Built-in rate limits. Unique constraints. No CAPTCHA.
Updated March 2026
Spam wrecks your data. Pollutes analytics, wastes storage, creates noise. Sutrena has several built-in defenses that do not need CAPTCHA or third-party services. uniqueBy constraints, maxSubmissions caps, closesAt deadlines, and per-IP rate limiting on the submit endpoint. Here is how to use them.
1. Use uniqueBy to prevent duplicates
Set uniqueBy on your form. Submissions with a duplicate value for that field get rejected with a 409. Most common use: one submission per email.
curl -X POST https://sutrena.com/api/forms \
-H "Authorization: Bearer st_trial_abc123" \
-H "Content-Type: application/json" \
-d '{
"name": "Waitlist",
"fields": [
{ "name": "email", "label": "Email", "type": "email", "required": true },
{ "name": "name", "label": "Name", "type": "text" }
],
"uniqueBy": "email"
}'
# Duplicate submission returns:
# 409 Conflict
# { "error": "A submission with this email already exists" }2. Set maxSubmissions to cap total entries
Limit how many submissions a form accepts. Once the cap hits, the form returns 410 Gone. Good for limited-slot events or early access.
curl -X POST https://sutrena.com/api/forms \
-H "Authorization: Bearer st_trial_abc123" \
-H "Content-Type: application/json" \
-d '{
"name": "Early Access - 100 Spots",
"fields": [
{ "name": "email", "label": "Email", "type": "email", "required": true }
],
"maxSubmissions": 100,
"uniqueBy": "email"
}'
# After 100 submissions:
# 410 Gone
# { "error": "This form has reached its submission limit" }3. Use closesAt for time-limited forms
Set a deadline. After that time, the form stops accepting submissions. Combine with maxSubmissions for capped, time-limited entries.
curl -X POST https://sutrena.com/api/forms \
-H "Authorization: Bearer st_trial_abc123" \
-H "Content-Type: application/json" \
-d '{
"name": "Flash Survey",
"fields": [
{ "name": "vote", "label": "Your choice", "type": "select",
"options": ["Option A", "Option B", "Option C"], "required": true }
],
"closesAt": "2026-03-10T23:59:59Z",
"maxSubmissions": 500
}'
# After the deadline:
# 410 Gone
# { "error": "This form is closed" }4. Rely on built-in rate limiting
The submit endpoint has per-IP rate limiting. Nothing to configure. One IP sends too many requests, it gets a 429.
# Rate limiting is automatic. If a single IP sends too many
# requests in a short window:
# 429 Too Many Requests
# { "error": "Rate limit exceeded. Try again later." }
# Combine all protections for maximum security:
# - uniqueBy: "email" (one per person)
# - maxSubmissions: 1000 (total cap)
# - closesAt: "2026-04-01" (time deadline)
# - Built-in IP rate limit (abuse prevention)Probably not. Per-IP rate limiting handles bots. uniqueBy handles repeated entries. Unless you have a specific threat model that needs CAPTCHA, most forms do not.
Yes. PATCH the form to update maxSubmissions, closesAt, or uniqueBy anytime. Existing submissions stay.
They stay. The form just stops accepting new ones. Dashboard keeps showing everything collected.
No. The rate limit is uniform. If you need to submit many entries programmatically (like importing data), use the authenticated API with your key -- it has higher limits.
Yes. Set uniqueBy to any field name. uniqueBy: "phone" prevents duplicate phone numbers, for example.
Sutrena is the web runtime for AI agents. Three primitives — pages, forms, and dashboards — accessible through one API. Your agent creates web artifacts, humans interact with them, and your agent gets the data back. Framework-agnostic. Works from any MCP client or HTTP client.
1. Get a trial key (no auth, no signup)
curl -X POST https://sutrena.com/api/trial2. Create a form + dashboard from a template
curl -X POST https://sutrena.com/api/forms \
-H "Authorization: Bearer st_trial_xxx" \
-H "Content-Type: application/json" \
-d '{"templateId": "waitlist", "createDashboard": true}'Get a trial API key instantly with no signup, or create an account for the full experience.