Accepts an Excel file of locations and an account_id (Account), validates the header row and every data row, stores the file to S3, and emails the admin team to verify before any locations are created. Does NOT create locations itself.

Auth: Both — authentication. Lives in the top-level authenticated group (no partner/*, admin/*, or partner-only access). The endpoint scopes the target by the account_id rule: it must be a company row with bundle_id=3 (Account), not soft-deleted, and pass an ownership check, which walks the auth user's company hierarchy. A Partner (bundle_id=1) can target any Account under their tree; a Account user can target Accounts in their own hierarchy.

Rate limit: No rate limit.

Request

• Body (multipart/form-data):

The endpoint validates each row: address, city, state, zip, business_phone (9-10 digits, no formatting), country_code (must be a known country code), and location_name are required. gbp_name, location_user_phone_number_optional, location_user_email_address_optional (valid email, unique in users, distinct) are optional. Formula values (#NAME?) are rejected.

Response — { data. } envelope. Always HTTP 200 on the happy/validation paths; bad header/empty file returns a badRequest error envelope instead.

• status (string) — "success" on accepted upload, "error" when per-row validation fails.
• message (string) — human-readable status text.
• errors (object, only when status=error) — map keyed by spreadsheet row number (data row index + 2) to an array of error message strings.