707 - Capstone: the supplier form end to end

• 701An automation that answers a requestWhat an endpoint is, the request a handler is handed and the answer it returns, who binds it, the limits a request runs under, and what a caller is told.
• 702A lookup a partner system callsThe three access modes, API keys and per-caller limits, one audit row per request, refusals by reason, signed tokens, and the Endpoints page.
• 703Your first formA form the agent writes: fields, live choices, field-by-field refusals, the checks the platform runs first, the hosted page, and submissions as a table.
• 704Putting the form on your site, or in a reportEmbedding in an asset and on an allowed site, named bot checks, the honeypot, and the minimum fill time.
• 705Sensitive fieldsEncryption before storage, who reads in clear and where, audited reads, exports, and why a file field cannot be sensitive.
• 706From submission to actionAn automation that runs once per submission, validation against live data, bursts and failures, and writes to other systems.
• 707Capstone: the supplier form end to endThe demo tenant’s supplier program assembled: form, page, table, intake automation, and a report joining applications to the warehouse.

acme-public-forms

bot check, administrator

A proof-of-work check created in Admin > Settings > Bot checks for the form.

acme-supplier-onboarding

form automation, agent

form_spec with twelve fields and live choices; form_submit checking the tax ID, the code of conduct, and repeat applications. Version 2.

/forms/supplier-onboarding

binding, administrator

Public with the bot check on submission, an allowed site, a 10 MB body, and the administrator persona allowed to decrypt.

form-supplier-onboarding

source and table, made by the binding

One row per accepted application in webhook_form_supplier_onboarding; certificates in the source’s library.

Become an ACME supplier

asset, agent

The program page with the form framed inside it, shared as a link with prospects.

acme-supplier-intake

event automation, agent

Runs once per application, adds store and category facts from the warehouse, posts to the operations feed.

Supplier pipeline

report, agent

The applications joined to stores, regions, and categories.

1. 1

   The page opens

   form_spec runs and reads 50 categories and 303 stores from the warehouse; the platform signs the spec into a token.

2. 2

   The supplier submits

   The page solves the proof-of-work check. The platform checks the token, the honeypot, the five-second fill time, and every field.

3. 3

   form_submit decides

   The tax ID’s shape, the code of conduct, and a query of the stored applications for a repeat. A refusal goes back to the page beside its field.

4. 4

   The application is stored

   The tax ID is encrypted, the certificate saved to the library, and the application written as one event before the supplier sees the confirmation.

5. 5

   The intake run follows

   Seconds later, acme-supplier-intake reads the event, looks up the store and category, and posts to the operations feed with a link to its run.

6. 6

   The report reads the table

   The supplier pipeline report joins every application to the warehouse.

→ trino_query   connection acme
  WITH apps AS (
    SELECT CAST(json_extract_scalar(payload, '$.values.pilot_store') AS integer) AS store_id,
           CAST(json_extract_scalar(payload, '$.values.category') AS integer)    AS category_id,
           CAST(json_extract_scalar(payload, '$.values.annual_volume_usd') AS double) AS volume
    FROM scratch.uploads.webhook_form_supplier_onboarding)
  SELECT r.region_name AS region, count(*) AS applications,
         count(DISTINCT a.category_id) AS categories, sum(a.volume) AS expected_annual_volume_usd
  FROM apps a
  JOIN warehouse.public.stores s  ON s.store_id = a.store_id
  JOIN warehouse.public.regions r ON r.region_id = s.region_id
  GROUP BY r.region_name ORDER BY applications DESC

← region        applications  categories  expected_annual_volume_usd
  West                     9           8                   4,370,000
  Southeast                7           6                   3,520,000
  Midwest                  7           7                   3,425,000
  Mid-Atlantic             5           5                   1,390,000
  Northeast                4           4                   2,700,000
  Southwest                4           4                   1,460,000
  Northwest                1           1                     180,000

applications stored, each answered by one intake run

37

expected annual volume across applicants

$17.0M

regions with a pilot request

7 of 8

tax IDs readable in the table

0

Intake runs

37 runs with the trigger event, all succeeded, between a quarter of a second and a second and a half each.

Refused before storing

Two malformed tax IDs and one repeat application answered 422; one honeypot, one early submission, and one missing bot check answered 400 or 403.

Siblings on the Endpoints page

The store finder (127 requests over a day, 14 refused at its bot check) and the partner stock lookup (169 requests from one key, 31 refused) beside the form.

From a website

Store finder requests, answered under a proof-of-work check.

From a partner

Stock lookups with an API key, under a per-caller rate.

From people

Supplier applications through a hosted page and a page that embeds the form.