So then it would be the first one.
Check the body / header of the request if have any media fields. if you log out ctx you should see it im guessing in the body. Where you can then do further get requests etc.
I would say if you dont have it create a custom endpoint where you can deal with this. You can also extend the upload endpoint etc. To do the checks you want.