Workflow form API

Each stage on your adviser workflow board can have its own form API key. Your web developer uses that key to send new client details from a website form straight into that stage in the adviser portal — no manual data entry.

Keys are created in the portal under Workflows → stage menu → Connect website form.

The form API key belongs to one stage column on one workflow. Every successful submission creates the client and places them in that column. You do not send a workflow id or a stage id.

To send leads into a different column, connect a form on that stage and use that stage’s key. A column with a form connected shows a Form marker on the board.

The response tells you where the client was created: workflowName and stageName.

Send a POST request as JSON, or as multipart form data when you are attaching files. Use your live adviser login host (same domain you use to sign in).

POST https://login.cobaltlicenseesolutions.com.au/api/public/workflow-ingest

Include the stage form API key using either header:

Authorization: Bearer YOUR_FORM_API_KEY

— or —

X-Workflow-Form-Key: YOUR_FORM_API_KEY

The legacy header X-Workflow-Ingest-Key is still accepted.

Content-Type: application/json

{
  "name": "Jane Smith",
  "phone": "0412345678",
  "email": "jane@example.com",
  "source": "client_forms",
  "tags": ["Website", "Priority"],
  "comment": "Asked to be called after 3pm.",
  "comments": ["Second note if you have more than one."],
  "files": [
    {
      "fileName": "statement.pdf",
      "contentType": "application/pdf",
      "contentBase64": "…"
    }
  ]
}

• name (required) — full name
• phone (required)
• email (optional)
• source (optional) — where the lead came from. One of manual, id_verification, client_forms, or document_upload. Labels such as “Client Forms” are also accepted. If you omit it, the client is saved as client_forms.
• tags (optional) — tag names to attach to the new client. Send an array, or one comma-separated string. Up to 20 tags, 40 characters each.
• comment (optional) — one note on the workflow client. Up to 4000 characters.
• comments (optional) — extra notes, same limit, up to 20 in total with comment.
• files (optional) — see Files below. Up to 8 files, 10 MB each.

Tags you send are attached to the client on that adviser's board. If a tag name does not already exist for that adviser, it is created and then attached. Matching is by name, so sending a tag the adviser already uses does not create a duplicate.

Comments are saved on the workflow client and show with the rest of that client's notes. Send one comment, a comments array, or both.

On a multipart form, repeat the field comment or comments for each note.

Files are saved on the client. They appear on the client record and on the workflow client. Accepted types are PDF, images, text, CSV, Word, and Excel.

With JSON, put each file in files as fileName, contentType, and contentBase64.

With multipart form data, send the file in a field named file (repeat it for more than one). files is also accepted. Put name, phone, email, tags, and comments in normal form fields. Tags can be repeated or sent as one comma-separated value.

const form = new FormData();
form.set("name", body.fullName);
form.set("phone", body.phone);
form.set("source", "client_forms");
form.set("tags", "Website,Priority");
form.set("comment", "Asked to be called after 3pm.");
form.append("file", statementPdf);

await fetch("https://login.cobaltlicenseesolutions.com.au/api/public/workflow-ingest", {
  method: "POST",
  headers: {
    Authorization: "Bearer YOUR_FORM_API_KEY",
  },
  body: form,
});

If a file cannot be saved, the client is still created. The response lists that file under fileErrors.

// 200 OK
{
  "ok": true,
  "clientId": "…",
  "placementId": "…",
  "workflowId": "…",
  "workflowName": "Vetting File Check",
  "stageId": "…",
  "stageName": "Vetting",
  "source": "client_forms",
  "tags": [{ "id": "…", "name": "Website" }],
  "comments": [{ "id": "…" }],
  "files": [{ "id": "…", "fileName": "statement.pdf" }],
  "fileErrors": []
}

// Error
{ "ok": false, "error": "…" }

Common status codes: 401 invalid key, 409 client already on workflow, 429 rate limit.

Never put the API key in browser JavaScript. Proxy the submission through your server:

await fetch("https://login.cobaltlicenseesolutions.com.au/api/public/workflow-ingest", {
  method: "POST",
  headers: {
    "Content-Type": "application/json",
    Authorization: "Bearer YOUR_FORM_API_KEY",
  },
  body: JSON.stringify({
    name: body.fullName,
    phone: body.phone,
    email: body.email || undefined,
    source: "client_forms",
    tags: ["Website"],
    comment: "Asked to be called after 3pm.",
  }),
});

• Treat the form API key like a password — store it in server env vars.
• Regenerate the key in the portal if it is ever exposed.
• Use HTTPS only.