepts every origin. The check reads the request's Origin header, or Referer when there is none; with a list set, a request that sends neither (curl, a server) gets 403 ORIGIN_NOT_ALLOWED. It stops other websites from posting to your form from a browser; it is not authentication, since a non-browser client can send any header.
Vanity slugs
On Pro plan and higher, a form can have a custom slug (f.bootform.com/contact-acme) instead of its raw UUID - set from the Settings tab. Useful for making a public-facing endpoint look first-party rather than a random ID.
Workspaces
Workspaces group forms together and let you set shared defaults once instead of per form - allowed_origins, time_zone, CAPTCHA, and email-branding removal can all be set at the workspace level and inherited by every form in it. Every account starts with one default workspace; creating additional ones requires Pro plan or higher. A form belongs to exactly one workspace at a time, and can be moved between workspaces you own.
An AI agent connected over MCP can do the same: list and create workspaces, rename them or change their allowed origins and time zone, create a form straight into one, and move a form between them. Deleting a workspace is done in the dashboard.
Form Rules
On Business plan, forms can have conditional rules that route or act on a submission based on its field values - configured from the dashboard's Workflow tab, evaluated in order. A rule pairs one condition with one action:
Conditions: always match, a field is empty, a field is not empty, a field contains a keyword, or a field does not contain a keyword.
Actions: send an email to a specific recipient, tag the submission as spam, or redirect the submitter to a specific URL.
For example: "if department contains housewares, send email to housewares@example.com" routes that one category of submission to a different inbox than the rest.
Rules can't approve or reject submissions for the moderated content feed: every submission still needs your approval before it appears there.
Deleting a form
Delete a form from its Settings tab (Danger zone), from the API (DELETE /forms/{form_id}), or through the MCP bootform_delete_form tool. It is permanent, and there is no undo.
The form disappears immediately: it is gone from your lists and sidebar, stops counting toward the 1,000-form fair-use limit (so you can create a replacement straight away), and its vanity slug is free to reuse. Its submissions, uploaded files and counters are then removed in the background, usually within a few minutes, however many it has. There is nothing to wait for and no completion notice; the Activity page records the request and, when it finishes, the removal.
A deleted form's ID can never be used again. The ID is usually still printed in the HTML of the site the form was on, so posts to it keep arriving. Those posts get 410 Gone (code FORM_DELETED), and a visitor submitting the old page in a browser sees a short "This form no longer exists" page. Nothing is stored, forwarded or counted against your quota, and nobody can claim the old ID to receive them. If you deleted a form by mistake, you can't restore it, but you can create a new one and point your page at the new ID.