Discussions

When a form instance is created or updated through the API with a value for an option field (dropdown) that is not among the options of the field's form definition, the API does not reject the value. Instead, it adds the value to the option list of the form definition itself. The definition is modified, although the client never called the /v1/form_definitions endpoint.

As a result, a dropdown's option list becomes a record of every value ever written by any client, instead of the curated list defined by the administrator.

Expected behaviour:

Changes to a form definition (including its option lists) should only happen through the form_definitions endpoints. For a value that is not a valid option, we would expect that the request is rejected with a 400 and a clear error, for example {"values":[{"error":"invalid_option", ...}]}. Otherwise, the form definition does not make much sense if it is not enforced.

Actual behaviour:

The request succeeds (201/200), and afterwards the definition's key_definitions[].options contains the new value.