It should be possible to check whether the client is authorized to render reports.
It could be either a fixed, pre-shared token or a JWT for which the public signing key is set up in the configuration.
Might be nice, but I'm not sure whether it's required or whether it just creates potential for unexpected behaviour. If the report structure changes with the new upload, it might result in other clients that are trying to process a request while the upload is happening unable to handle the render.
It might be useful to render different reports in a batch, returning a concatenated PDF from all reports.
In that case, instead of receiving a simple JSON object in the form of
{
"reportName": {}
}
which is sent to /render/:reportName, it would receive