Plexara
What you will take away from this lesson
The supplier form from 703 has its own address. ACME also wants it on a supplier program page the vendor team sends to prospects, and on the vendor section of the company website. Both are a frame around the same form, and every submission lands in the same table whichever page it came from.
Learning Objectives
- 01Name the three places a form can live and who decides each.
- 02Embed a form in a report or dashboard so it works in a shared link.
- 03Put a form on a website an administrator allows.
- 04Choose a bot check provider for a public form and say what each one stops.
- 05Explain the honeypot and the minimum fill time, and read their refusals.
Where this lesson sits
Lesson 703 built the supplier form and its hosted page. This lesson puts the same form in two more places and protects it while it is public.
700 Series: Endpoints and Forms
- 701An automation that answers a requestWhat an endpoint is, the request a handler is handed and the answer it returns, who binds it, the limits a request runs under, and what a caller is told.
- 702A lookup a partner system callsThe three access modes, API keys and per-caller limits, one audit row per request, refusals by reason, signed tokens, and the Endpoints page.
- 703Your first formA form the agent writes: fields, live choices, field-by-field refusals, the checks the platform runs first, the hosted page, and submissions as a table.
- 704Putting the form on your site, or in a reportEmbedding in an asset and on an allowed site, named bot checks, the honeypot, and the minimum fill time.
- 705Sensitive fieldsEncryption before storage, who reads in clear and where, audited reads, exports, and why a file field cannot be sensitive.
- 706From submission to actionAn automation that runs once per submission, validation against live data, bursts and failures, and writes to other systems.
- 707Capstone: the supplier form end to endThe demo tenant’s supplier program assembled: form, page, table, intake automation, and a report joining applications to the warehouse.
The 700 series builds on the automations of the 600 series: an endpoint is an automation that answers a request, and a form is an endpoint that people fill in.
Three places a form can live
The form is the same in each place. What changes is the page around it and who allowed it.
Three places a form can live
Its own address
/forms/<endpoint>
- The platform’s hosted page, linked from an email or a site. Nothing to set up beyond the binding.
Inside an asset
a report or dashboard
- The asset declares the form and frames it. It works wherever the asset opens, shared links included.
On an allowed website
an administrator’s list
- A site frames the hosted page with a snippet the automation’s page offers. The browser refuses any site the binding does not list.
Inside a report or dashboard
Asked for a supplier program page with the form on it, the agent saved an HTML asset that frames the form beside the program’s terms.
Become an ACME supplier, the form inside an asset
<section class="formcard"> <h2>Supplier application</h2> <iframe src="mcp:form:supplier-onboarding" title="Supplier application" loading="lazy"></iframe> </section> references: [ "mcp:form:supplier-onboarding", "mcp://global/brand/acme/logos/acme-logo-reversed.svg", "mcp://global/brand/fonts/archivo-variable.woff2", "mcp://global/brand/fonts/ibm-plex-sans-variable.woff2" ]
The agent built the supplier program page as an HTML asset in the ACME brand: a summary band, how the program works, and the form beside it. The form is written as mcp:form:supplier-onboarding and declared in the asset’s references, and every viewing surface turns that into the form’s page framed inside the asset.
Shared as a link, the page works for a prospect who has never signed in. The query string of the page the asset is opened at is handed to the form, so a link can carry a token or a prefilled value. A form that requires sign-in is told who the reader is; in a public share there is no reader, so such a form refuses there, and only its owner or an administrator may embed it.
On your website
The automation’s page in the portal offers the form’s address and a snippet to paste into a site.
The embed snippet the automation’s page offers
<iframe src="https://mcp-demo.plexara.io/forms/supplier-onboarding"
title="supplier-onboarding" data-platform-form
style="width:100%;border:0" loading="lazy"></iframe>
<!-- followed by a few lines of script that size the frame
to the height the form reports -->The frame shows the hosted page, and the few lines of script size the frame to the height the form reports. The page is served only to the sites in the binding’s allowed origins; the supplier form allows https://www.example.com, and a browser on any other site refuses to show it. Because the binding is an administrator’s, so is the list.
Bot checks
A public form answers anyone, so an administrator decides what a submission must prove before it is accepted.
Admin > Settings > Bot checks: the providers
Proof of work
the platform’s own
- The browser solves a small puzzle before it submits. It calls no third party. It does not stop a program outright, since any program can pay the work; it makes a flood expensive, because the puzzle gets harder as the rate rises.
Turnstile
Cloudflare
- Verified on the server with the provider’s secret key, kept as a stored secret. Stops a caller without a browser.
hCaptcha
- Verified on the server the same way. Stops a caller without a browser.
Bot checks are a named list an administrator manages in the portal, and each public endpoint names the one it uses, so a lookup and a form on the same deployment can use different checks. The demo tenant has two proof-of-work checks: default, used by the store finder, and acme-public-forms, used by the supplier form, each starting at a difficulty of 16 bits and rising to 22 once an endpoint takes more than 30 answers a minute.
Every accepted answer is recorded as used, so it cannot be replayed. A check an endpoint names cannot be deleted; the settings page names the endpoints that use it. Proof of work answers inside an asset; Turnstile and hCaptcha may need the form opened at its own address.
The layers in front of a public form
The bot check is one of four layers. The other three apply to every form whatever its access mode.
The layers in front of a public form
- 1
Bot check
On the methods the binding checks. The supplier form checks POST only, so the page loads without a puzzle and the submission carries the answer.
- 2
Honeypot
Every form has it, whatever its access mode.
- 3
Minimum fill time
Two seconds at least, more when the spec says so.
- 4
Rate limit
The endpoint’s requests a minute on each server, with challenges counted separately so fetching one does not spend the request it guards.
Each layer refusing
A test client sent the supplier form the kinds of submission a careless program sends. Each was refused before the automation ran.
Three refusals on the demo tenant
What the calling system sends. This is the HTTP exchange a test client posing as a careless program has with the endpoint, shown for the technical reader. The calling system sends it on its own; nobody types it.
POST /endpoints/supplier-onboarding no bot check answer
403 {"detail": "the request carries no bot check answer"}
POST /endpoints/supplier-onboarding answered, sent straight after opening
400 {"error": "the submission was refused: the form came back sooner than a person
fills it in; wait a moment and send it again"}
POST /endpoints/supplier-onboarding answered, website field filled in
400 {"error": "the submission was refused: a field people do not see was filled in"}None of the three reached the form’s automation, and none was stored. A person filling the page in never sees any of these: the page solves the bot check for them, takes longer than five seconds, and never shows the honeypot field.
Next: sensitive fields
Key terms
Four terms cover where a form is shown and how a public one is protected.
Key Terms
- Embed
- A form framed inside an asset by its mcp:form reference, or on an allowed website by the snippet its automation’s page offers.
- Allowed origins
- The websites a binding lets frame its form or call its endpoint from a browser.
- Bot check
- A named check an administrator configures, proof of work, Turnstile, or hCaptcha, that a public endpoint requires.
- Minimum fill time
- The seconds after a form opens before a submission is accepted.