diff --git a/resources/js/form/components/Field.vue b/resources/js/form/components/Field.vue
index fedc8f1de..429ea3c34 100644
--- a/resources/js/form/components/Field.vue
+++ b/resources/js/form/components/Field.vue
@@ -8,7 +8,7 @@
     import Editor from "./fields/editor/Editor.vue";
     import Geolocation from "./fields/geolocation/Geolocation.vue";
     import Html from "./fields/Html.vue";
-    import List from "./fields/List.vue";
+    import List from "./fields/list/List.vue";
     import Number from "./fields/Number.vue";
     import Select from "./fields/select/Select.vue";
     import Tags from "./fields/Tags.vue";
diff --git a/resources/js/form/components/Form.vue b/resources/js/form/components/Form.vue
index 07c088208..ef55db098 100644
--- a/resources/js/form/components/Form.vue
+++ b/resources/js/form/components/Form.vue
@@ -29,8 +29,8 @@
     import debounce from "lodash/debounce";
     import { api } from "@/api/api";
     import { route } from "@/utils/url";
-    import { useParentCommands } from "@/commands/useCommands";
     import merge from 'lodash/merge';
+    import { useFieldContainerData } from "@/form/useFieldContainerData";
 
     const props = defineProps<{
         form: Form
@@ -82,14 +82,11 @@
         props.form.setMeta(fieldKey, { uploading });
     }
 
-    const parentCommands = useParentCommands();
+    const fieldContainerData = useFieldContainerData(props.form);
     const refresh = debounce((data) => {
         api.post(route('code16.sharp.api.form.refresh.update', {
             entityKey: props.form.entityKey,
-            instance_id: props.form.instanceId,
-            embed_key: props.form.embedKey,
-            entity_list_command_key: parentCommands?.commandContainer === 'entityList' ? props.form.commandKey : null,
-            show_command_key: parentCommands?.commandContainer === 'show' ? props.form.commandKey : null,
+            ...fieldContainerData,
         }), data)
             .then(response => {
                 merge(props.form.data, response.data.form.data);
diff --git a/resources/js/form/components/fields/Autocomplete.vue b/resources/js/form/components/fields/Autocomplete.vue
index 65b5fb18d..a0513defc 100644
--- a/resources/js/form/components/fields/Autocomplete.vue
+++ b/resources/js/form/components/fields/Autocomplete.vue
@@ -4,7 +4,7 @@
     import {
         FormAutocompleteItemData,
         FormAutocompleteLocalFieldData,
-        FormAutocompleteRemoteFieldData,
+        FormAutocompleteRemoteFieldData
     } from "@/types";
     import { Popover, PopoverContent, PopoverTrigger } from "@/components/ui/popover";
     import { computed, ref } from "vue";
@@ -21,12 +21,12 @@
     import { route } from "@/utils/url";
     import { api } from "@/api/api";
     import { useParentForm } from "@/form/useParentForm";
-    import { isCancel } from "axios";
     import { ComboboxItemIndicator } from "reka-ui";
-    import { useParentCommands } from "@/commands/useCommands";
     import { useIsInDialog } from "@/components/ui/dialog/Dialog.vue";
     import { useFullTextSearch } from "@/composables/useFullTextSearch";
     import { useRemoteAutocomplete } from "@/composables/useRemoteAutocomplete";
+    import { useFieldContainerData } from "@/form/useFieldContainerData";
+    import { useParentListField } from "@/form/components/fields/list/useParentListField";
 
     const props = defineProps<FormFieldProps<FormAutocompleteLocalFieldData | FormAutocompleteRemoteFieldData>>();
     const emit = defineEmits<FormFieldEmits<FormAutocompleteLocalFieldData | FormAutocompleteRemoteFieldData>>();
@@ -36,7 +36,6 @@
     const searchTerm = ref('');
     const results = ref<FormAutocompleteItemData[]>([]);
 
-    const parentCommands = useParentCommands();
     const isInDialog = useIsInDialog();
     const { fullTextSearch } = useFullTextSearch(
         () => props.field.mode === 'local' ? props.field.localValues : null,
@@ -45,19 +44,19 @@
             searchKeys: props.field.mode === 'local' ? props.field.searchKeys : [],
         }
     );
+    const parentListField = useParentListField();
+    const fieldContainerData = useFieldContainerData(form);
     const { loading, search: remoteSearch } = useRemoteAutocomplete(({ query, signal, onSuccess, onError }) => {
         const field = props.field as FormAutocompleteRemoteFieldData;
         return api.post(
             route('code16.sharp.api.form.autocomplete.index', {
                 entityKey: form.entityKey,
-                autocompleteFieldKey: props.parentField ? `${props.parentField.key}.${field.key}` : field.key,
-                embed_key: form.embedKey,
-                entity_list_command_key: parentCommands?.commandContainer === 'entityList' ? form.commandKey : null,
-                show_command_key: parentCommands?.commandContainer === 'show' ? form.commandKey : null,
-                dashboard_command_key: parentCommands?.commandContainer === 'dashboard' ? form.commandKey : null,
-                instance_id: form.instanceId,
+                autocompleteFieldKey: parentListField && parentListField.form === form
+                    ? `${parentListField.props.field.key}.${field.key}`
+                    : field.key,
                 endpoint: field.remoteEndpoint,
                 search: query,
+                ...fieldContainerData,
             }), {
                 formData: field.callbackLinkedFields
                     ? Object.fromEntries(
diff --git a/resources/js/form/components/fields/editor/Editor.vue b/resources/js/form/components/fields/editor/Editor.vue
index 48b42cd62..8598db340 100644
--- a/resources/js/form/components/fields/editor/Editor.vue
+++ b/resources/js/form/components/fields/editor/Editor.vue
@@ -86,7 +86,8 @@
         uploadModal,
         embedManager,
         embedModal,
-    } satisfies ParentEditor);
+        form,
+    });
 
     watch(() => [embedManager.contentEmbeds, uploadManager.contentUploads], () => {
         emit('input', {
diff --git a/resources/js/form/components/fields/editor/useParentEditor.ts b/resources/js/form/components/fields/editor/useParentEditor.ts
index 1e864f972..a087a4386 100644
--- a/resources/js/form/components/fields/editor/useParentEditor.ts
+++ b/resources/js/form/components/fields/editor/useParentEditor.ts
@@ -8,7 +8,7 @@ import EditorUploadModal from "@/form/components/fields/editor/extensions/upload
 import EditorEmbedModal from "@/form/components/fields/editor/extensions/embed/EditorEmbedModal.vue";
 
 /**
- * @see import('./Editor.vue') -> provide('editor')
+ * @see import('./Editor.vue')
  */
 export type ParentEditor = {
     props: FormFieldProps<FormEditorFieldData>,
@@ -16,8 +16,9 @@ export type ParentEditor = {
     embedModal: Ref<InstanceType<typeof EditorEmbedModal>>
     uploadManager: ContentUploadManager<Form>,
     uploadModal: Ref<InstanceType<typeof EditorUploadModal>>,
+    form: Form,
 };
 
 export function useParentEditor() {
-    return inject<ParentEditor>('editor');
+    return inject<ParentEditor>('editor', null);
 }
diff --git a/resources/js/form/components/fields/List.vue b/resources/js/form/components/fields/list/List.vue
similarity index 98%
rename from resources/js/form/components/fields/List.vue
rename to resources/js/form/components/fields/list/List.vue
index ae61e6dd7..d7aa17d2b 100644
--- a/resources/js/form/components/fields/List.vue
+++ b/resources/js/form/components/fields/list/List.vue
@@ -3,7 +3,7 @@
     import { useParentForm } from "@/form/useParentForm";
     import { FormFieldData, FormListFieldData, FormUploadFieldData, FormUploadFieldValueData } from "@/types";
     import { getDependantFieldsResetData } from "@/form/util";
-    import { computed, nextTick, ref, watch, watchEffect } from "vue";
+    import { computed, nextTick, provide, ref, watch, watchEffect } from "vue";
     import { Button, buttonVariants } from '@/components/ui/button';
     import { showAlert } from "@/utils/dialogs";
     import { FieldMeta, FieldsMeta, FormFieldEmitInputOptions, FormFieldEmits, FormFieldProps } from "@/form/types";
@@ -22,11 +22,18 @@
     import { useSortable } from "@vueuse/integrations/useSortable";
     import { useEventListener, watchArray } from "@vueuse/core";
     import { FormEvents } from "@/form/Form";
+    import { ParentListField } from "@/form/components/fields/list/useParentListField";
 
     const props = defineProps<FormFieldProps<FormListFieldData>>();
     const emit = defineEmits<FormFieldEmits<FormListFieldData>>();
 
     const form = useParentForm();
+
+    provide<ParentListField>('listField', {
+        props,
+        form,
+    });
+
     const canAddItem = computed(() => {
         const { field, value } = props;
         return field.addable &&
@@ -226,7 +233,6 @@
                                                             :field="form.getField(itemFieldLayout.key, field.itemFields, item, props.field.readOnly)"
                                                             :field-layout="itemFieldLayout"
                                                             :field-error-key="`${field.key}.${item[errorIndex] ?? item[itemKey]}.${itemFieldLayout.key}`"
-                                                            :parent-field="field"
                                                             :value="item[itemFieldLayout.key]"
                                                             :locale="(form.getMeta(`${field.key}.${item[itemKey]}.${itemFieldLayout.key}`) as FieldMeta)?.locale ?? form.defaultLocale"
                                                             :parent-data="item"
diff --git a/resources/js/form/components/fields/list/useParentListField.ts b/resources/js/form/components/fields/list/useParentListField.ts
new file mode 100644
index 000000000..f0ddc031e
--- /dev/null
+++ b/resources/js/form/components/fields/list/useParentListField.ts
@@ -0,0 +1,16 @@
+import { FormFieldProps } from "@/form/types";
+import { FormListFieldData } from "@/types";
+import { inject } from "vue";
+import { Form } from "@/form/Form";
+
+export type ParentListField = {
+    props: FormFieldProps<FormListFieldData>,
+    form: Form,
+}
+
+/**
+ * @see import('./List.vue')
+ */
+export function useParentListField() {
+    return inject<ParentListField>('listField', null);
+}
diff --git a/resources/js/form/components/fields/upload/Upload.vue b/resources/js/form/components/fields/upload/Upload.vue
index 7193a89ad..6950da791 100644
--- a/resources/js/form/components/fields/upload/Upload.vue
+++ b/resources/js/form/components/fields/upload/Upload.vue
@@ -1,8 +1,7 @@
 <script setup lang="ts">
     import { FormUploadFieldData } from "@/types";
-    import Uppy, { MinimalRequiredUppyFile } from '@uppy/core';
+    import Uppy from '@uppy/core';
     import type { UppyFile } from "@uppy/core";
-    import ThumbnailGenerator from '@uppy/thumbnail-generator';
     import XHRUpload from '@uppy/xhr-upload';
     import DropTarget from '@uppy/drop-target';
     import Cropper from 'cropperjs';
@@ -42,6 +41,9 @@
     } from "@/components/ui/dialog";
     import { rotate, rotateTo } from "@/form/components/fields/upload/util/rotate";
     import { createThumbnail } from "@/form/components/fields/upload/util/thumbnail";
+    import { useFieldContainerData } from "@/form/useFieldContainerData";
+    import { useParentEditor } from "@/form/components/fields/editor/useParentEditor";
+    import { useParentListField } from "@/form/components/fields/list/useParentListField";
 
     const props = defineProps<FormFieldProps<FormUploadFieldData> & {
         asEditorEmbed?: boolean,
@@ -67,6 +69,8 @@
         (e: 'edit', event: CustomEvent): void
     }>();
     const form = useParentForm();
+    const parentEditor = useParentEditor();
+    const parentListField = useParentListField();
     const transformedImg = ref<string>();
     const persistedEditableImg = ref<string>();
     const playablePreviewUrl = ref<string>();
@@ -75,6 +79,22 @@
         return props.value && canTransform(props.value.name, props.value.mime_type) && !props.hasError
             || !!props.dropdownEditLabel;
     });
+    const fieldContainerData = useFieldContainerData(form);
+    const uploadEndpoint = computed(() => {
+        // we check form equality because the field may be in an editor embed
+        // so parentEditor can be the embed parent editor and not an embed form field
+        let uploadFieldKey = parentEditor && parentEditor.form === form
+            ? parentEditor.props.field.key
+            : props.field.key;
+        if(parentListField && parentListField.form === form) {
+            uploadFieldKey = `${parentListField.props.field.key}.${uploadFieldKey}`;
+        }
+        return route('code16.sharp.api.form.upload', {
+            entityKey: form.entityKey,
+            uploadFieldKey,
+            ...fieldContainerData,
+        });
+    });
     const uppy = new Uppy({
         id: props.fieldErrorKey,
         restrictions: {
@@ -92,12 +112,9 @@
             pluralize: () => 1,
         },
         autoProceed: true,
-        meta: {
-            'validation_rule[]': props.field.validationRule,
-        },
     })
         .use(XHRUpload, {
-            endpoint: route('code16.sharp.api.form.upload'),
+            endpoint: uploadEndpoint.value,
             fieldName: 'file',
             headers: {
                 'Accept': 'application/json',
diff --git a/resources/js/form/types.ts b/resources/js/form/types.ts
index a538b7545..a18d1ab85 100644
--- a/resources/js/form/types.ts
+++ b/resources/js/form/types.ts
@@ -23,7 +23,6 @@ export type WithDynamicAttributesApplied<Data extends FormFieldData> =
 
 export type FormFieldProps<Data extends FormFieldData = FormFieldData, Value = Data['value']> = {
     field: WithDynamicAttributesApplied<Data>,
-    parentField?: FormListFieldData
     fieldLayout?: LayoutFieldData,
     fieldErrorKey?: string,
     parentData?: FormFieldData | FormListFieldData['value'][number],
diff --git a/resources/js/form/useFieldContainerData.ts b/resources/js/form/useFieldContainerData.ts
new file mode 100644
index 000000000..dc84d425a
--- /dev/null
+++ b/resources/js/form/useFieldContainerData.ts
@@ -0,0 +1,16 @@
+import { RequestFieldContainerData } from "@/types";
+import { useParentCommands } from "@/commands/useCommands";
+import { Form } from "@/form/Form";
+
+
+export function useFieldContainerData(form: Form): RequestFieldContainerData {
+    const parentCommands = useParentCommands();
+
+    return {
+        embed_key: form.embedKey,
+        entity_list_command_key: parentCommands?.commandContainer === 'entityList' ? form.commandKey : null,
+        show_command_key: parentCommands?.commandContainer === 'show' ? form.commandKey : null,
+        dashboard_command_key: parentCommands?.commandContainer === 'dashboard' ? form.commandKey : null,
+        instance_id: form.instanceId,
+    };
+}
diff --git a/resources/js/types/generated.d.ts b/resources/js/types/generated.d.ts
index 270a73402..105216c2b 100644
--- a/resources/js/types/generated.d.ts
+++ b/resources/js/types/generated.d.ts
@@ -47,7 +47,6 @@ export type BreadcrumbData = {
   items: Array<BreadcrumbItemData>;
 };
 export type BreadcrumbItemData = {
-  type: string;
   label: string;
   documentTitleLabel: string | null;
   entityKey: string;
@@ -812,6 +811,13 @@ export type PieGraphWidgetData = {
   ratioY: number | null;
   height: number | null;
 };
+export type RequestFieldContainerData = {
+  embed_key: string | null;
+  entity_list_command_key: string | null;
+  show_command_key: string | null;
+  dashboard_command_key: string | null;
+  instance_id: string | number | null;
+};
 export type SearchResultLinkData = {
   link: string;
   label: string;
@@ -850,7 +856,6 @@ export type ShowConfigData = {
   isSingle: boolean;
   commands: ConfigCommandsData | null;
   titleAttribute: string | null;
-  breadcrumbAttribute: string | null;
   editButtonLabel: string | null;
   state: EntityStateData | null;
 };
diff --git a/resources/js/types/routes.d.ts b/resources/js/types/routes.d.ts
index 78dcac1db..ac31bf061 100644
--- a/resources/js/types/routes.d.ts
+++ b/resources/js/types/routes.d.ts
@@ -512,7 +512,20 @@ declare module 'ziggy-js' {
             "required": false
         }
     ],
-    "code16.sharp.api.form.upload": [],
+    "code16.sharp.api.form.upload": [
+        {
+            "name": "globalFilter"
+        },
+        {
+            "name": "entityKey",
+            "required": true,
+            "binding": "key"
+        },
+        {
+            "name": "uploadFieldKey",
+            "required": true
+        }
+    ],
     "code16.sharp.api.form.autocomplete.index": [
         {
             "name": "globalFilter"
diff --git a/src/Data/RequestFieldContainerData.php b/src/Data/RequestFieldContainerData.php
new file mode 100644
index 000000000..90d449ba6
--- /dev/null
+++ b/src/Data/RequestFieldContainerData.php
@@ -0,0 +1,28 @@
+<?php
+
+namespace Code16\Sharp\Data;
+
+/**
+ * @internal
+ */
+final class RequestFieldContainerData extends Data
+{
+    public function __construct(
+        public ?string $embed_key,
+        public ?string $entity_list_command_key,
+        public ?string $show_command_key,
+        public ?string $dashboard_command_key,
+        public string|int|null $instance_id,
+    ) {}
+
+    public static function from(array $request): self
+    {
+        return new self(
+            embed_key: $request['embed_key'] ?? null,
+            entity_list_command_key: $request['entity_list_command_key'] ?? null,
+            show_command_key: $request['show_command_key'] ?? null,
+            dashboard_command_key: $request['dashboard_command_key'] ?? null,
+            instance_id: $request['instance_id'] ?? null,
+        );
+    }
+}
diff --git a/src/Http/Controllers/Api/ApiFormUploadController.php b/src/Http/Controllers/Api/ApiFormUploadController.php
index 535b0b50d..ef8d677c3 100644
--- a/src/Http/Controllers/Api/ApiFormUploadController.php
+++ b/src/Http/Controllers/Api/ApiFormUploadController.php
@@ -2,27 +2,34 @@
 
 namespace Code16\Sharp\Http\Controllers\Api;
 
+use Code16\Sharp\Exceptions\SharpInvalidConfigException;
+use Code16\Sharp\Form\Fields\SharpFormEditorField;
+use Code16\Sharp\Utils\Entities\ValueObjects\EntityKey;
 use Code16\Sharp\Utils\FileUtil;
 use Illuminate\Foundation\Validation\ValidatesRequests;
 
 class ApiFormUploadController extends ApiController
 {
+    use HandlesFieldContainer;
     use ValidatesRequests;
 
-    public function store(FileUtil $fileUtil)
+    public function store(string $globalFilter, EntityKey $entityKey, string $uploadFieldKey, FileUtil $fileUtil)
     {
-        $this->validate(request(), [
-            'validation_rule' => ['nullable', 'array'],
-            'validation_rule.*' => [
-                'string',
-                'regex:/^(file$|image:?|mimes:|mimetypes:|extensions:|dimensions:|size:|between:|min:|max:)/',
-            ],
-        ]);
+        $field = $this->getFieldContainer($entityKey)
+            ->findFieldByKey($uploadFieldKey);
+
+        if ($field instanceof SharpFormEditorField) {
+            $field = $field->uploadsConfig();
+        }
+
+        if (! $field) {
+            throw new SharpInvalidConfigException('Upload field '.$uploadFieldKey.' was not found in form.');
+        }
 
         $this->validate(request(), [
             'file' => [
                 'required',
-                ...request()->input('validation_rule') ?? ['file'],
+                ...$field->toArray()['validationRule'],
             ],
         ]);
 
diff --git a/src/Http/Controllers/Api/HandlesFieldContainer.php b/src/Http/Controllers/Api/HandlesFieldContainer.php
index 0eca57292..65ef1e8d5 100644
--- a/src/Http/Controllers/Api/HandlesFieldContainer.php
+++ b/src/Http/Controllers/Api/HandlesFieldContainer.php
@@ -2,6 +2,7 @@
 
 namespace Code16\Sharp\Http\Controllers\Api;
 
+use Code16\Sharp\Data\RequestFieldContainerData;
 use Code16\Sharp\EntityList\Commands\Command;
 use Code16\Sharp\Form\Fields\Embeds\SharpFormEditorEmbed;
 use Code16\Sharp\Form\SharpForm;
@@ -20,18 +21,20 @@ trait HandlesFieldContainer
 
     private function getFieldContainer(EntityKey $entityKey): SharpFormEditorEmbed|Command|SharpForm
     {
-        if (request()->input('embed_key')) {
-            return $this->getEmbedFromKey(request()->input('embed_key'));
+        $requestFieldContainerData = RequestFieldContainerData::from(request()->query());
+
+        if ($requestFieldContainerData->embed_key) {
+            return $this->getEmbedFromKey($requestFieldContainerData->embed_key);
         }
 
         $entity = $this->entityManager->entityFor($entityKey);
 
-        if ($commandKey = request()->input('entity_list_command_key')) {
-            if (request()->input('instance_id')) {
+        if ($commandKey = $requestFieldContainerData->entity_list_command_key) {
+            if ($requestFieldContainerData->instance_id) {
                 return $this->getInstanceCommandHandler(
                     $entity->getListOrFail(),
                     $commandKey,
-                    request()->input('instance_id')
+                    $requestFieldContainerData->instance_id
                 );
             }
 
@@ -41,15 +44,15 @@ private function getFieldContainer(EntityKey $entityKey): SharpFormEditorEmbed|C
             );
         }
 
-        if ($commandKey = request()->input('show_command_key')) {
+        if ($commandKey = $requestFieldContainerData->show_command_key) {
             return $this->getInstanceCommandHandler(
                 $entity->getShowOrFail(),
                 $commandKey,
-                request()->input('instance_id')
+                $requestFieldContainerData->instance_id
             );
         }
 
-        if ($commandKey = request()->input('dashboard_command_key')) {
+        if ($commandKey = $requestFieldContainerData->dashboard_command_key) {
             return $this->getDashboardCommandHandler(
                 $entity->getViewOrFail(),
                 $commandKey
diff --git a/src/routes/api.php b/src/routes/api.php
index 0ccc4e03d..65993f5f0 100644
--- a/src/routes/api.php
+++ b/src/routes/api.php
@@ -110,7 +110,7 @@
     Route::post('/{globalFilter}/upload/thumbnail/{entityKey}/{instanceId?}', [ApiFormUploadThumbnailController::class, 'show'])
         ->name('code16.sharp.api.form.upload.thumbnail.show');
 
-    Route::post('/upload', [ApiFormUploadController::class, 'store'])
+    Route::post('/{globalFilter}/upload/{entityKey}/{uploadFieldKey}', [ApiFormUploadController::class, 'store'])
         ->name('code16.sharp.api.form.upload');
 
     Route::post('/{globalFilter}/form/autocomplete/{entityKey}/{autocompleteFieldKey}', [ApiFormAutocompleteController::class, 'index'])
diff --git a/tests/Http/Api/ApiFormUploadControllerTest.php b/tests/Http/Api/ApiFormUploadControllerTest.php
index a188ce7c1..af882cdfa 100644
--- a/tests/Http/Api/ApiFormUploadControllerTest.php
+++ b/tests/Http/Api/ApiFormUploadControllerTest.php
@@ -1,16 +1,57 @@
 <?php
 
+use Code16\Sharp\Dashboard\Commands\DashboardCommand;
+use Code16\Sharp\EntityList\Commands\EntityCommand;
+use Code16\Sharp\EntityList\Commands\InstanceCommand;
+use Code16\Sharp\Form\Fields\Editor\Uploads\SharpFormEditorUpload;
+use Code16\Sharp\Form\Fields\Embeds\SharpFormEditorEmbed;
+use Code16\Sharp\Form\Fields\SharpFormEditorField;
+use Code16\Sharp\Form\Fields\SharpFormListField;
+use Code16\Sharp\Form\Fields\SharpFormUploadField;
+use Code16\Sharp\Tests\Fixtures\Entities\DashboardEntity;
+use Code16\Sharp\Tests\Fixtures\Entities\PersonEntity;
+use Code16\Sharp\Tests\Fixtures\Sharp\PersonForm;
+use Code16\Sharp\Tests\Fixtures\Sharp\PersonList;
+use Code16\Sharp\Tests\Fixtures\Sharp\PersonShow;
+use Code16\Sharp\Tests\Fixtures\Sharp\TestDashboard;
+use Code16\Sharp\Utils\Fields\FieldsContainer;
 use Illuminate\Http\UploadedFile;
 use Illuminate\Support\Facades\Storage;
 
 beforeEach(function () {
-    login();
     Storage::fake('local');
+    login();
 });
 
+function registerPersonEntityWithUploadField(?SharpFormUploadField $field = null): void
+{
+    sharp()->config()->declareEntity(PersonEntity::class);
+
+    $field ??= SharpFormUploadField::make('file')
+        ->setStorageDisk('local')
+        ->setStorageBasePath('tmp');
+
+    $form = new class($field) extends PersonForm
+    {
+        public function __construct(private SharpFormUploadField $field) {}
+
+        public function buildFormFields(FieldsContainer $formFields): void
+        {
+            $formFields->addField($this->field);
+        }
+    };
+
+    fakeFormFor('person', $form);
+}
+
 it('allows to upload a file', function () {
+    registerPersonEntityWithUploadField();
+
     $this
-        ->postJson(route('code16.sharp.api.form.upload'), [
+        ->postJson(route('code16.sharp.api.form.upload', [
+            'entityKey' => 'person',
+            'uploadFieldKey' => 'file',
+        ]), [
             'file' => UploadedFile::fake()->image('image.jpg', 600, 600),
         ])
         ->assertOk()
@@ -20,9 +61,13 @@
 it('allows to upload a file on a custom defined disk', function () {
     sharp()->config()->configureUploads(uploadDisk: 'uploads');
     Storage::fake('uploads');
+    registerPersonEntityWithUploadField();
 
     $this
-        ->postJson(route('code16.sharp.api.form.upload'), [
+        ->postJson(route('code16.sharp.api.form.upload', [
+            'entityKey' => 'person',
+            'uploadFieldKey' => 'file',
+        ]), [
             'file' => UploadedFile::fake()->image('image.jpg', 600, 600),
         ])
         ->assertOk();
@@ -31,15 +76,23 @@
 });
 
 it('adds a increment to the file name if needed', function () {
+    registerPersonEntityWithUploadField();
+
     $this
-        ->postJson(route('code16.sharp.api.form.upload'), [
+        ->postJson(route('code16.sharp.api.form.upload', [
+            'entityKey' => 'person',
+            'uploadFieldKey' => 'file',
+        ]), [
             'file' => UploadedFile::fake()->image('image.jpg', 600, 600),
         ])
         ->assertOk()
         ->assertJson(['name' => 'image.jpg']);
 
     $this
-        ->postJson(route('code16.sharp.api.form.upload'), [
+        ->postJson(route('code16.sharp.api.form.upload', [
+            'entityKey' => 'person',
+            'uploadFieldKey' => 'file',
+        ]), [
             'file' => UploadedFile::fake()->image('image.jpg', 600, 600),
         ])
         ->assertOk()
@@ -47,8 +100,13 @@
 });
 
 it('copies the file to the wanted directory', function () {
+    registerPersonEntityWithUploadField();
+
     $this
-        ->postJson(route('code16.sharp.api.form.upload'), [
+        ->postJson(route('code16.sharp.api.form.upload', [
+            'entityKey' => 'person',
+            'uploadFieldKey' => 'file',
+        ]), [
             'file' => UploadedFile::fake()->image('image.jpg', 600, 600),
         ]);
 
@@ -56,15 +114,23 @@
 });
 
 it('throws a validation exception on missing file even without explicit rule', function () {
+    registerPersonEntityWithUploadField();
+
     $this
-        ->postJson(route('code16.sharp.api.form.upload'), [
+        ->postJson(route('code16.sharp.api.form.upload', [
+            'entityKey' => 'person',
+            'uploadFieldKey' => 'file',
+        ]), [
             'file' => null,
         ])
         ->assertStatus(422)
         ->assertJsonValidationErrorFor('file');
 
     $this
-        ->postJson(route('code16.sharp.api.form.upload'), [
+        ->postJson(route('code16.sharp.api.form.upload', [
+            'entityKey' => 'person',
+            'uploadFieldKey' => 'file',
+        ]), [
             'file' => 'not a file',
         ])
         ->assertStatus(422)
@@ -72,44 +138,336 @@
 });
 
 it('validates on explicit rules', function () {
+    registerPersonEntityWithUploadField(
+        SharpFormUploadField::make('file')
+            ->setStorageDisk('local')
+            ->setStorageBasePath('tmp')
+            ->setImageOnly(),
+    );
+
     $this
-        ->postJson(route('code16.sharp.api.form.upload'), [
+        ->postJson(route('code16.sharp.api.form.upload', [
+            'entityKey' => 'person',
+            'uploadFieldKey' => 'file',
+        ]), [
             'file' => UploadedFile::fake()->create('file.xls'),
-            'validation_rule' => [
-                str(app()->version())->startsWith('11.')
-                    ? 'image'
-                    : 'image:allow_svg',
-            ],
         ])
         ->assertStatus(422)
         ->assertJsonValidationErrorFor('file');
 
+    registerPersonEntityWithUploadField(
+        SharpFormUploadField::make('file')
+            ->setStorageDisk('local')
+            ->setStorageBasePath('tmp')
+            ->setMaxFileSize(2),
+    );
+
     $this
-        ->postJson(route('code16.sharp.api.form.upload'), [
+        ->postJson(route('code16.sharp.api.form.upload', [
+            'entityKey' => 'person',
+            'uploadFieldKey' => 'file',
+        ]), [
             'file' => UploadedFile::fake()->create('file.xls', 1024 * 3),
-            'validation_rule' => ['max:2048'],
         ])
         ->assertStatus(422)
         ->assertJsonValidationErrorFor('file');
 });
 
-it('does not permit to send insecure validation rules', function () {
+class UploadTestEmbed extends SharpFormEditorEmbed
+{
+    public function buildFormFields(FieldsContainer $formFields): void
+    {
+        $formFields->addField(
+            SharpFormUploadField::make('file')
+                ->setStorageDisk('local')
+                ->setStorageBasePath('tmp')
+        );
+    }
+
+    public function updateContent(array $data = []): array
+    {
+        return $data;
+    }
+}
+
+it('allows to upload a file in an embed', function () {
     $this
-        ->postJson(route('code16.sharp.api.form.upload'), [
-            'file' => UploadedFile::fake()->create('file.xls'),
-            'id' => 1,
-            'validation_rule' => ['file', 'exists:users,id'],
-        ])
-        ->assertStatus(422)
-        ->assertJsonValidationErrorFor('validation_rule.1');
+        ->postJson(
+            route('code16.sharp.api.form.upload', [
+                'entityKey' => 'person',
+                'uploadFieldKey' => 'file',
+                'embed_key' => (new UploadTestEmbed())->key(),
+            ]),
+            ['file' => UploadedFile::fake()->image('image.jpg')]
+        )
+        ->assertOk()
+        ->assertJson(['name' => 'image.jpg']);
 });
 
-it('does not allow to use a path traversal exploit', function () {
+it('allows to upload a file in an entity list entity command', function () {
+    $command = new class() extends EntityCommand
+    {
+        public function label(): string
+        {
+            return 'label';
+        }
+
+        public function buildFormFields(FieldsContainer $formFields): void
+        {
+            $formFields->addField(
+                SharpFormUploadField::make('file')
+                    ->setStorageDisk('local')
+                    ->setStorageBasePath('tmp')
+            );
+        }
+
+        public function execute(array $data = []): array
+        {
+            return $this->reload();
+        }
+    };
+
+    $list = new class($command) extends PersonList
+    {
+        public function __construct(private EntityCommand $command) {}
+
+        public function getInstanceCommands(): ?array
+        {
+            return [$this->command];
+        }
+
+        public function getEntityCommands(): ?array
+        {
+            return ['entity-command' => $this->command];
+        }
+    };
+
+    sharp()->config()->declareEntity(PersonEntity::class);
+    fakeListFor('person', $list);
+
     $this
-        ->postJson(route('code16.sharp.api.form.upload'), [
-            'file' => UploadedFile::fake()->create('../../../etc/passwd.txt'),
-        ])
-        ->assertOk();
+        ->postJson(
+            route('code16.sharp.api.form.upload', [
+                'entityKey' => 'person',
+                'uploadFieldKey' => 'file',
+                'entity_list_command_key' => 'entity-command',
+            ]),
+            ['file' => UploadedFile::fake()->image('image.jpg')]
+        )
+        ->assertOk()
+        ->assertJson(['name' => 'image.jpg']);
+});
+
+it('allows to upload a file in an entity list instance command', function () {
+    $command = new class() extends InstanceCommand
+    {
+        public function label(): string
+        {
+            return 'label';
+        }
+
+        public function buildFormFields(FieldsContainer $formFields): void
+        {
+            $formFields->addField(
+                SharpFormUploadField::make('file')
+                    ->setStorageDisk('local')
+                    ->setStorageBasePath('tmp')
+            );
+        }
+
+        public function execute(mixed $instanceId, array $data = []): array
+        {
+            return $this->reload();
+        }
+    };
 
-    $this->assertTrue(Storage::disk('local')->exists('tmp/passwd.txt'));
+    $list = new class($command) extends PersonList
+    {
+        public function __construct(private InstanceCommand $command) {}
+
+        public function getInstanceCommands(): ?array
+        {
+            return ['instance-command' => $this->command];
+        }
+    };
+
+    sharp()->config()->declareEntity(PersonEntity::class);
+    fakeListFor('person', $list);
+
+    $this
+        ->postJson(
+            route('code16.sharp.api.form.upload', [
+                'entityKey' => 'person',
+                'uploadFieldKey' => 'file',
+                'entity_list_command_key' => 'instance-command',
+                'instance_id' => 1,
+            ]),
+            ['file' => UploadedFile::fake()->image('image.jpg')]
+        )
+        ->assertOk()
+        ->assertJson(['name' => 'image.jpg']);
+});
+
+it('allows to upload a file in a show instance command', function () {
+    $command = new class() extends InstanceCommand
+    {
+        public function label(): string
+        {
+            return 'label';
+        }
+
+        public function buildFormFields(FieldsContainer $formFields): void
+        {
+            $formFields->addField(
+                SharpFormUploadField::make('file')
+                    ->setStorageDisk('local')
+                    ->setStorageBasePath('tmp')
+            );
+        }
+
+        public function execute(mixed $instanceId, array $data = []): array
+        {
+            return $this->reload();
+        }
+    };
+
+    $show = new class($command) extends PersonShow
+    {
+        public function __construct(private InstanceCommand $command) {}
+
+        public function getInstanceCommands(): ?array
+        {
+            return ['show-command' => $this->command];
+        }
+    };
+
+    sharp()->config()->declareEntity(PersonEntity::class);
+    fakeShowFor('person', $show);
+
+    $this
+        ->postJson(
+            route('code16.sharp.api.form.upload', [
+                'entityKey' => 'person',
+                'uploadFieldKey' => 'file',
+                'show_command_key' => 'show-command',
+                'instance_id' => 1,
+            ]),
+            ['file' => UploadedFile::fake()->image('image.jpg')]
+        )
+        ->assertOk()
+        ->assertJson(['name' => 'image.jpg']);
+});
+
+it('allows to upload a file within a dashboard command form', function () {
+    sharp()->config()->declareEntity(DashboardEntity::class);
+
+    $command = new class() extends DashboardCommand
+    {
+        public function label(): string
+        {
+            return 'label';
+        }
+
+        public function buildFormFields(FieldsContainer $formFields): void
+        {
+            $formFields->addField(
+                SharpFormUploadField::make('file')
+                    ->setStorageDisk('local')
+                    ->setStorageBasePath('tmp')
+            );
+        }
+
+        public function execute(array $data = []): array
+        {
+            return $this->reload();
+        }
+    };
+
+    fakeDashboardFor('dashboard', new class($command) extends TestDashboard
+    {
+        public function __construct(private DashboardCommand $command) {}
+
+        public function getDashboardCommands(): ?array
+        {
+            return [
+                'my_command' => $this->command,
+            ];
+        }
+    });
+
+    $this
+        ->postJson(
+            route('code16.sharp.api.form.upload', [
+                'entityKey' => 'dashboard',
+                'uploadFieldKey' => 'file',
+                'dashboard_command_key' => 'my_command',
+            ]),
+            ['file' => UploadedFile::fake()->image('image.jpg')]
+        )
+        ->assertOk()
+        ->assertJson(['name' => 'image.jpg']);
+});
+
+it('allows to upload a file in a list field', function () {
+    sharp()->config()->declareEntity(PersonEntity::class);
+
+    $form = new class() extends PersonForm
+    {
+        public function buildFormFields(FieldsContainer $formFields): void
+        {
+            $formFields->addField(
+                SharpFormListField::make('list')
+                    ->addItemField(
+                        SharpFormUploadField::make('file')
+                            ->setStorageDisk('local')
+                            ->setStorageBasePath('tmp')
+                    )
+            );
+        }
+    };
+
+    fakeFormFor('person', $form);
+
+    $this
+        ->postJson(
+            route('code16.sharp.api.form.upload', [
+                'entityKey' => 'person',
+                'uploadFieldKey' => 'list.file',
+            ]),
+            ['file' => UploadedFile::fake()->image('image.jpg')]
+        )
+        ->assertOk()
+        ->assertJson(['name' => 'image.jpg']);
+});
+
+it('allows to upload a file in an editor field', function () {
+    sharp()->config()->declareEntity(PersonEntity::class);
+
+    $form = new class() extends PersonForm
+    {
+        public function buildFormFields(FieldsContainer $formFields): void
+        {
+            $formFields->addField(
+                SharpFormEditorField::make('editor')
+                    ->allowUploads(
+                        SharpFormEditorUpload::make()
+                            ->setStorageDisk('local')
+                            ->setStorageBasePath('tmp')
+                    )
+            );
+        }
+    };
+
+    fakeFormFor('person', $form);
+
+    $this
+        ->postJson(
+            route('code16.sharp.api.form.upload', [
+                'entityKey' => 'person',
+                'uploadFieldKey' => 'editor',
+            ]),
+            ['file' => UploadedFile::fake()->image('image.jpg')]
+        )
+        ->assertOk()
+        ->assertJson(['name' => 'image.jpg']);
 });
diff --git a/tests/Http/Form/FormEditorUploadsTest.php b/tests/Http/Form/FormEditorUploadsTest.php
index 1735b3330..fab00ee6e 100644
--- a/tests/Http/Form/FormEditorUploadsTest.php
+++ b/tests/Http/Form/FormEditorUploadsTest.php
@@ -46,7 +46,10 @@ public function update($id, array $data)
     });
 
     $uploadedFileData = $this
-        ->postJson(route('code16.sharp.api.form.upload'), ['file' => UploadedFile::fake()->create('file.pdf')])
+        ->postJson(route('code16.sharp.api.form.upload', [
+            'entityKey' => 'person',
+            'uploadFieldKey' => 'bio',
+        ]), ['file' => UploadedFile::fake()->create('file.pdf')])
         ->json();
 
     $editorXSharpFileData = $this
@@ -58,7 +61,10 @@ public function update($id, array $data)
         ->json();
 
     $uploadedImageData = $this
-        ->postJson(route('code16.sharp.api.form.upload'), ['file' => UploadedFile::fake()->image('image.jpg', 200, 200)])
+        ->postJson(route('code16.sharp.api.form.upload', [
+            'entityKey' => 'person',
+            'uploadFieldKey' => 'bio',
+        ]), ['file' => UploadedFile::fake()->image('image.jpg', 200, 200)])
         ->json();
 
     $editorXSharpImageData = $this
@@ -135,7 +141,10 @@ public function update($id, array $data)
     });
 
     $uploadedFileData = $this
-        ->postJson(route('code16.sharp.api.form.upload'), ['file' => UploadedFile::fake()->create('file.pdf')])
+        ->postJson(route('code16.sharp.api.form.upload', [
+            'entityKey' => 'person',
+            'uploadFieldKey' => 'bio',
+        ]), ['file' => UploadedFile::fake()->create('file.pdf')])
         ->json();
 
     $editorXSharpFileData = $this
@@ -148,7 +157,10 @@ public function update($id, array $data)
         ->json();
 
     $uploadedImageData = $this
-        ->postJson(route('code16.sharp.api.form.upload'), ['file' => UploadedFile::fake()->image('image.jpg', 200, 200)])
+        ->postJson(route('code16.sharp.api.form.upload', [
+            'entityKey' => 'person',
+            'uploadFieldKey' => 'bio',
+        ]), ['file' => UploadedFile::fake()->image('image.jpg', 200, 200)])
         ->json();
 
     $editorXSharpImageData = $this
@@ -224,7 +236,13 @@ public function update($id, array $data)
     $uploadedFile = UploadedFile::fake()->create('file.pdf');
 
     $uploadedFileData = $this
-        ->postJson(route('code16.sharp.api.form.upload'), ['file' => $uploadedFile])
+        ->postJson(route('code16.sharp.api.form.upload', [
+            'entityKey' => 'person',
+            'uploadFieldKey' => 'file',
+            'embed_key' => (new FormEditorUploadsTestEmbed())->key(),
+        ]), [
+            'file' => $uploadedFile,
+        ])
         ->json();
 
     $editorXEmbedData = $this
diff --git a/tests/Http/Form/FormUploadsTest.php b/tests/Http/Form/FormUploadsTest.php
index ed2fbd264..8658f0526 100644
--- a/tests/Http/Form/FormUploadsTest.php
+++ b/tests/Http/Form/FormUploadsTest.php
@@ -1,12 +1,16 @@
 <?php
 
 use Code16\Sharp\Form\Fields\SharpFormUploadField;
+use Code16\Sharp\Tests\Fixtures\Entities\PersonEntity;
+use Code16\Sharp\Tests\Unit\Form\Fakes\FakeSharpForm;
+use Code16\Sharp\Utils\Fields\FieldsContainer;
 use Illuminate\Http\UploadedFile;
 use Illuminate\Support\Facades\Storage;
 
 beforeEach(function () {
-    login();
+    sharp()->config()->declareEntity(PersonEntity::class);
     Storage::fake('local');
+    login();
 });
 
 it('uploads a file from field with validation', function () {
@@ -14,19 +18,32 @@
         ->setMaxFileSize(1)
         ->setImageOnly();
 
+    fakeFormFor('person', new class($field) extends FakeSharpForm
+    {
+        public function __construct(private SharpFormUploadField $field) {}
+        public function buildFormFields(FieldsContainer $formFields): void
+        {
+            $formFields->addField($this->field);
+        }
+    });
+
     $this
         ->postJson(
-            route('code16.sharp.api.form.upload'), [
+            route('code16.sharp.api.form.upload', [
+                'entityKey' => 'person',
+                'uploadFieldKey' => 'file',
+            ]), [
                 'file' => UploadedFile::fake()->image('image.jpg', 600, 600),
-                'validation_rule' => $field->toArray()['validationRule'],
             ])
         ->assertOk()
         ->assertJson(['name' => 'image.jpg']);
 
     $this
-        ->postJson(route('code16.sharp.api.form.upload'), [
+        ->postJson(route('code16.sharp.api.form.upload', [
+            'entityKey' => 'person',
+            'uploadFieldKey' => 'file',
+        ]), [
             'file' => UploadedFile::fake()->create('file.pdf'),
-            'validation_rule' => $field->toArray()['validationRule'],
         ])
         ->assertStatus(422)
         ->assertJsonValidationErrors('file');