Application API: Async Form Submission Callback - Adding Allowlist Validation

With the arrival of Eloqua's 26C release (August 2026), Oracle added an allowlist validation for the Application API for form batch submissions where a callback URL is provided. This will be under Settings > Security Configurations > Domain, under the tab "Async Form Submission Callback”, with the configuration screen currently available for all clients. This allowlist is being enforced with Eloqua 26C.

Note: It is recommended that any domains intended for use as callback URLs be added to the allowlist before the Eloqua 26C release. The allowlist enforcement can also be enabled prior to release 26C by submitting a Oracle Service Request (SR)

When enabled, if the domain for the callback URL is not included within the Async Form Submission Callback domain allowlist, the form submission will be processed, but the form will not notify the callback URL when it has completed with a new response header, "X-Eloqua-Warning", indicating the issue with the domain. In addition, as of now any domains that do not have a valid domain or are pointed at an internal IP address will return a 400 validation error.

New allowlist domain screen:

Allowlist Domain Screen

Allowlist Domain Screen

Impacted endpoint:

POST /api/REST/2.0/data/form/<form ID>/batch

Example:

{

"callbackUrl": "https://www.example.com/callback",

"batchCorrelationId": "BBB61C0B-8B95-4050-8D0F-11A0587E50EF",

"formData": [

{

"correlationId": "BBB61C0B-8B95-4050-8D0F-12A0587E50EF",

"fieldValues": [

{

"type": "FieldValue",

"id": "1",

"name": "firstName",

"value": "John"

},

{

"type": "FieldValue",

"id": "2",

"name": "lastName",

"value": "Snow"

},

{

"type": "FieldValue",

"id": "13",

"name": "Salesperson",

"value": "Sales@oracle.com"

}

]

}

]

}

Response if the domain is not on the allowlist:

201 Created
Content-Type: application/json
X-Eloqua-Warning: field="callbackUrl"; type="AllowedHostnameRequirement"; message="The domain 'example.com' is not on the allowlist and will not be called."

{
    "type": "AsyncFormSubmissionBatch",
    "id": "198",
    "batchCorrelationId": "b12b61c0b-8b95-4050-8d0f-11a0587e5023",
    "callbackUrl": "https://www.example.com/callback",
    "created": [
    ...
}

If the domain is invalid or sending to an internal IP, the form will not be processed. Here is the response when setting the callbackUrl to the invalid domain "http://www.oracletest.com”

400 Validation Error

[
    {
        "type": "ObjectValidationError",
        "container": {
            "type": "ObjectKey",
            "objectType": "AsyncFormSubmissionBatch"
        },
        "property": "CallBackURL",
        "requirement": {
            "type": "AllowedHostnameRequirement",
            "disallowedValue": "www.oracletest.com"
        },
        "value": "https://www.oracletest.com"
    }
]

 

Business Benefits:

  • Improves security around asynchronous form submission callbacks.
  • Gives developers and administrators time to configure callback domains before enforcement.
  • Provides warning headers to help teams identify callback domains that need allowlist updates.

Steps to enable and configure

You don't need to do anything to enable this feature.

Tips and considerations

Recommended Actions:

The callback URL allow list for form batch data callback URLs will be enforced with Eloqua's 26C release. If you are using the Application API endpoint /api/REST/2.0/data/form/<form ID>/batch review any domains used in callback URLs, it is recommended in preparation for Eloqua release 26C (August 2026) to add all domains that will be passed as callback URLs to the domain list. Any domains not added that are used within form submission batches will not receive a callback response from the API. Any integrations using the Application API endpoint /api/REST/2.0/data/form/<form ID>/batch should also be prepared for the response header for domains not on the allow list, and the 400 error response for domains with invalid or no external IP.

If you would like to enable the enforcement of the allow list prior to 26C, please reach out to support with a service request. Prior to the release of 26C if this feature is enabled for your environment through a service request, any domains not on the allow list will return a 400 validation error and the submission will not be processed. After the release of the Eloqua 26C, valid domains not on the allow list will be processed and return the warning in the header.

Tips and Considerations

  • A non-allowlisted callback domain produces a warning header while the form submission is still processed before enforcement
  • Invalid domains or internal IP destinations are blocked with a 400 validation error.

Key resources