Public Insights URLs

Every Share Insights link resolves to a token-scoped route that renders an HTML report by default, or JSON with ?format=json / an Accept: application/json header.

Routes

Both routes are rate-limited (60 requests/minute) and public — no auth token or cookie is required beyond the share token itself and, if set, the password.

curl "https://your-app.test/flex-forms/insights/share/TOKEN?format=json&range=30d"

curl -X POST "https://your-app.test/flex-forms/insights/share/TOKEN/unlock" \
  -H "Content-Type: application/json" \
  -d '{"password": "the-password"}'

curl "https://your-app.test/flex-forms/insights/share/TOKEN?format=json" \
  -H "X-Insights-Password: the-password"

string

default:"7d"

A preset range key (e.g. 7d, 30d) or use with from/to for a custom range.

string

Custom range start (ISO date), used together with to.

string

Custom range end (ISO date).

object

The same Insights filter shape used in the Filament panel (device, country, referrer, UTM, …).

token, allowed_tabs (subset of answers/visits/dropoffs), expires_at, password_protected.

object

id and name of the source form.

object

Only the KPIs relevant to allowed_tabs are populated — everything else is zeroed/emptied server-side, not just hidden client-side.

Show Example JSON response (answers-only share)

{
  "kpis": { "visits": 0, "starts": 0, "submissions": 128, "conversion_rate": 0 },
  "answers": [
    { "field_key": "plan", "label": "Which plan?", "kind": "choice", "answers_count": 128 }
  ],
  "series": [],
  "breakdowns": { "devices": [], "browsers": [], "countries": [] },
  "funnel": [],
  "share": { "token": "TOKEN", "allowed_tabs": ["answers"], "expires_at": null, "password_protected": false },
  "form": { "id": 42, "name": "Customer feedback" }
}

Passwords are never accepted via the query string — only a JSON/form body field, the X-Insights-Password header, or an Authorization: Bearer header. Failed attempts are rate-limited per token + IP and return 429 once exceeded.

An invalid or expired token always returns 404 — Flex Forms does not distinguish “wrong token” from “expired token” in the response, to avoid leaking which is the case.

Does unlocking persist across requests?

Yes, for the browser session that unlocked it (cookie-based). A fresh curl request or a different session must supply the password again.

Can I build my own dashboard against this?

Yes — the JSON shape is stable per allowed tab; poll it on an interval or fetch it server-side and cache it yourself.

APIs & config

Extensibility

Architecture

Public Insights URLs

Routes

​Routes

Routes