AnsweredAssumed Answered

Form submission using POST menthod

Question asked by Amit Jain on Oct 10, 2019
Latest reply on Oct 22, 2019 by Sanford Whiteman

Like • Show 0 Likes0
Comment • 26

Is it possible to hit an form endpoint to submit the form? I was trying to do that using following URL:

https://xxxx.marketo.com/index.php/leadCapture/save2?formid=1234&munchkinId=xxx-xxx-xxx

but I'm getting error that form is not found? I also checked the documentation and found that it's not allowed to server side positing the data to a form.

Is there any other way to achieve this?

We are trying to integrate ManyChat.com with marketo and there is an option to post the data to en external system directly like a Marketo webhook. I can use the /lead REST API to creaeteOrUpdate but there will be an issue with the token since it's work just like Marketo webhook.

Thanks in advance for your input on this.

Regards,
Amit

No one else has this question

Outcomes

26 Replies

Amit Jain Oct 10, 2019 4:51 AM
Mark Correct
Correct Answer
Sanford Whiteman probably you can help me out here.
Like • Show 0 Likes0
Actions
Sanford Whiteman Oct 11, 2019 12:17 PM
Mark Correct
Correct Answer
You can POST to /save (not /save2).

Use the case-sensitive core fields:
```
   munchkinId
   formid
   retURL (Thank You URL)
   _mkt_trk (Munchkin cookie)
   _mktoReferrer (URL of the page w/form)
```
/save is the same endpoint used by <noscript> form posts from Marketo LPs, so it's not really exotic in any way. While you can't open a Support case about it (like other advanced and/or experimental tactics) it's a reliable part of the Marketo ecosystem, up to its rate limit (30 form posts per second minute per IP).
1 person found this helpful
Like • Show 1 Like1
Actions
- Amit Jain @ Sanford Whiteman on Oct 10, 2019 10:46 PM
  Mark Correct
  Correct Answer
  Thanks Sanford. I tried but it didn't work either in my case.
  Like • Show 0 Likes0
  Actions
  - Sanford Whiteman @ Amit Jain on Oct 10, 2019 11:00 PM
    Mark Correct
    Correct Answer
    Without seeing your code I can't tell you what's wrong. But it's a basic URL-encoded form POST.
    Like • Show 0 Likes0
    Actions
    - Amit Jain @ Sanford Whiteman on Oct 10, 2019 11:57 PM
      Mark Correct
      Correct Answer
      I understand that but there is no code involved here. I have an option on UI in ManyChat like we do in Postman to just select "GET" OR "POST" method and put the endpoint URL. Pretty similar to Marketo's webhook UI.
      Like • Show 0 Likes0
      Actions
      - Sanford Whiteman @ Amit Jain on Oct 11, 2019 12:04 AM
        Mark Correct
        Correct Answer
        So if you put a test URL (i.e. your testing server) what is it POSTing?
        
        Set the server to https://2f6eb214.ngrok.io/ temporarily and then run a couple of tests, I'll tell you what it's sending.
        Like • Show 0 Likes0
        Actions
        Amit Jain @ Sanford Whiteman on Oct 11, 2019 12:07 AM
        Mark Correct
        Correct Answer
        Thank you Sanford Whiteman! But it's working fine now at my end. I'm using following URL:
        https://xxx.marketo.com/index.php/leadCapture/save2?formid=36496&formVid=36496&munchkinId=xxx-xxx-xxx&FirstName=Amit&LastName=Jain&Email=amitjain@ntest.com
        Like • Show 0 Likes0
        Actions
        Sanford Whiteman @ Amit Jain on Oct 11, 2019 12:12 AM
        Mark Correct
        Correct Answer
        That's a GET, not a POST (like Jay said).
        
        Please send a POST to my test endpoint, I'll tell you what it was actually sending.
        Like • Show 0 Likes0
        Actions
        Sanford Whiteman @ Sanford Whiteman on Oct 11, 2019 12:59 AM
        Mark Correct
        Correct Answer
        OK, I stopped my test server for now as you seem to be busy. But you need to make sure you're using POST. GET support could be discontinued at any time; there's no supported Marketo feature that uses it.
        Like • Show 0 Likes0
        Actions
        Amit Jain @ Sanford Whiteman on Oct 11, 2019 3:39 AM
        Mark Correct
        Correct Answer
        Sorry for delayed response Sanford Whiteman.
        
        Please see below screenshot from ManyChat. If you can turn on the server again, that would be really helpful.
        
        Like • Show 0 Likes0
        Actions
        Amit Jain @ Amit Jain on Oct 14, 2019 10:43 PM
        Mark Correct
        Correct Answer
        Hi Sanford Whiteman, please let me know when you will be available to take a look on this? I'll be online the same time.
        
        Regards,
        Amit
        Like • Show 0 Likes0
        Actions
        Amit Jain @ Amit Jain on Oct 14, 2019 11:59 PM
        Mark Correct
        Correct Answer
        I got it now. Sorry I just started learning the API stuff. So I'm using this now:
        
        Endpoint URL with POST method:
        https://app-sxxx.marketo.com/index.php/leadCapture/save2?formVid=36496&munchkinId=xxx-xxx-xxx
        
        Body:
        {
           "FirstName ":"First Name",
           "LastName ":"Last Name",
           "Email ":"Email Address",
           "Dummy_Text_Area_1 ":"Preferred Meeting time",
           "cellPhoneNumber ":"Phone"
        }
        
        Is this looks OK now? Please let me know. Sanford Whiteman Jay Jiang
        
        Edited: When I'm trying this, its making the call in Marketo but it's creating a lead record without any data in it.
        
        But if I pass these in URL parameter instead of Body, it creates lead record with all the details.
        Like • Show 0 Likes0
        Actions
        Jay Jiang @ Amit Jain on Oct 15, 2019 4:40 AM
        Mark Correct
        Correct Answer
        a serialized POST payload is formatted exactly the same as a query string:
        param1=value1&param2=value2&paramN=valueN
        
        You're trying to send an object and marketo doesn't recognize it.
        
        I'm actually confused what you're trying to do/achieve.
        Like • Show 1 Like1
        Actions
        Sanford Whiteman @ Amit Jain on Oct 11, 2019 12:14 AM
        Mark Correct
        Correct Answer
        And in addition, I can see that it isn't URL-encoding, which is bad.
        Like • Show 0 Likes0
        Actions
        Amit Jain @ Sanford Whiteman on Oct 11, 2019 3:44 AM
        Mark Correct
        Correct Answer
        I'm not sure how can I encode the URL here from the UI (see above screenshot). If you have any thoughts on that, please let me know. I'm just trying to see if it's possible to integrate ManyChat with marketo directly but if you think this is not going to work like this, I have Zapier subscription and can use that to pass the data from ManyChat to Marketo.
        
        Thanks again for your help on this.
        
        Best,
        Amit
        Like • Show 0 Likes0
        Actions
- Jep Castelein @ Sanford Whiteman on Oct 11, 2019 9:10 AM
  Mark Correct
  Correct Answer
  Small correction: "30 form posts per minute per IP", not per second
  1 person found this helpful
  Like • Show 0 Likes0
  Actions
  - Sanford Whiteman @ Jep Castelein on Oct 11, 2019 12:20 PM
    Mark Correct
    Correct Answer
    Sorry, yeah, meant that. Fixed.
    Like • Show 0 Likes0
    Actions
Jay Jiang Oct 10, 2019 6:20 PM
Mark Correct
Correct Answer
https://xxxx.marketo.com/index.php/leadCapture/save2?formid=1234&munchkinId=xxx-xxx-xxx

You should be including the parameters in the body of the POST. Adding it to the URL is GET.

You can post to save2 server side (apparently you just need to add "formVid"). But warning that the anonymous IP address will be that of the server's and any inferred data will be incorrect.

CURL example in php
```
<?php
$fields = [
 'formid'=>1234,
 'formVid'=>1234,
 'munchkinId'=>'xxx-xxx-xxx',
 'Email'=>'abc@cba.com' // Email not email
];
$payload = '';
foreach($fields as $k=>$v) { $payload .= $k.'='.$v.'&';}
$payload = rtrim($payload , '&');
$ch = curl_init('https://xxxx.marketo.com/index.php/leadCapture/save2');
curl_setopt($ch, CURLOPT_POST, 1);
curl_setopt($ch, CURLOPT_POSTFIELDS, $payload);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
$result = curl_exec($ch);
curl_close($ch);
?>
```
1 person found this helpful
Like • Show 0 Likes0
Actions
- Amit Jain @ Jay Jiang on Oct 10, 2019 10:48 PM
  Mark Correct
  Correct Answer
  Hi Jay,
  
  What is the purpose of formVid here? When I added this in the request, Marketo accepted it and before I was getting 404?
  
  Regards,
  Amit
  Like • Show 0 Likes0
  Actions
  - Sanford Whiteman @ Amit Jain on Oct 10, 2019 11:01 PM
    Mark Correct
    Correct Answer
    formVid is simply one of the required fields for the Forms 2.0 /save2 endpoint.
    
    It's not required for the Forms 1.0 /save endpoint.
    
    I recommend using /save because there will be fewer surprises, namely that only /save, last I checked, can be used from a Marketo instance to itself (which is used for deliberate duplicates and for cookie association).
    1 person found this helpful
    Like • Show 0 Likes0
    Actions
- Sanford Whiteman @ Jay Jiang on Oct 10, 2019 11:03 PM
  Mark Correct
  Correct Answer
  Remember to URL-encode the Email field. Emails can contain characters that break URL parsing.
  1 person found this helpful
  Like • Show 1 Like1
  Actions
Arpit Arora Oct 15, 2019 7:50 AM
Mark Correct
Correct Answer
Hi Guys,

Munchkin ID and Form ID are available on every Marketo LP by using that value anyone can create the spam leads in any marketo instance using the above method. Is there any way to stop that? /save or /save2 should not work directly and do not create any lead?

Thanks!
Like • Show 0 Likes0
Actions
- Sanford Whiteman @ Arpit Arora on Oct 15, 2019 10:25 AM
  Mark Correct
  Correct Answer
  That's the way the Marketo forms endpoint works, Arpit. (And the way any forms endpoint that doesn't specifically require a CSRF token works, not that's it's difficult to simulate a CSRF token.)
  Like • Show 0 Likes0
  Actions
  - Arpit Arora @ Sanford Whiteman on Oct 22, 2019 12:58 AM
    Mark Correct
    Correct Answer
    Thanks Sanford Whiteman, But I am not sure what are CSRF tokens and how it is connected to Marketo form submit.
    Like • Show 0 Likes0
    Actions
    - Amit Jain @ Arpit Arora on Oct 22, 2019 1:08 AM
      Mark Correct
      Correct Answer
      Hi Arpit,
      
      As Sanford mentioned, there is no CSRF (Cross-site request forgery) requirement for the marketo forms.
      
      For your information, A CSRF token is a unique, secret, unpredictable value that is generated by the server-side application and transmitted to the client in such a way that it is included in a subsequent HTTP request made by the client. When the later request is made, the server-side application validates that the request includes the expected token and rejects the request if the token is missing or invalid.
      
      CSRF tokens can prevent CSRF attacks by making it impossible for an attacker to construct a fully valid HTTP request suitable for feeding to a victim user. Since the attacker cannot determine or predict the value of a user's CSRF token, they cannot construct a request with all the parameters that are necessary for the application to honor the request.
      
      Regards,
      Amit
      Like • Show 1 Like1
      Actions
      - Sanford Whiteman @ Amit Jain on Oct 22, 2019 9:49 AM
        Mark Correct
        Correct Answer
        Yes, and more to the point: for demand gen forms CSRF tokens make no sense, because there's no boundary between the authorized session and an unauthorized session on another domain.
        Like • Show 0 Likes0
        Actions

Form submission using POST menthod

Outcomes

Related Content

Recommended Content