#x3.lead()

For sites without an own backend: x3.lead() sends the form to X3, which stores the lead, checks it for spam and pushes it to your CRM. Sites with a server keep using leads.create – it accepts the same crm routing.

<script>
  document.querySelector("#contact").addEventListener("submit", (event) => {
    const form = new FormData(event.target);
    window.x3?.lead({
      form: "contact",
      email: form.get("email"),
      firstName: form.get("name"),
      message: form.get("message"),
      // optional: only these CRMs (aliases or names, never ids); false = no CRM
      crm: ["sales"],
    });
  });
</script>

#Switch it on

The SDK sends POST /v1/leads (text/plain JSON with the publishable key, like the conversion beacon). Einstellungen › CRM › „Leads aus dem Browser annehmen“. Until then the endpoint answers 403. Leads are accepted from the project's tracked domains (and the extra origins listed there), at most 3 per minute and IP; a double submit is recorded once.

#Fields

form, email, phone, firstName, lastName, company, message, answers ({questionnaire: {question: option}}), consent: {marketing}, crm, honeypot (your honeypot field had a value – spam), fillMs (time in the form; default: time on the page – under two seconds counts as spam), eventId (dedupe). The SDK adds the visit and the page view so the lead joins its journey.

#Privacy

The contact data travels once over TLS. X3 stores it in plain text only with the project's opt-in (Einstellungen › Erweitert › „Kontaktdaten im Klartext speichern“); otherwise X3 keeps hashes and hands the contact data to the CRM encrypted and transiently. identify() stays hash-only and never creates a CRM contact.