Delete files via API

Gemfile.lock

@@ -114,7 +114,7 @@ GEM
       argon2-kdf (>= 0.2)
     bootsnap (1.21.1)
       msgpack (~> 1.2)
-    brakeman (8.0.2)
+    brakeman (8.0.4)
       racc
     builder (3.3.0)
     capybara (3.40.0)

app/controllers/api/v4/uploads_controller.rb

@@ -63,6 +63,14 @@ def create_from_url
         render json: { error: "Upload failed: #{e.message}" }, status: :unprocessable_entity
       end
 
+      # DELETE /api/v4/upload/:id
+      def destroy
+        upload = current_user.uploads.find(params[:id])
+        upload.destroy!
+
+        render json: { id: upload.id, deleted: true }, status: :ok
+      end
+
       private
 
       def check_quota

app/views/docs/pages/api.md

@@ -92,6 +92,36 @@ const response = await fetch('https://cdn.hackclub.com/api/v4/upload_from_url',
 const { url } = await response.json();
 ```
 
+## DELETE /api/v4/upload/:id
+
+Delete an uploaded file by its ID.
+
+```bash
+curl -X DELETE \
+  -H "Authorization: Bearer sk_cdn_your_key_here" \
+  https://cdn.hackclub.com/api/v4/upload/01234567-89ab-cdef-0123-456789abcdef
+```
+
+```javascript
+const response = await fetch('https://cdn.hackclub.com/api/v4/upload/01234567-89ab-cdef-0123-456789abcdef', {
+  method: 'DELETE',
+  headers: { 'Authorization': 'Bearer sk_cdn_your_key_here' }
+});
+
+const result = await response.json();
+```
+
+**Response:**
+
+```json
+{
+  "id": "01234567-89ab-cdef-0123-456789abcdef",
+  "deleted": true
+}
+```
+
+Returns 404 if the upload doesn't exist or doesn't belong to you.
+
 ## GET /api/v4/me
 
 Get the authenticated user and quota information.

config/routes.rb

@@ -22,6 +22,7 @@
       get "me", to: "users#show"
       post "upload", to: "uploads#create"
       post "upload_from_url", to: "uploads#create_from_url"
+      delete "upload/:id", to: "uploads#destroy"
       post "revoke", to: "api_keys#revoke"
     end
   end