---
type: api
title: Uploads Endpoints
description: Admin-only multipart upload endpoints for category icons and challenge files.
tags: [api, uploads, multipart, admin]
timestamp: 2026-07-21T18:28:00Z
---

# Endpoints

| Method | Path                                  | Auth  | Source                                                  |
|--------|---------------------------------------|-------|---------------------------------------------------------|
| `POST` | `/api/v1/uploads/category-icon`       | Admin | `backend/src/modules/uploads/uploads.controller.ts`     |
| `POST` | `/api/v1/uploads/challenge-file`      | Admin | Same.                                                   |

# Guard chain

Both handlers are gated by `JwtAuthGuard` + `AdminGuard`. CSRF is enforced
(standard cookie + header pattern; nothing is added to the skip list).

# Behavior

* Each endpoint uses `FileInterceptor('file')` and parses a single
  multipart part named `file`.
* File size is validated by `parseUploadSizeLimit()` in
  `backend/src/common/utils/upload.ts`.
* Filenames are sanitized by the same helper before being persisted
  under `UPLOAD_DIR`.

# See also

- [REST API Overview](/api/rest-overview.md)
- [Backend Module Map](/architecture/backend-modules.md)