A held response was accepted into quarantine: the form requires verified respondents and this request wasn't verified. That covers a missing identity, a missing or invalid hash, or a workspace with no usable identity secret. While it's held, it isn't delivered to normal downstream consumers.
Find the response
Open the form's Responses area and switch to the Held view. Review the submitted answers and the identity context. From there, an authorized workspace member can release a legitimate response or delete it.
Releasing sends the response through the normal delivery path. That can fire enabled email, webhooks, direct integrations, and Zapier — so repair those destinations before you release a backlog. Deleting a held response is permanent.
Repair identity signing
Generate the respondent hash on your server with the current workspace identity secret. Sign the stable respondent ID exactly the way the SDK contract specifies, then pass that same ID and the resulting hash to the renderer.
import { createHmac } from "node:crypto";
const hash = createHmac("sha256", process.env.FILLO_IDENTITY_SECRET!)
.update(user.id)
.digest("hex");Don't generate the hash in browser code or expose the identity secret through a public environment variable. Common culprits: whitespace, accidental encoding changes, a stale secret, or different IDs between server render and client hydration.
When quarantine applies
Quarantine follows the form policy and fails closed, even before identity verification is configured. Without a usable workspace secret, every request counts as unverified and every new submission is held. A page-supplied ID without a valid signature isn't trustworthy. And forms with person-keyed update behavior need a verified identity before Fillo will read or overwrite that person's standing response.
Held responses stay out of the ordinary response grid, exports, notifications, webhooks, and integrations until you release them. Release is an operational action, not just a display change.
Related
- Trust and verification: Configure identity quarantine and release behavior.
- Respondents and identity: Pass signed account context from your product.
- Response limits: Require verified identity for update-in-place repeats.