# Data flow — payloadcms/payload

> Canonical page: https://codevetter.com/unpack/payload/data-flow

# Data flow — payloadcms/payload

Scanned commit e6cd442f40563b2dd95cebcc6a3ffaa2dbbc68f2 (2026-10-02). Generated by codevetter codevetter 1.15.0 on 2026-10-02.

Source inspection; upstream code and tests were not executed.

Configuration is transformed before runtime state is initialized. HTTP requests acquire authentication, query, locale, and translation context before endpoint handlers consume data. Collection operations own validation and lifecycle behavior, then delegate stored representations to adapters. Returned documents are transformed again for field visibility, population, localization, and hooks before crossing the response boundary.
- buildConfig sorts plugins by order, awaits each config transformation, invokes each storage adapter's init, and finally passes the resulting config to sanitizeConfig. — [packages/payload/src/config/build.ts#L10-32](https://github.com/payloadcms/payload/blob/e6cd442f40563b2dd95cebcc6a3ffaa2dbbc68f2/packages/payload/src/config/build.ts#L10-L32)
- createPayloadRequestFromWebRequest parses cookies, gets a cached Payload instance with crons enabled, parses query strings with depth 10 and arrayLimit 1000, and normalizes configured locales. — [packages/payload/src/utilities/createPayloadRequestFromWebRequest.ts#L33-38](https://github.com/payloadcms/payload/blob/e6cd442f40563b2dd95cebcc6a3ffaa2dbbc68f2/packages/payload/src/utilities/createPayloadRequestFromWebRequest.ts#L33-L38) [packages/payload/src/utilities/createPayloadRequestFromWebRequest.ts#L66-94](https://github.com/payloadcms/payload/blob/e6cd442f40563b2dd95cebcc6a3ffaa2dbbc68f2/packages/payload/src/utilities/createPayloadRequestFromWebRequest.ts#L66-L94)
- createPayloadRequest attaches Payload, context, i18n, user, and a request dataloader; the web wrapper then executes auth strategies and attaches the resulting user and response headers. — [packages/payload/src/utilities/createPayloadRequest.ts#L130-159](https://github.com/payloadcms/payload/blob/e6cd442f40563b2dd95cebcc6a3ffaa2dbbc68f2/packages/payload/src/utilities/createPayloadRequest.ts#L130-L159) [packages/payload/src/utilities/createPayloadRequestFromWebRequest.ts#L126-140](https://github.com/payloadcms/payload/blob/e6cd442f40563b2dd95cebcc6a3ffaa2dbbc68f2/packages/payload/src/utilities/createPayloadRequestFromWebRequest.ts#L126-L140)
- Internal POST/PATCH endpoint wrappers parse data/files and body locales before calling the original handler; JSON becomes req.data, while multipart _payload supplies data and file parts populate req.files/req.file. — [packages/payload/src/utilities/wrapInternalEndpoints.ts#L6-19](https://github.com/payloadcms/payload/blob/e6cd442f40563b2dd95cebcc6a3ffaa2dbbc68f2/packages/payload/src/utilities/wrapInternalEndpoints.ts#L6-L19) [packages/payload/src/utilities/addDataAndFileToRequest.ts#L16-59](https://github.com/payloadcms/payload/blob/e6cd442f40563b2dd95cebcc6a3ffaa2dbbc68f2/packages/payload/src/utilities/addDataAndFileToRequest.ts#L16-L59)
- The client Form reduces fields to values, runs optional beforeSubmit and form validation, builds FormData, then either sends an HTTP request with Accept-Language or calls a function action. — [packages/ui/src/forms/Form/index.tsx#L318-345](https://github.com/payloadcms/payload/blob/e6cd442f40563b2dd95cebcc6a3ffaa2dbbc68f2/packages/ui/src/forms/Form/index.tsx#L318-L345) [packages/ui/src/forms/Form/index.tsx#L355-366](https://github.com/payloadcms/payload/blob/e6cd442f40563b2dd95cebcc6a3ffaa2dbbc68f2/packages/ui/src/forms/Form/index.tsx#L355-L366) [packages/ui/src/forms/Form/index.tsx#L395-412](https://github.com/payloadcms/payload/blob/e6cd442f40563b2dd95cebcc6a3ffaa2dbbc68f2/packages/ui/src/forms/Form/index.tsx#L395-L412)
- createLocal resolves a collection, defaults overrideAccess to false, constructs request context, and resolves req.file from an explicit file or filePath before entering the shared create path. — [packages/payload/src/collections/operations/local/create.ts#L181-219](https://github.com/payloadcms/payload/blob/e6cd442f40563b2dd95cebcc6a3ffaa2dbbc68f2/packages/payload/src/collections/operations/local/create.ts#L181-L219)
- The MongoDB adapter transforms application data for writing, assigns database identity, obtains the request session, calls Model.create, and converts/transforms the stored result back for reading unless returning is false. — [packages/db-mongodb/src/create.ts#L24-55](https://github.com/payloadcms/payload/blob/e6cd442f40563b2dd95cebcc6a3ffaa2dbbc68f2/packages/db-mongodb/src/create.ts#L24-L55) [packages/db-mongodb/src/create.ts#L57-75](https://github.com/payloadcms/payload/blob/e6cd442f40563b2dd95cebcc6a3ffaa2dbbc68f2/packages/db-mongodb/src/create.ts#L57-L75)
- After persistence, createOperation sanitizes internal fields, optionally saves a version and sends verification email, runs field/collection afterRead and afterChange hooks, then cleans temporary files and commits its transaction. — [packages/payload/src/collections/operations/create.ts#L482-523](https://github.com/payloadcms/payload/blob/e6cd442f40563b2dd95cebcc6a3ffaa2dbbc68f2/packages/payload/src/collections/operations/create.ts#L482-L523) [packages/payload/src/collections/operations/create.ts#L530-576](https://github.com/payloadcms/payload/blob/e6cd442f40563b2dd95cebcc6a3ffaa2dbbc68f2/packages/payload/src/collections/operations/create.ts#L530-L576) [packages/payload/src/collections/operations/create.ts#L582-623](https://github.com/payloadcms/payload/blob/e6cd442f40563b2dd95cebcc6a3ffaa2dbbc68f2/packages/payload/src/collections/operations/create.ts#L582-L623)

Every claim links to its cited files at the pinned commit. Citations identify source evidence; they do not establish runtime correctness. Independent CodeVetter scan — not reviewed by upstream maintainers.

## Public product links

- [CodeVetter](https://codevetter.com/)
- [Download](https://codevetter.com/download)
- [Documentation](https://codevetter.com/docs/)
- [Source](https://github.com/Codevetter/codevetter)