> For the complete documentation index, see [llms.txt](https://docs.acpt.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.acpt.io/developers/actions/acpt-form-authorize_submission.md).

# acpt/form/authorize\_submission

Allow or reject a whole front-end form submission before anything is saved

**Type:** Filter

{% hint style="info" %}
Available since ACPT 2.1.1.
{% endhint %}

Runs when a visitor submits one of your front-end forms, **after** validation and **before** anything is written to the database (posts, terms, users, meta fields, custom content type records). Use it to plug your own authorization rules into ACPT Forms, for example to require a WordPress capability before a form can create or edit content.

Return a `WP_Error` (or `false`) to reject the submission: nothing is saved, no email is sent and the error message is shown on the form.

### Parameters

| Parameter  | Type             | Description                                                                                                                                                      |
| ---------- | ---------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `$allowed` | `bool\|WP_Error` | `true` by default                                                                                                                                                |
| `$form`    | `FormModel`      | The form being submitted                                                                                                                                         |
| `$data`    | `array`          | The sanitized submitted values, one entry per form field (`id`, `name`, `type`, `value`, `extra`, …)                                                             |
| `$target`  | `array`          | What the submission writes to: `action` (the form action, e.g. `FILL_META` or `FILL_TABLE`), `postId`, `termId`, `userId`, `recordId` (each `null` when not set) |

**Return:** `true` to allow the submission, `false` or a `WP_Error` to reject it. With a `WP_Error`, its message is shown to the visitor.

### Usage

```php
use ACPT\Core\Models\Form\FormModel;

add_filter("acpt/form/authorize_submission", function($allowed, FormModel $form, array $data, array $target){
    // only users who can publish posts may use the "Submit an article" form
    if ($form->getName() === 'submit-article' && !current_user_can('publish_posts')) {
        return new WP_Error('acpt_not_allowed', 'You are not allowed to submit articles.');
    }

    return $allowed;
}, 10, 4);
```

### What ACPT already checks

Before this filter runs, ACPT has already applied its own rules:

* the form's [Submission limits](/forms/manage-forms/submission-limits.md);
* `edit_post`, `edit_term` or `edit_user` when the form updates an existing post, term or user;
* the create/update [permissions](/permissions-manager/custom-content-types.md) of a custom content type table the form writes a record to;
* the permissions of each field or table column (see [`acpt/form/authorize_field`](/developers/actions/acpt-form-authorize_field.md)).

Creating a **new** post is not tied to a WordPress capability, so that guest submission forms keep working. If you want to require one, do it with this filter.