Form submission using POST menthod

[Amit_Jain]

Is it possible to hit an form endpoint to submit the form? I was trying to do that using following URL:

https://xxxx.marketo.com/index.php/leadCapture/save2?formid=1234&munchkinId=xxx-xxx-xxx

but I'm getting error that form is not found? I also checked the documentation and found that it's not allowed to server side positing the data to a form.

Is there any other way to achieve this?

We are trying to integrate ManyChat.com with marketo and there is an option to post the data to en external system directly like a Marketo webhook. I can use the /lead REST API to creaeteOrUpdate but there will be an issue with the token since it's work just like Marketo webhook.

Thanks in advance for your input on this.

Regards,
Amit

[Arpit_Arora]

Hi Guys,

Munchkin ID and Form ID are available on every Marketo LP by using that value anyone can create the spam leads in any marketo instance using the above method. Is there any way to stop that?  /save or /save2 should not work directly and do not create any lead?

Thanks!

[SanfordWhiteman]

That's the way the Marketo forms endpoint works, Arpit.  (And the way any forms endpoint that doesn't specifically require a CSRF token works, not that's it's difficult to simulate a CSRF token.)

[Arpit_Arora]

Thanks Sanford Whiteman‌, But I am not sure what are CSRF tokens and how it is connected to Marketo form submit.

[Amit_Jain]

Hi Arpit,

As Sanford mentioned, there is no CSRF (Cross-site request forgery) requirement for the marketo forms.

For your information, A CSRF token is a unique, secret, unpredictable value that is generated by the server-side application and transmitted to the client in such a way that it is included in a subsequent HTTP request made by the client. When the later request is made, the server-side application validates that the request includes the expected token and rejects the request if the token is missing or invalid.

CSRF tokens can prevent CSRF attacks by making it impossible for an attacker to construct a fully valid HTTP request suitable for feeding to a victim user. Since the attacker cannot determine or predict the value of a user's CSRF token, they cannot construct a request with all the parameters that are necessary for the application to honor the request.

Regards,

Amit

[SanfordWhiteman]

Yes, and more to the point: for demand gen forms CSRF tokens make no sense, because there's no boundary between the authorized session and an unauthorized session on another domain.

[Jay_Jiang]

https://xxxx.marketo.com/index.php/leadCapture/save2?formid=1234&munchkinId=xxx-xxx-xxx

You should be including the parameters in the body of the POST. Adding it to the URL is GET.

You can post to save2 server side (apparently you just need to add "formVid"). But warning that the anonymous IP address will be that of the server's and any inferred data will be incorrect.

CURL example in php

<?php
$fields = [
 'formid'=>1234,
 'formVid'=>1234,
 'munchkinId'=>'xxx-xxx-xxx',
 'Email'=>'abc@cba.com' // Email not email
];
$payload = '';
foreach($fields as $k=>$v) { $payload .= $k.'='.$v.'&';}
$payload = rtrim($payload , '&');
$ch = curl_init('https://xxxx.marketo.com/index.php/leadCapture/save2');
curl_setopt($ch, CURLOPT_POST, 1);
curl_setopt($ch, CURLOPT_POSTFIELDS, $payload);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
$result = curl_exec($ch);
curl_close($ch);
?>‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍

[rajanikantsaner]

hI @Jay_Jiang : Where I will find this curl_init URL . how its generated?

I just tried with replace my marketo instance name with "https://xxxx.marketo.com"but its not working its show me following error message

{"error":true,"errorCode":400,"message":"Form error, no subscription ID"}

Thanks in advanced.

[SanfordWhiteman]

Using the forms /save endpoint in this way is now formally deprecated. So please don't consider this route. What, exactly (spare no detail) are you trying to do?

[rajanikantsaner]

@SanfordWhiteman  thanks for the quick reply.

We want to push the data using website custom form to marketo specific form using php.  We tried to figure out how to do that. (Store method might be curl , soap or rest api ) previously we do it using curl in PARDOT and I am new to marketo so stuck on this.

I found soap api syncLead using php its stored data but we want to store data within specific web form which we have created.

so we have track from which website form data get captured and its eaiser for us we can filter with filloutforms in smart list.

Thanks in advanced!

[SanfordWhiteman]

---

We want to push the data using website custom form to marketo specific form using php.  We tried to figure out how to do but we want to store data within specific web form which we have created. so we have track from which website form data get captured and its eaiser for us we can filter with filloutforms in smart list.

There's no public, supported API endpoint for what you describe at this time. (There's one in the feature pipeline, but it's not public yet.)

Even with such an endpoint, simply consuming rate-limited API (REST or SOAP) calls wouldn't be resilient against DoS attacks: you must introduce a rate limiter within your app, or it will be easily overwhelmed. And you'll always have a limit that's far below the real-world peak, simply because there aren't enough REST/SOAP API calls in a day.

In any case, what you should be doing is using the Forms 2.0 JavaScript API — on the client side — to post a hidden Marketo form with your custom form's values, not trying to do this from the server side. You don't need to cURL anything!

[rajanikantsaner]

@SanfordWhiteman  thanks for the reply.

We want to achieve the following functionality

https://www.zycus.com/knowledge-hub/whitepapers/designing-an-ap-shared-service-center-for-cost-contr...

like we have added custom form after data filled we have push data in to PARDOT using ajax + PHP using different page called. on successful submit we display different content on same page without page refresh as per visitor requirement. Using Form 2.0 javascript how we can do that because we didn't found more customization feature can you please share some example so it will helpful.

Thanks in advanced!

[SanfordWhiteman]

---

wn successful submit we display different content on same page without page refresh as per visitor requirement. Using Form 2.0 javascript how we can do that because we didn't found more customization feature can you please share some example so it will helpful.

---

You can do anything you want after success using an onSuccess listener function.

MktoForms2.whenReady(function(mktoForm){
  mktoForm.onSuccess(function(submittedValues,thankYouURL){
    // `submittedValues` is an Object with the vals just sent
    // `thankYouURL` is the server-generated URL which is decided by Form Editor choices
    // you can do anything you want with these values 

    // make sure to stop the default full-page redirect behavior 
    return false;
  });
});

[rajanikantsaner]

Hi @SanfordWhiteman  thanks for the reply.

Using post method of java script API 2.0 works fine. but I when same thing we try to achieve using CURL code is as follows.

$curlURL = "https://xxxx.marketo.com/leadCapture/save"; // replace with our domain name on marketo
$fields = array('formid'=>1001, 'formVid'=>1001, 'munchkinId'=>'000-GIE-000', 'Email'=>'curlapi.com', 'FirstName'=>'curlapiFname', 'LastName'=>'curlapiLname', 'formName'=>'TOFU_Leads_Form');
$payload = '';

foreach($fields as $k=>$v) {
$payload .= $k.'='.$v.'&';
}

$payload = urlencode(rtrim($payload , '&'));

$ch = curl_init($curlURL);
curl_setopt($ch, CURLOPT_POST, 1);
curl_setopt($ch, CURLOPT_POSTFIELDS, $payload);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
$result = curl_exec($ch);
print_r($result);
curl_close($ch);

I have curiosity why its not working

[SanfordWhiteman]

Since the feature is not supported and will be completely removed next year, it's not worth pursuing further.

[rajanikantsaner]

@SanfordWhiteman thanks 🙂

Can you please help us for few issues as follows

1) We have created Landing page on Marketo and added embed code for forms. before submitting the forms we want to add third party tracking code like we have CTA named "Download" on forms onclick or on forms submission we want to executive that code how we can achieve it.

For Ex. onclick download CTA - tracking code (in Javascript) is - xyz('track', 'DownloadNow');

2) On website forms, we have added background form submission code to submit data to marketo. once someone fills the forms also we are tracking utm parameters,  same time we want to send notification to internal team with forms fills data also tracking UTM parameters. User fills data and UTM parameters get captured properly within Marketo but when we set smart campaign to send notification to internal team we created email template with token of forms fields added within email to send dynamic data but its pulls the previous data and sent within notification.

For. X user comes with UTM parameters like utm_source=XYZ, utm_campaign=123, utm_medium=ABC  its stored within marketo and send in notification email but if next time UTM parameters values changes or UTM parameters are blank then it will not reflected within email notification its will pulled old UTM values from marketo and send in notification email which is wrong.  Can you please suggest how we can achieve this so we can get updated values of UTM parameters it might contain different value or may be blank same should be updated in marketo as well as in notification email.

Waiting for your  reply.

[SanfordWhiteman]

Please open these as 2 new threads in Products rather than updating this thread, thx.

[rajanikantsaner]

sure thanks 🙂

[SanfordWhiteman]

Remember to URL-encode the Email field.  Emails can contain characters that break URL parsing.

[Amit_Jain]

Hi Jay,

What is the purpose of formVid here? When I added this in the request, Marketo accepted it and before I was getting 404?

Regards,

Amit

[SanfordWhiteman]

formVid is simply one of the required fields for the Forms 2.0 /save2 endpoint.

It's not required for the Forms 1.0 /save endpoint.

I recommend using /save because there will be fewer surprises, namely that only /save, last I checked, can be used from a Marketo instance to itself (which is used for deliberate duplicates and for cookie association).