diff --git a/deploy/convert_server.py b/deploy/convert_server.py
index 3e408b4..f9067d4 100755
--- a/deploy/convert_server.py
+++ b/deploy/convert_server.py
@@ -62,9 +62,9 @@ class Handler(BaseHTTPRequestHandler):
             self._handle_llm_ops()
         elif self.path == "/convert-doc":
             self._handle_convert_doc()
-        elif self.path == "/classify-batch":
+        elif self.path == "/api/classify-batch":
             self._handle_classify_batch()
-        elif self.path == "/apply-groups":
+        elif self.path == "/api/apply-groups":
             self._handle_apply_groups()
         else:
             self.send_error(404)
diff --git a/deploy/services/upload.py b/deploy/services/upload.py
index 7b5c091..354fc7f 100644
--- a/deploy/services/upload.py
+++ b/deploy/services/upload.py
@@ -32,6 +32,12 @@ def handle_upload(rfile, content_type, content_length):
         contract_id = fs.getfirst("contract_id", "")
 
     batch_id = fs.getfirst("batch_id", None) if "batch_id" in fs else None
+    # Validate UUID
+    if batch_id:
+        try:
+            uuid.UUID(batch_id)
+        except (ValueError, AttributeError):
+            batch_id = None
 
     if not filename or not file_data:
         return {"ok": False, "error": "no file in request"}