umContactManager 1.1.1

Contact Manager

An Umbraco backoffice package for managing contact form submissions, email history, and related CRM workflows. It centralizes incoming leads, spam filtering, outbound email, notifications, and optional AI assistance — with shared validation and security for built-in forms, same-site custom UIs, and external API sources.

Features

Backoffice CRM

• Dedicated Contacts section with Incoming, Archived, Spam, Email History, and Settings views.
• Contact list with search, status and source filters, date range, sortable columns, pagination, and persisted grid layout.
• Bulk actions — send email, archive, and unarchive — plus inline status changes per contact.
• Contact details workspace with full submission history, email thread, compose/reply modal, and attachment handling.
• New activity badges on section tabs for unviewed messages and inbound emails.
• IP → GeoIP lookup popover on submission IP addresses (configurable Simple or Advanced provider).

Lead intake

• Shared submission pipeline for built-in Contact Manager Form, same-site custom forms, and external / remote lead sources (X-API-Key).
• Built-in Contact Manager Form block for Block List / Block Grid — zero-code forms on content pages with a drag-and-drop field picker.
• Same-site custom form endpoint for your own HTML/Razor markup on the Umbraco site (schema + antiforgery helpers included).
• External JSON API for other sites, landings, and headless or backend clients — multi-site intake via configurable lead sources.
• Inbound email via Postmark webhooks — customer replies create or update contacts and thread into the email history.
• Automatic contact creation from inbound emails, with configurable ignored sender domains.

Form fields and validation

• Configurable form field catalog — Text, Url, Select, and File field types with labels, tokens, required flags, and per-channel aliases.
• Standard fields built in: Name, Email, Company, Message, PageUrl, Site — plus page tracking (landing page, page history).
• Field-level controls for backoffice visibility, email token inclusion, and AI context inclusion.
• Shared field catalog allowlist — unknown custom keys are rejected across all channels.

Security and spam protection

• Configurable payload limits — request size, field length, message length, file count, and allowed extensions.
• Rate limiting per IP (with support for X-Original-Client-IP behind gateways).
• Honeypot field with soft-accept behaviour (spam is silently discarded).
• CAPTCHA hooks — host registers IContactSubmissionCaptchaVerifier when CAPTCHA is required.
• Allowed origins check for browser-based submissions.
• Spam threshold — auto-marks contacts as Spam after repeated submissions from the same email.
• Rejected and Spam contacts are blocked from receiving new submissions.

Email

• Outbound email via SMTP (Umbraco config) or Postmark, with delivery tracking through Postmark webhooks.
• Tokenized notification and thank-you email templates (HTML, with custom field tokens).
• Compose and reply from the backoffice — rich text editor, attachments, and reply threading to inbound emails.
• Email history view with delivery status badges (Queued, Sent, Delivered, Bounced, Opened, Spam complaint).
• Attachment storage — local disk or Amazon S3 (with configurable bucket, region, and key prefix).

Notifications

• Configurable notification providers — Telegram built in (bot token + chat ID).
• Event-driven alerts for form submissions, customer replies, and direct email leads.
• Customizable message templates and test notification sending from Settings.

AI assistance

• Optional AI reply generation for outbound emails (Claude or OpenAI), with configurable reply instructions.
• Lead intelligence — AI-powered research block with risk scoring, company/person info, and source references.
• Auto-research for new contacts and optional auto-archive for low-quality leads.
• Per-field control over which custom fields are included in AI context.

Multi-site / multi-channel

• Internal source configuration for same-site and built-in forms (name + site ID).
• External lead sources with per-source API keys (hashed storage, one-time display on create/regenerate), domains, and site IDs.
• Source-based filtering across all list views and contact details.

Requirements

• Umbraco CMS 17.x–18.x
• .NET 10.0

Installation

Install the package into your Umbraco project:

dotnet add package umContactManager

The package registers itself through an Umbraco composer, runs its database migrations on startup, and adds a Contacts section to the backoffice.

⚠️ After installing, grant the section to your user group. Umbraco does not show a newly installed section to anyone — not even administrators — until it is added to a user group's allowed sections. Go to Settings → Users → User groups → your group (e.g. Administrators) → Sections, tick Contacts, and Save. Reload the backoffice (Ctrl-F5) and the section will appear. If you don't do this, the section stays hidden and it looks like the package didn't install.

Configuration

Open Contacts → Settings and configure at least:

• Form fields — custom field catalog (optional; standard fields are built in)
• Security — payload limits, rate limiting, honeypot, spam threshold, CAPTCHA
• Internal source — required for same-site / built-in forms
• External lead sources — required for POST /api/contact/submit (API key)
• Email / notifications / AI as needed

Email provider

Choose SMTP (uses Umbraco Umbraco:CMS:Global:Smtp settings) or Postmark (server token, from address, message stream). When using Postmark, configure webhook credentials for delivery tracking and inbound email processing.

AI replies and lead intelligence

Enable AI in Settings, choose OpenAI or Claude, and configure your API key and model. Optional toggles: auto-research new contacts and auto-archive low-quality leads.

ℹ️ When you use AI features, selected contact context is sent to the AI provider you configure, and that provider's own API usage charges apply. You are responsible for determining whether that content contains personal data and for obtaining any consents required before processing it.

Integration

All channels share one pipeline (validation, limits, spam protection, save, email, notifications, AI).

Built-in Contact Manager Form

1. Enable Internal source in Settings.
2. Add Contact Manager Form (contactManagerForm) to your Block List / Block Grid allowed blocks.
3. On a content page, add the block, pick fields and order, then publish.

The form posts to /api/contact/form/submit with antiforgery — no custom controller required.

Public helpers:

• GET /api/contact/form/schema — field catalog plus honeypot / CAPTCHA flags
• GET /api/contact/form/antiforgery — antiforgery token for same-site clients

Same-site custom form

Post multipart/form-data or application/x-www-form-urlencoded to /api/contact/form/submit with a valid antiforgery token and credentials: 'same-origin'. Use field keys from Settings (plus optional honeypot Trap and CaptchaToken when enabled). File uploads are supported on this endpoint only.

External API

Create an External lead source, then POST /api/contact/submit with header X-API-Key and JSON:

{
  "name": "Jane Doe",
  "email": "jane@example.com",
  "company": "Acme",
  "message": "Hello",
  "pageUrl": "https://example.com/contact",
  "customFields": {
    "phone": "+1 555 0100"
  }
}

Prefer calling from a trusted backend. For browser calls, set Allowed origins and treat the key as visible. When a gateway forwards submissions, set the end-user IP in X-Original-Client-IP.

Response contract

Success: { "success": true, "code": "accepted" }

Honeypot hits may still return accepted (soft accept).

CAPTCHA (optional)

CAPTCHA is host-owned — the package does not ship a provider widget or site key. Enable Require CAPTCHA for built-in form in Security, register IContactSubmissionCaptchaVerifier in host DI, and post a token as CaptchaToken, Recaptcha, or g-recaptcha-response.

Migrating an existing form

1. Move fields and security limits into Contact Manager Settings.
2. Point the form to /api/contact/form/submit (same-site) or /api/contact/submit (API key).
3. Remove duplicated host validation / submission logic — or replace the UI with the built-in form block.

License

umContactManager is free to use — no paid license key is required. It is not open source.

Copyright © 2026 OSKI solutions OÜ. All rights reserved.

See LICENSE.md for the full terms. Third-party service costs (for example AI providers, email delivery, or object storage) are not included and remain your responsibility.

Support

Please connect with me (Kyrylo Osadchuk) if you need assistance with AI or Umbraco consulting services:

• OSKI solutions OU
• Kyrylo Osadchuk on LinkedIn
• Kyrylo Osadchuk on GitHub
• umContactManager Overview