--- title: "Basin Integration" description: "Basin is a no-code form backend: point an HTML form at a Basin endpoint and it handles storage, spam filtering and notifications. Agents read and manage submissions, forms and projects, submit entries, and react to every new submission through a signed webhook." url: https://flowrunner.ai/integrations/basin date_modified: 2026-09-04T19:08:45-07:00 --- # Basin [Forms](https://flowrunner.ai/integrations/category/documents-forms) Basin is a no-code form backend: point an HTML form at a Basin endpoint and it handles storage, spam filtering and notifications. Agents read and manage submissions, forms and projects, submit entries, and react to every new submission through a signed webhook. [Verified](https://flowrunner.ai/integrations/verified "What does verified mean?") · 1 trigger · 27 actions · API key · available [Basin website](https://usebasin.com/) · [Platform Documentation](https://usebasin.com/) · Capability data verified 2026-08-26 1. On New Submission fires the moment the site's contact form posts to Basin 2. Get Submission returns the metadata the delivery leaves out, including the spam verdict, IP address, and referrer 3. Agent confirms the submission cleared Basin's spam filters and is not a repeat of one already processed 4. Download Submission Attachment pulls the uploaded file into FlowRunner storage 5. The lead and the attachment are written into \[HubSpot\](/integrations/hubspot) against the source page 6. The owning rep is alerted in \[Slack\](/integrations/slack) with the referrer and the form the entry came from 7. The rep decides whether this is a real inbound lead or a misclassification worth correcting in Basin ## What This Integration Enables Basin is for teams who want to keep writing their own HTML and stop maintaining a form server. You point a form's action at a Basin endpoint and the vendor takes over storage, spam filtering, notifications, autoresponses, and outbound delivery. That is a deliberately narrow product, and it means the interesting operational surface is not the form. It is everything that happens to a submission after it lands. FlowRunner agents work both of Basin's surfaces. On the public endpoint, an agent can submit on a visitor's behalf while forwarding the visitor's real IP address, source URL, and user agent, so Basin scores its spam filters against the actual person rather than against a shared automation address. On the management API, agents read submissions with their full metadata, correct spam verdicts in a way that improves later filtering, audit where a form's submissions are being reposted, pause a failing destination, and replay a backlog. These [connectors](https://flowrunner.ai/concepts/connectors) are built and verified against the vendor's official API, down to details the vendor's own troubleshooting table gets wrong. The replay is the operation that reaches other people's systems, and that is where [human-in-the-loop](https://flowrunner.ai/concepts/human-in-the-loop) belongs. ### Without FlowRunner **Two systems, one blind spot**: The site posts to a backend nobody in operations can see into, so lead problems surface as complaints **Spam verdicts nobody revisits**: A genuine inquiry filtered as spam sits in a folder until someone happens to open it **Recovery means asking visitors to resubmit**: When a downstream integration breaks, the entries that arrived during the outage are simply lost work ### With FlowRunner **The backend is part of the workflow**: Every submission is read with its full metadata and routed to the system that owns the next step **Misclassifications get corrected**: An agent surfaces borderline verdicts, and the correction feeds Basin's own spam training **Outages are replayable**: Submissions already stored can be refired to downstream systems once a person decides where they should land ## Use Case Scenarios ### Inbound leads with their context intact A visitor submits the pricing page form. On New Submission fires within seconds, carrying the submitted fields and the submission id but none of Basin's own metadata. The agent calls Get Submission with that id and now has the spam verdict, the submitting IP address, the referrer, and the user agent. It uses the referrer to identify which campaign produced the lead, writes the contact into [HubSpot](https://flowrunner.ai/integrations/hubspot), appends a row to the attribution sheet in [Google Sheets](https://flowrunner.ai/integrations/google-sheets), and posts the lead to the owning rep with the source page named. The rep gets a lead that already knows where it came from. ### A spam queue that gets a second look On a schedule, the agent calls List Submissions filtered to entries Basin flagged as spam in the last day. It reads each one, checks the submitted domain against the customer list and the sender against known contacts, and separates the obvious junk from the entries that look like real people. The borderline set goes to the marketing owner as a short list. When the owner marks one as genuine, the agent calls Update Submission to clear the spam flag, which also feeds Basin's spam training on forms that contribute to it, and then routes the entry into the CRM. The filter gets better because someone corrected it, not because someone rewrote a rule. ### Forms provisioned per client, not per ticket An agency onboards a new client site. The agent calls Create Project to group the client's work, then Create Form for each page that needs a form, setting notification recipients, honeypot and CAPTCHA enforcement, duplicate filtering, retention, and the allowed domain list in the same call. It returns the UUID for each new endpoint so the site build can wire the form action immediately, and files the endpoint list in [Notion](https://flowrunner.ai/integrations/notion) for the delivery team. Setup that used to be a dashboard session per form becomes one run. ## Human-in-Loop Highlight Refire Webhooks For Submissions is the recovery path after a downstream service was unavailable, and it is also the operation most likely to do real damage, because it does not target one destination. It queues every enabled webhook on the form to fire again for every submission in the batch. A form that reposts to a CRM, an autoresponder relay, and an ad platform will repost to all three, and a replay of a two day backlog can mean hundreds of duplicate records and hundreds of emails that visitors already received. Nothing recalls them. So the recovery agent stops before it refires. It calls List Form Webhooks first, reads `failure_count` and `last_failure_at` on each destination, and posts what it found: "412 submissions arrived on the Contact form between Tuesday 09:10 and Wednesday 14:30. Three webhooks are enabled on this form. The CRM endpoint has 412 failures since Tuesday. The autoresponder and the ad pixel show zero failures, so they already received all 412. Refiring sends to all three. Disable the two healthy webhooks first and replay only to the CRM, or replay to all three?" The operations owner answers, the agent uses Update Form Webhook to switch off the destinations that already succeeded, runs the replay, and switches them back on. The agent identified the outage window, the failure counts, and the safe sequence. The choice to resend to somebody else's inbox stayed with a person. Agent processes routinely Detects exception requiring judgment Clear match Continues automatically Ambiguous Routes to human via email Human decides Agent resumes with decision ## Agent Capabilities 27 actions ### Submitting Entries 2 - **Submit Form Entry** Posts a submission to a Basin form endpoint, the same URL a website's HTML form posts to, addressed by the form's UUID rather than its numeric id. Supply the original visitor's IP address, source URL, and user agent so Basin applies its normal spam checks against the real person instead of against FlowRunner's shared address. - **Submit Form Entry With Attachment** Posts a submission carrying a file, as a multipart request exactly as a browser would send it. The file is fetched from a URL, so it can come from FlowRunner storage or anywhere reachable. Name the file part after the form's own file input, or use the multiple file convention when one input accepts several. ### Forms 5 - **List Forms** Lists the forms the API key can reach, with each record carrying both identifiers a workflow needs: the numeric id for the management routes and the UUID for the public endpoint, alongside inbox, spam, and trash counts. - **Get Form** Reads one form's full configuration by numeric id, covering identity and routing, notifications, autoresponses, spam and CAPTCHA flags, retention, and its submission counts. - **Create Form** Creates a new form endpoint inside a project and returns the UUID its public endpoint will use. Only the name is required, and every other setting falls back to the account default, which makes it the provisioning step in a site onboarding workflow. - **Update Form** Updates an existing form's settings, changing only the fields supplied. The three notification recipient lists behave differently from the rest: leaving one empty keeps the current recipients, supplying addresses replaces them, and supplying a single space removes every recipient. - **Delete Form** Permanently removes a form endpoint and every submission stored against it, and the endpoint stops accepting posts immediately. To stop collecting without losing data, update the form or set a retention period instead. ### Submissions 4 - **List Submissions** Lists a form's submissions with filtering by state, free text search, ordering, and a date range. Each record carries the submitted values alongside Basin's metadata: read, spam, and trash flags, the spam reason, the submitting IP address, referrer, user agent, and attachments. - **Get Submission** Reads one submission by numeric id with every piece of metadata Basin recorded. This is the natural follow up to the trigger, whose delivery carries the submitted fields but not the verdict or the visitor context. - **Update Submission** Changes a submission's state flags for spam, read, and trash. Marking a submission as spam or not spam also feeds Basin's spam training on forms that contribute to it, so a correction here improves later filtering rather than just fixing one row. - **Delete Submission** Permanently removes a submission and its stored attachments. This is a hard delete rather than a move to the trash, so use Update Submission with the trash flag when recovery should stay possible. ### Webhook Replay 2 - **Refire Submission Webhooks** Queues every enabled webhook on a submission's form to fire again for that one submission, without the visitor resubmitting anything. The single entry recovery path after a downstream outage or a corrected webhook URL. - **Refire Webhooks For Submissions** Queues every enabled webhook to fire again across a batch of submissions in one call. The efficient way to replay a backlog, and the operation this page's human gate exists for, because it reaches every destination on the form rather than only the one that failed. ### Attachments 1 - **Download Submission Attachment** Downloads a file uploaded through a Basin form into FlowRunner storage and returns a URL later steps can use. A URL on Basin's own domain is fetched with the connection's key attached so proxied attachments work, and a URL anywhere else is fetched without it. ### Outbound Webhooks 5 - **List Form Webhooks** Lists the webhooks configured across reachable forms, with each record reporting its target URL, payload format, spam setting, enabled state, and recent health in the failure counters. The audit step before any replay. - **Get Form Webhook** Reads one webhook by numeric id with its target, settings, and failure history. The signing secret is deliberately not returned by Basin's API and can only be revealed in the vendor's dashboard. - **Create Form Webhook** Adds a webhook so Basin reposts each submission to a URL of your choice, with a documented retry policy and a signature header the receiving endpoint can verify. To start a FlowRunner flow from new submissions, use the trigger instead, which manages its own webhook. - **Update Form Webhook** Updates a webhook, changing only the fields supplied. Switching it off is the safe way to pause deliveries while a downstream service is unavailable, because the webhook and its signing secret survive and no retries accumulate. - **Delete Form Webhook** Permanently removes a webhook and destroys its signing secret with it, so recreating it later produces a new secret the receiving endpoint must be updated to expect. Prefer disabling when the pause is temporary. ### Projects and Domains 6 - **List Projects** Lists the projects the API key can reach. A project groups related forms and is what team access and custom SMTP servers are assigned against. - **Get Project** Reads one project by numeric id, used to confirm it exists and resolve its name before creating forms inside it. - **Create Project** Creates a project to group related forms, and returns the numeric id that Create Form takes. The first step when onboarding a new site or client. - **Update Project** Renames an existing project. The forms inside are untouched and keep working, because a form's endpoint URL derives from its own UUID rather than from its project. - **Delete Project** Permanently removes a project, and removes any forms and submissions still inside it. Move anything worth keeping into another project first. - **List Domains** Lists the verified custom email sending domains available to the account. The numeric id returned here is what Create Form and Update Form take when notifications should come from your own address. ### Legacy Form Views 2 - **List Form Views** Lists form views, the read only records of forms built with Basin's retired builder. These exist only for accounts that used it before Form Studio replaced it. - **Get Form View** Reads one legacy form view by numeric id. Forms created in Form Studio have no form view, and their field definitions are not exposed by any public Basin endpoint. ## Triggers 1 triggers ### Event Triggers 1 - **On New Submission** Fires when someone submits the chosen Basin form. FlowRunner registers the webhook when the trigger is switched on and removes it when it is switched off, so nothing needs configuring in the Basin dashboard. Only submissions that passed Basin's spam filters arrive unless spam is explicitly included. The delivery carries the submitted values, the submission id, and any attachments, but not the spam verdict, IP address, or referrer, so follow it with Get Submission when the flow needs those. ## Frequently Asked Questions ### What can FlowRunner do with Basin? FlowRunner agents can run Submit Form Entry, Submit Form Entry With Attachment, and List Forms in Basin, plus 24 more actions. ### Does connecting Basin to FlowRunner require OAuth? No. Basin connects to FlowRunner with an API key, no OAuth flow required. ### Can Basin trigger a FlowRunner workflow automatically? Yes. Basin supports 1 trigger that can start a FlowRunner workflow automatically. **Work at Basin?** This integration exposes Basin to AI agents on every FlowRunner plan, including through MCP, at no cost to you. [See what FlowRunner offers integration partners](https://flowrunner.ai/integrations/partners), including how to keep this page current. --- Markdown version of https://flowrunner.ai/integrations/basin. Site index: https://flowrunner.ai/llms.txt