diff --git a/admin/admin.go b/admin/admin.go
index 5b92549..de33334 100644
--- a/admin/admin.go
+++ b/admin/admin.go
@@ -12,7 +12,10 @@ import (
 	"hacklab.nilfm.cc/quartzgun/router"
 	. "hacklab.nilfm.cc/quartzgun/util"
 	"html/template"
+	"io/ioutil"
 	"net/http"
+	"os"
+	"path/filepath"
 )
 
 func apiGetTableList(next http.Handler, udb auth.UserStore) http.Handler {
@@ -135,6 +138,7 @@ func apiDestroyTable(next http.Handler, udb auth.UserStore, dbAdapter mongodb.Db
 			} else {
 				w.WriteHeader(404)
 			}
+			next.ServeHTTP(w, req)
 
 		} else {
 			w.WriteHeader(500)
@@ -145,13 +149,63 @@ func apiDestroyTable(next http.Handler, udb auth.UserStore, dbAdapter mongodb.Db
 	return http.HandlerFunc(handlerFunc)
 }
 
-func apiUploadMapImg(next http.Handler, udb auth.UserStore, dbAdapter mongodb.DbAdapter) http.Handler {
+func apiUploadMapImg(next http.Handler, udb auth.UserStore, dbAdapter mongodb.DbAdapter, uploads, uploadType string, uploadMax int) http.Handler {
 	handlerFunc := func(w http.ResponseWriter, req *http.Request) {
+		// get table from request body
+		tableKey := models.TableKey{}
+		err := json.NewDecoder(req.Body).Decode(&tableKey)
+		if err != nil {
+			w.WriteHeader(400)
+			next.ServeHTTP(w, req)
+			return
+		}
+
+		// check if this table exists
+		if !dbAdapter.CheckTable(tableKey) {
+			w.WriteHeader(401)
+			next.ServeHTTP(w, req)
+			return
+		}
+
 		// ensure data storage dir exists
+		info, err := os.Stat(uploads)
+		if !info.IsDir() {
+			w.WriteHeader(500)
+			next.ServeHTTP(w, req)
+		} else if err != nil {
+			err = os.MkdirAll(filepath.Join(uploads, tableKey.Name, uploadType), 0755)
+			if err != nil {
+				w.WriteHeader(500)
+				next.ServeHTTP(w, req)
+			}
+		}
 		// check for filename; call create to overwrite regardless
 		// get file data from multipart form
+		req.ParseMultipartForm(int64(uploadMax << 20))
+		file, header, err := req.FormFile("file")
+		if err != nil {
+			w.WriteHeader(500)
+			next.ServeHTTP(w, req)
+		}
+		fileData, err := ioutil.ReadAll(file)
+		if err != nil {
+			w.WriteHeader(500)
+			next.ServeHTTP(w, req)
+		}
 		// write to file
-		// respond with URL?
+		destPath := filepath.Join(uploads, tableKey.Name, uploadType, header.Filename)
+		dest, err := os.Create(destPath)
+		if err != nil {
+			w.WriteHeader(500)
+			next.ServeHTTP(w, req)
+		}
+		dest.Write(fileData)
+		dest.Close()
+		// respond with URL so UI can update
+		w.WriteHeader(201)
+		w.Header().Set("Content-Type", "application/json")
+		AddContextValue(req, "location", "/uploads/"+tableKey.Name+"/"+uploadType+"/"+header.Filename)
+		next.ServeHTTP(w, req)
 	}
 
 	return http.HandlerFunc(handlerFunc)
@@ -172,9 +226,9 @@ func CreateAdminInterface(udb auth.UserStore, dbAdapter mongodb.DbAdapter, uploa
 	rtr.Delete(`/api/table/(?P<Slug>\S+)`, Validate(apiDestroyTable(renderer.JSON("result"), udb, dbAdapter), udb, scopes))
 
 	// asset management
-	// POST /api/upload/<table>/map/
+	rtr.Post(`/api/upload/(?P<Slug>\S+)/map/`, Validate(apiUploadMapImg(renderer.JSON("location"), udb, dbAdapter, uploads, "map", uploadMaxMB), udb, scopes))
 	// DELETE /api/upload/<table>/map/<map>
-	// POST /api/upload/<table>/token/
+	rtr.Post(`/api/upload/(?P<Slug>\S+)/token/`, Validate(apiUploadMapImg(renderer.JSON("location"), udb, dbAdapter, uploads, "token", uploadMaxMB), udb, scopes))
 	// DELETE /api/upload/<table>/token/<token>
 
 	return http.HandlerFunc(rtr.ServeHTTP)