PDF Action
An operation triggered by a user event or document state in a PDF — such as opening a URL, jumping to a page, running JavaScript, submitting a form, or playing media. Actions can be chained together in a sequence.
PDF actions are the mechanism behind nearly all interactive behaviour in PDF documents. When a user clicks a button, opens a document, submits a form, or follows a bookmark, a PDF action is triggered. Actions define what happens — navigate to a page, open a URL, run JavaScript, submit form data to a server, or play a sound.
Actions are stored as PDF dictionaries with an <strong>/S</strong> (SubType) key that identifies the action type, plus type-specific parameters. They can be attached to many different triggers in a PDF: link annotations, form field events, bookmarks, the document open event, and more. Multiple actions can be chained into a sequence using the <strong>/Next</strong> key — each action in the chain fires after the previous one completes.
Understanding PDF actions is essential for anyone building interactive PDFs, debugging navigation problems, or implementing PDF processing pipelines that need to handle or strip PDF actions for security or compatibility reasons.
Core action types in the PDF specification
The <a href="https://www.iso.org/standard/63534.html" target="_blank" rel="noopener">PDF specification (ISO 32000)</a> defines a set of standard action types. The most commonly used are:
<strong>GoTo action (/S /GoTo)</strong> — Navigate to a destination within the current document. The destination can be explicit (page + coordinates) or reference a named destination. Used by bookmarks and internal hyperlinks.
<strong>GoToR action (/S /GoToR)</strong> — Navigate to a destination in a different (remote) PDF file. The /F key specifies the target file. The destination can open at a specific page or named destination in that file.
<strong>URI action (/S /URI)</strong> — Open a URL in the system browser. The /URI key specifies the target URL string. This is what clickable web hyperlinks in PDFs use — when you add a hyperlink to a PDF, the link annotation includes a URI action. The <a href="https://pdftheguide.com/glossary/uri-annotation" target="_blank" rel="noopener">URI annotation</a> wraps this action.
<strong>JavaScript action (/S /JavaScript)</strong> — Execute JavaScript code. The /JS key contains the script. Used for form validation, calculations, dynamic field behaviour, and alert dialogs. Supported primarily in Adobe Acrobat/Reader; disabled or sandboxed in most other viewers. See <a href="https://pdftheguide.com/glossary/pdf-javascript" target="_blank" rel="noopener">PDF JavaScript</a>.
<strong>SubmitForm action (/S /SubmitForm)</strong> — Submit form field data to a URL. The /F key specifies the submission URL; optional flags control data format (FDF, XFDF, HTML, PDF). This is how fillable PDF forms can submit data to a web server without printing.
<strong>ResetForm action (/S /ResetForm)</strong> — Reset all or specified form fields to their default values.
<strong>ImportData action (/S /ImportData)</strong> — Import form data from an FDF file into the current form.
<strong>Launch action (/S /Launch)</strong> — Open a file or application. A significant security risk — modern PDF viewers warn before executing launch actions, and many disable them entirely.
<strong>Named action (/S /Named)</strong> — Execute a viewer-defined action by name, such as `NextPage`, `PrevPage`, `FirstPage`, `LastPage`, or `PrintDocument`.
Action triggers: where actions are attached
Actions do not exist in isolation — they are attached to triggers that fire them. Understanding where actions can be attached is important for building interactive PDFs and for security analysis:
<strong>Link annotations</strong> — The most common trigger. A link annotation covers a rectangular area of a page; clicking within that area fires the annotation's action. URI actions (web links) and GoTo actions (internal navigation) are the most common link annotation actions.
<strong>Bookmark actions</strong> — Every entry in the PDF outline (bookmarks) can have an action. When a user clicks a bookmark in the navigation panel, the action fires. Almost always a GoTo action, but technically any action type is permitted.
<strong>Form field events</strong> — AcroForm fields support multiple event triggers: - `/AA /E` — Mouse Enter - `/AA /X` — Mouse Exit - `/AA /D` — Mouse Down - `/AA /U` — Mouse Up (the "click") - `/AA /Fo` — Field Focus - `/AA /Bl` — Field Blur (lose focus) - `/AA /K` — Keystroke (each character typed) - `/AA /V` — Validate (when field value is committed) - `/AA /C` — Calculate (run calculations based on field values)
<strong>Document-level events</strong> — The document catalogue supports: - `/OpenAction` — Fires when the document is opened. Can navigate to a specific page, run JavaScript, or perform any supported action. Commonly used for document-level initialisation scripts in complex forms. - `/AA /WC` — Will Close (fires before document closes) - `/AA /WS` — Will Save, `/AA /DS` — Did Save - `/AA /WP` — Will Print, `/AA /DP` — Did Print
Action chaining with /Next
PDF actions can be chained: each action dictionary can include a `/Next` key pointing to another action (or an array of actions). When the triggering event fires, the first action executes, then its `/Next` action(s), and so on.
Practical uses of action chaining: - Reset a form, then navigate to a confirmation page - Run a calculation JavaScript, then submit the form data - Open a URL, then also add a sticky note annotation
Action chains are evaluated synchronously by the PDF viewer's action processor. Long chains with multiple JavaScript actions can cause perceptible delays.
Security note: Action chaining is sometimes used in malicious PDFs to make attack payloads harder to detect — a chain might include innocuous actions followed by a Launch or JavaScript action that executes the malicious payload. Security-conscious PDF processing pipelines strip or sandbox all action types except GoTo and URI.
The <a href="https://www.pdfa.org/resource/technical-note-0006/" target="_blank" rel="noopener">PDF Association Technical Note 0006</a> on PDF actions provides a comprehensive reference.
Frequently asked questions
What is a PDF action?
A PDF action is an operation triggered by a user event or document state — such as clicking a link, opening a document, or focusing on a form field. Actions define what happens in response: navigate to a page, open a URL, run JavaScript, submit form data, or play media. Actions are stored in the PDF file as dictionaries and can be chained together in sequences.
How do PDF form submissions work?
PDF forms use the SubmitForm action to send data to a URL when a submit button is clicked. The action specifies the target URL and the data format — typically FDF (Forms Data Format), XFDF (XML-based FDF), or HTML multipart form data. The PDF viewer handles the HTTP POST request. This works in Adobe Acrobat/Reader; browser-based PDF viewers may not support SubmitForm actions and instead provide a "download" flow for form data.
Are PDF actions a security risk?
Some action types are significant security risks: Launch actions can execute arbitrary files or applications; JavaScript actions can access the file system or make network requests in some viewer contexts; GoToR and embedded file actions can reference remote resources. Modern PDF viewers disable or warn on Launch and JavaScript actions. Security-conscious workflows strip all actions from PDFs received from untrusted sources. PDF JavaScript in particular should be treated with caution.
What is the difference between a GoTo and a GoToR action?
A GoTo action navigates to a destination within the current document. A GoToR (Go To Remote) action navigates to a destination in a different PDF file, specified by the /F (file) key. GoToR actions are used to cross-reference between related PDF documents in a document set. The target file must be accessible (local or network path); if it cannot be found, the action fails silently or shows an error.