List a flow's submissions

GET 
/v1/flows/:flow_id/submissions

Every submission on this flow as the canonical submission record, oldest-updated first. Paginated with an opaque cursor: follow next_cursor until has_more is false. ?format=csv (or Accept: text/csv) returns every matching submission as a single CSV download instead — unpaginated by contract, so limit/after together with it are a 400. 404s for a flow this key cannot see — either it does not exist, or it belongs to another organisation and the caller has no submissions on it. Requires the submissions:read scope.

Request

Responses

200

One page of submissions as JSON (default) — or, when ?format=csv or Accept: text/csv asks for it, every submission matching the filters as a single CSV download, unpaginated.

400

An unrecognised query parameter (code: unknown_parameter), a malformed flow_id, a parameter value this endpoint will not accept, or limit/after combined with CSV mode (code: invalid_parameter).

401

Missing, malformed, unknown, revoked, or expired key — one body for all of them (code: unauthorized), with WWW-Authenticate: Bearer realm="hop".

403

The key lacks the scope (code: insufficient_scope), named in WWW-Authenticate: Bearer error="insufficient_scope", scope="…".

404

No such flow — either it does not exist, or it belongs to another organisation and the caller has no submissions on it. Both cases answer identically (code: not_found): no existence oracle.

429

Over a bucket. Obey Retry-After (seconds); RateLimit-* fields are informational.

Response Headers

RateLimit-Limit

Requests allowed in the current window. Informational.

RateLimit-Remaining

Requests left in the current window. Informational.

RateLimit-Reset

Seconds until the window resets. Informational.

Retry-After

Seconds to wait before retrying. The binding contract.