Validation rules

Validation stops a form being submitted (or moving to the next step) until answers follow your rules. Rules are checked in the respondent’s browser as they type and again on the server when they submit, so they can’t be bypassed.

Add a rule

1. Open the question and go to the Validation tab.
2. Select Add a rule, or a Quick add chip.
3. Choose the Rule and enter its value.
4. Optionally change the Error message. Use {value} to include the rule’s value, as in “Must be at least {value} characters”.
5. Select Add another rule to stack more. All rules must pass.

Each rule is summarised in plain words on the question card, for example “At least 10 characters” or “Same answer as ‘Email address’”.

All rules

Rule	Passes when the answer…	Default message
Min length	has at least N characters	Must be at least {value} characters
Max length	has at most N characters	Must be no more than {value} characters
Min value	is N or more	Must be at least {value}
Max value	is N or less	Must be no more than {value}
Greater than (>)	is more than N	Invalid input
Less than (<)	is less than N	Invalid input
Greater than or equal (≥)	is N or more	Invalid input
Less than or equal (≤)	is N or less	Invalid input
Exactly equals	is exactly this value	Invalid input
Does not equal	is anything except this value	Invalid input
Regex pattern	matches a regular expression	Please match the required format
URL format	is a valid web address	Please enter a valid URL
Contains text	includes this text	Invalid input
Does not contain	doesn’t include this text	Invalid input
Starts with	begins with this text	Invalid input
Ends with	ends with this text	Invalid input
Matches another field	is the same as another question’s answer	Fields must match

Write your own message for any rule marked Invalid input. It tells respondents what to fix.

Required isn’t in this list. Use the Required switch in the question’s footer.

Which rules each type offers

Question type	Rules
Text Input	Min/Max length, Regex pattern, Contains, Does not contain, Starts with, Ends with, Exactly equals, Does not equal, URL format, Matches another field
Long Text	Min/Max length, Regex pattern, Contains, Does not contain, Matches another field
Email	Min/Max length, Contains, Does not contain, Exactly equals, Does not equal, Matches another field (format is always checked)
Phone	Min/Max length, Regex pattern, Contains, Does not contain, Exactly equals, Does not equal, Matches another field
Number	Min/Max value, >, <, ≥, ≤, Exactly equals, Does not equal, Matches another field
Dropdown, Radio Buttons, Checkboxes, Multi-Select, Date Picker, Time Picker	Exactly equals, Does not equal, Matches another field
Rating	Min/Max value, Exactly equals, Does not equal
NPS, CSAT, CES	Min/Max value
File Upload	File types and sizes instead of rules. See File Upload.
Others	No answer rules. “This question type has no answer rules.”

Regex pattern examples

Need	Pattern
Letters only	^[A-Za-z ]+$
Indian mobile (10 digits, starts 6–9)	^[6-9]\d{9}$
PAN number	^[A-Z]{5}[0-9]{4}[A-Z]$
Employee ID like EMP-1234	^EMP-\d{4}$
6-digit PIN code	^[1-9]\d{5}$

If a pattern has a mistake you see “This pattern is invalid — the rule won’t run until it’s fixed.”

Unique answers

Turn on Unique submission value in the Validation tab to reject an answer that an earlier response already used. Good for registration numbers, employee IDs, email addresses and ticket numbers. On an optional question, uniqueness is only checked when someone enters a value.

Limits linked to variables

Minimum and maximum values can come from a variable instead of a fixed number. For example, Amount to withdraw can’t exceed a calculated available balance. Date limits work the same way. See Date Picker.

External API validation

Check an answer against your own system before the form can be submitted. For example: is this membership number active, is this coupon valid, does this GST number exist?

Open the question, then Advanced → External Validation, and turn on Enable validation. The editor has five tabs:

Tab	Settings
Connection	API Endpoint URL (the full address), HTTP Method (POST or GET), Field Value Key: the JSON key the answer is sent under, such as licenseKey.
Auth	Authentication Type: No Authentication, Bearer Token (sent as Authorization: Bearer [token]), Basic Auth (Username and Password), or Custom Header (Header Name such as x-api-key, and its Token / Value).
Headers	Custom HTTP Headers: any extra headers your API needs. Add Header.
Payload	Extra Payload Parameters: other values to send, each a Static Value or another question’s answer (Form Field ID). Add Param.
Response	How to decide pass or fail: Search Path (JSON Path) to the value to check, such as data.isValid (empty means the whole response), and the Validation Logic: Is True, Equals String, Not Equals String, Contains String, Not Contains String, Matches Regex Pattern, Greater Than (Number), Less Than (Number), or Field Exists / Not Null. Plus the Success Message and Failure Message respondents see.

Then choose Run validation:

• Automatic: “Runs when the respondent leaves the field.”
• Verify button: “The respondent clicks a button to run the check.” Set the Button name, which defaults to Verify.

Your secrets stay private

Tokens, passwords and headers are stored on the server and removed from the form before it’s sent to respondents’ browsers. The check is made from KyraForm’s servers, so your API must be reachable from the internet.