---
title: "Upload file via forms engine"
method: POST
path: "/file"
tags: ["Upload", "Forms"]
---

# Upload file via forms engine

`POST /file`

File upload endpoint specifically for @defra/forms-engine-plugin integration.
CSRF protection is disabled for this endpoint to allow forms engine integration.

This endpoint handles both:
- File uploads (multipart/form-data)
- CDP callbacks (application/json)

## Response `201`

File uploaded successfully

- UploadSuccessResponse
  - `success` boolean, required
  - `uploadId` string, uuid, required — Unique identifier for this upload
  - `filename` string, required — Timestamped filename stored in system
  - `originalFilename` string — Original filename from user
  - `timestamp` string, date-time — Upload timestamp (ISO 8601)
  - `message` string, required

## Other responses

- `400` — Bad request - invalid input
- `413` — File size exceeds maximum allowed (50MB)
- `415` — Unsupported file type
- `500` — Internal server error

---

[API](https://skmtc.net/defra/apis/apha-surveillance-data-submission-portal-api.md) · [All operations](https://skmtc.net/defra/apis/apha-surveillance-data-submission-portal-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/defra/apha-surveillance-data-submission-portal-api/versions/592deaf8edd7/schema)