api upload works for assertion verification

@stepzhou I think I'll just include this in gerrit (this branch rebase collapsed). Review it when you have time