Administrators build and manage forms in Drupal Canvas Forms within the Drupal Canvas editor. Define the submission table, its fields, and its policy here. The React component that visitors access is generated separately from the table. This document provides instructions how to open Drupal Canvas Forms, create a form, add and configure fields, and set form options.
Prerequisites
Ensure that you have the Administer Drupal Canvas Forms permission to create, edit, and delete forms.
In the left toolbar, select the Drupal Canvas Forms icon.
The interface displays the most recent form. If no forms exist, the interface displays a welcome page.
A navigation panel opens for each form. The panel includes the Submissions, Connect, Webhooks, Logs, and Settings options. The Privacy option is at the bottom of the panel. To open an existing form, click the list at the top of the navigation panel and select the form.
At the top of the navigation panel, click the form selector dropdown.
Select + New form.
In the dialog box, select a template from the following options:
Blank form: This template contains no predefined fields.
Contact form: This template contains fields for a name, an email address, and a message.
Newsletter signup: This template contains a single field for an email address.
In the Form name field, enter a name.
(Optional): Drupal Canvas Forms derives an API name from the form name. Next to the API name, select Edit to change the machine name. The machine name identifies the form, keys submissions, and appears in the submission endpoint URL. The machine name is immutable after creation.
Select Create form.
The system creates the submission table and opens the form. The form opens to the Submissions page, which displays submissions as rows and the form fields as columns.
Select the column header of the field on the Submissions page.
Open the options menu of the field in the header, and select the Edit.
The right panel opens and displays the following controls:
Control
Description
Field label
Specifies the human-readable label that visitors read.
Property name
Defines the machine name for the field and the key for the stored value. The system locks the property name after the field contains responses because a name modification disconnects existing answers.
Field type
Permits modifications only before the field contains responses. The system locks this setting after the field contains responses because a type modification makes existing answers unreadable. To collect a different type of answer, add a new field and hide or delete the previous field.
Required field
Requires a non-empty value.
Hidden field
Retains the field in the data table but omits the column from the default view.
Contains personal data
Identifies the field as personal data to control redactions during anonymization and data subject requests. The system selects this option by default. Deactivate this setting only to retain specific field values after the system anonymizes a submission, refer to Managing form submissions and privacy.
Note: This setting controls the redacted content during anonymization and data subject requests. Fields are marked as personal data by default. Deactivate this option only for fields to deliberately keep when a submission undergoes anonymization, see Manage Form Submissions and Privacy.
Note
The system automatically saves all field changes.
Certain field types include specific options. For more details, refer to Field types.
The field type determines the input control in the generated form and how the value is validated and stored.
Field type
Stored as
Details and options
Text
String
Up to 1,000 characters.
Email
String
Validated as a real email address, using strict RFC syntax plus a DNS check on the domain. Turn on Business emails only to reject free personal email providers such as gmail.com.
Number
Integer or decimal
Must be numeric.
Long text
String
Multi-line text, up to 10,000 characters.
Checkbox
Boolean
A single on/off checkbox. An unchecked box is stored as false.
Date
String
Must be a valid date in YYYY-MM-DD format.
Single select
String
Must be one of the field's configured options.
Multiple select
List of strings
Consent fields
A Consent field records durable proof of consent for GDPR obligations. After a visitor accepts the terms, Drupal Canvas Forms stores the exact consent text displayed on the form, a hash of that text, and the acceptance timestamp. The configured consent text seeds the generated form component. The system stores the exact text that the visitor views to serve as proof. The system rejects a submission that lacks consent text.
Important
Administrators must never pre-check a consent box because the system rejects submissions without explicit consent.
File upload fields and private storage
The system stores uploaded files in private storage rather than a publicly accessible location. Only a user with the View form submissions permission can download a stored file. Alternatively, a time-limited signed URL provides access after a webhook delivers the submission.
File upload fields require a configured private file system on the site because uploads use private storage. The system disables file uploads if the private file system is unavailable. In this scenario, the generated form displays file fields as unavailable, and the site status report displays an error. Ensure that the private file system is configured for the site before a user publishes a form with a file field.
In the Delete this form, select the delete action.
When prompted to confirm, select Yes, delete.
Important
Deleting a form is permanent. The system permanently deletes the definition, stored submissions, uploaded files, and webhook delivery logs.
Creating and managing forms
Administrators build and manage forms in Drupal Canvas Forms within the Drupal Canvas editor. Define the submission table, its fields, and its policy here. The React component that visitors access is generated separately from the table. This document provides instructions how to open Drupal Canvas Forms, create a form, add and configure fields, and set form options.
Prerequisites
Ensure that you have the Administer Drupal Canvas Forms permission to create, edit, and delete forms.
In the left toolbar, select the Drupal Canvas Forms icon.
The interface displays the most recent form. If no forms exist, the interface displays a welcome page.
A navigation panel opens for each form. The panel includes the Submissions, Connect, Webhooks, Logs, and Settings options. The Privacy option is at the bottom of the panel. To open an existing form, click the list at the top of the navigation panel and select the form.
At the top of the navigation panel, click the form selector dropdown.
Select + New form.
In the dialog box, select a template from the following options:
Blank form: This template contains no predefined fields.
Contact form: This template contains fields for a name, an email address, and a message.
Newsletter signup: This template contains a single field for an email address.
In the Form name field, enter a name.
(Optional): Drupal Canvas Forms derives an API name from the form name. Next to the API name, select Edit to change the machine name. The machine name identifies the form, keys submissions, and appears in the submission endpoint URL. The machine name is immutable after creation.
Select Create form.
The system creates the submission table and opens the form. The form opens to the Submissions page, which displays submissions as rows and the form fields as columns.
Select the column header of the field on the Submissions page.
Open the options menu of the field in the header, and select the Edit.
The right panel opens and displays the following controls:
Control
Description
Field label
Specifies the human-readable label that visitors read.
Property name
Defines the machine name for the field and the key for the stored value. The system locks the property name after the field contains responses because a name modification disconnects existing answers.
Field type
Permits modifications only before the field contains responses. The system locks this setting after the field contains responses because a type modification makes existing answers unreadable. To collect a different type of answer, add a new field and hide or delete the previous field.
Required field
Requires a non-empty value.
Hidden field
Retains the field in the data table but omits the column from the default view.
Contains personal data
Identifies the field as personal data to control redactions during anonymization and data subject requests. The system selects this option by default. Deactivate this setting only to retain specific field values after the system anonymizes a submission, refer to Managing form submissions and privacy.
Note: This setting controls the redacted content during anonymization and data subject requests. Fields are marked as personal data by default. Deactivate this option only for fields to deliberately keep when a submission undergoes anonymization, see Manage Form Submissions and Privacy.
Note
The system automatically saves all field changes.
Certain field types include specific options. For more details, refer to Field types.
The field type determines the input control in the generated form and how the value is validated and stored.
Field type
Stored as
Details and options
Text
String
Up to 1,000 characters.
Email
String
Validated as a real email address, using strict RFC syntax plus a DNS check on the domain. Turn on Business emails only to reject free personal email providers such as gmail.com.
Number
Integer or decimal
Must be numeric.
Long text
String
Multi-line text, up to 10,000 characters.
Checkbox
Boolean
A single on/off checkbox. An unchecked box is stored as false.
Date
String
Must be a valid date in YYYY-MM-DD format.
Single select
String
Must be one of the field's configured options.
Multiple select
List of strings
Consent fields
A Consent field records durable proof of consent for GDPR obligations. After a visitor accepts the terms, Drupal Canvas Forms stores the exact consent text displayed on the form, a hash of that text, and the acceptance timestamp. The configured consent text seeds the generated form component. The system stores the exact text that the visitor views to serve as proof. The system rejects a submission that lacks consent text.
Important
Administrators must never pre-check a consent box because the system rejects submissions without explicit consent.
File upload fields and private storage
The system stores uploaded files in private storage rather than a publicly accessible location. Only a user with the View form submissions permission can download a stored file. Alternatively, a time-limited signed URL provides access after a webhook delivers the submission.
File upload fields require a configured private file system on the site because uploads use private storage. The system disables file uploads if the private file system is unavailable. In this scenario, the generated form displays file fields as unavailable, and the site status report displays an error. Ensure that the private file system is configured for the site before a user publishes a form with a file field.
In the Delete this form, select the delete action.
When prompted to confirm, select Yes, delete.
Important
Deleting a form is permanent. The system permanently deletes the definition, stored submissions, uploaded files, and webhook delivery logs.
Stores every selected option as a list.
File upload
File reference
Requires the private file system. Options include Allow multiple files, Maximum number of files, Max file size (MB), and Other allowed file extensions.
Consent (GDPR)
Boolean plus proof
A required consent checkbox with a Privacy policy URL option and the consent text shown next to the checkbox. Refer to Consent fields.
Click Save settings.
Retention runs automatically in the background.
Did not find what you were looking for?
If this content did not answer your questions, try searching or contacting our support team for further assistance.
Stores every selected option as a list.
File upload
File reference
Requires the private file system. Options include Allow multiple files, Maximum number of files, Max file size (MB), and Other allowed file extensions.
Consent (GDPR)
Boolean plus proof
A required consent checkbox with a Privacy policy URL option and the consent text shown next to the checkbox. Refer to Consent fields.
Click Save settings.
Retention runs automatically in the background.
Did not find what you were looking for?
If this content did not answer your questions, try searching or contacting our support team for further assistance.