API reference
Technical documentation for Farvane's one public endpoint: POST /api/v1/submit. It requires no authentication — the access_key identifies the form.
Reserved fields
These three field names are reserved by Farvane. Don't use them for your own form data.
| Field | Required | What it does |
|---|---|---|
access_key | Yes | The form's UUID. Identifies which form in your account the submission belongs to. If it's missing, not a valid UUID, or doesn't match any form, the request is rejected with 400. |
botcheck | Yes (empty) | Anti-spam honeypot field: it must exist in the form but always arrive empty. If it arrives with content, Farvane treats the submission as spam. |
turnstile_token | Conditional | Only if the form has Cloudflare Turnstile enabled in Settings. If it's missing or fails verification, the request is rejected with 422. |
Every other form field is free-form: any other name you send (name, email, message, or whatever you like) is relayed as-is in the notification email, with no schema validation.
Supported Content-Type
The endpoint accepts both application/json (an object with access_key, botcheck, turnstile_token, and the rest of the fields as properties) and application/x-www-form-urlencoded or multipart/form-data — the result of a native <form> or a FormData. Use whichever fits your integration.
JSON or a 302 redirect
If the request includes the Accept: text/html header (the default for a native browser form submission) and the form has a redirect_url configured in Settings, Farvane responds with 302 Found and that URL in Location. In any other case — a fetch with Accept: application/json, or no redirect_url configured — it responds 200 with JSON.
Note on the honeypot: when botcheck arrives filled in, Farvane responds 200 just like a legitimate submission — it never tips off the bot that it was caught. The submission is not relayed by email; it's stored internally, flagged as spam.
Response codes
| Code | When it happens | Body |
|---|---|---|
200 | Submission accepted (or caught as a honeypot, see the note above). | {"success":true,"message":"Enviado correctamente"} |
302 | Submission accepted, Accept: text/html header, and the form has redirect_url configured. | No body — Location: <redirect_url> |
400 | access_key is missing, not a valid UUID, or doesn't match any existing form. | {"success":false,"message":"..."} |
403 | The form has allowed_domains configured and the request's origin (Origin header, or Referer if Origin is missing) isn't in that list. | {"message":"...","status":403,"timestamp":"..."} |
422 | The form has Turnstile enabled and turnstile_token is missing, blank, or fails verification. | {"success":false,"message":"Verificación de seguridad fallida"} |
429 | More than 20 requests/minute for the same access_key + IP, or the plan's monthly submission quota is exhausted. | {"success":false,"message":"..."} |
The 20 requests/minute limit applies per access_key + IP combination, in the process's memory — it's independent from your plan's monthly quota, a separate limit checked on its own.
Curl example
curl -X POST https://farvane-api.panergos.com/api/v1/submit -H "Accept: application/json" -F "access_key=YOUR_ACCESS_KEY_HERE" -F "botcheck=" -F "name=Ada Lovelace" -F "[email protected]" -F "message=Hola desde curl"Next step: create your account and copy your real access_key.