---
title: "Upload file via forms engine"
method: POST
path: "/file"
tags: ["Upload", "Forms"]
---

# Upload file via forms engine

`POST /file`

## Request

- Base URL: `http://localhost:3000`
- URL: `http://localhost:3000/file`
- Auth: API key in cookie `session`

File upload endpoint specifically for @defra/forms-engine-plugin integration.
CSRF protection is disabled for this endpoint to allow forms engine integration.

This endpoint handles both:
- File uploads (multipart/form-data)
- CDP callbacks (application/json)

## Request body `multipart/form-data`

- object
  - `file` string, binary, required: Spreadsheet file to upload
  - `formData` object: Optional form metadata
    - `formId` string: Form identifier
    - `submissionId` string: Submission identifier

## Response `201`

File uploaded successfully

- UploadSuccessResponse
  - `success` boolean, required
  - `uploadId` string, uuid, required: Unique identifier for this upload
  - `filename` string, required: Timestamped filename stored in system
  - `originalFilename` string: Original filename from user
  - `timestamp` string, date-time: Upload timestamp (ISO 8601)
  - `message` string, required

## Other responses

- `400`: Bad request - invalid input
- `413`: File size exceeds maximum allowed (50MB)
- `415`: Unsupported file type
- `500`: Internal server error

---

[API](https://skmtc.dev/defra/apis/apha-surveillance-data-submission-portal-api.md) - [All operations](https://skmtc.dev/defra/apis/apha-surveillance-data-submission-portal-api/llms.txt) - [OpenAPI document](https://skmtc.dev/defra/apis/apha-surveillance-data-submission-portal-api/revisions/592deaf8edd7?raw)