completed /api/upload endpoint