diff --git a/modules/backend/src/main/scala/docspell/backend/ops/OCollective.scala b/modules/backend/src/main/scala/docspell/backend/ops/OCollective.scala
index 715e8110..0ed64f2a 100644
--- a/modules/backend/src/main/scala/docspell/backend/ops/OCollective.scala
+++ b/modules/backend/src/main/scala/docspell/backend/ops/OCollective.scala
@@ -8,7 +8,7 @@ import docspell.backend.PasswordCrypt
 import docspell.backend.ops.OCollective._
 import docspell.common._
 import docspell.store.queries.QCollective
-import docspell.store.records.{RCollective, RContact, RUser}
+import docspell.store.records._
 import docspell.store.{AddResult, Store}
 
 trait OCollective[F[_]] {
@@ -41,6 +41,8 @@ trait OCollective[F[_]] {
       kind: Option[ContactKind]
   ): Stream[F, RContact]
 
+  def findSource(sourceId: Ident): F[Option[RSource]]
+
 }
 
 object OCollective {
@@ -156,5 +158,7 @@ object OCollective {
       ): Stream[F, RContact] =
         store.transact(QCollective.getContacts(collective, query, kind))
 
+      def findSource(sourceId: Ident): F[Option[RSource]] =
+        store.transact(RSource.find(sourceId))
     })
 }
diff --git a/modules/restserver/src/main/scala/docspell/restserver/routes/UploadRoutes.scala b/modules/restserver/src/main/scala/docspell/restserver/routes/UploadRoutes.scala
index b14e4aac..322486a0 100644
--- a/modules/restserver/src/main/scala/docspell/restserver/routes/UploadRoutes.scala
+++ b/modules/restserver/src/main/scala/docspell/restserver/routes/UploadRoutes.scala
@@ -1,5 +1,6 @@
 package docspell.restserver.routes
 
+import cats.data.OptionT
 import cats.effect._
 import cats.implicits._
 
@@ -43,11 +44,21 @@ object UploadRoutes {
     import dsl._
 
     HttpRoutes.of {
-      case req @ POST -> Root / "item" / Ident(id) =>
-        submitFiles(backend, cfg, Left(id))(req, None, Priority.Low, dsl)
+      case req @ POST -> Root / "item" / Ident(srcId) =>
+        (for {
+          _ <- OptionT(backend.collective.findSource(srcId))
+          res <- OptionT.liftF(
+            submitFiles(backend, cfg, Left(srcId))(req, None, Priority.Low, dsl)
+          )
+        } yield res).getOrElseF(NotFound())
 
-      case req @ POST -> Root / "item" / Ident(itemId) / Ident(id) =>
-        submitFiles(backend, cfg, Left(id))(req, Some(itemId), Priority.Low, dsl)
+      case req @ POST -> Root / "item" / Ident(itemId) / Ident(srcId) =>
+        (for {
+          _ <- OptionT(backend.collective.findSource(srcId))
+          res <- OptionT.liftF(
+            submitFiles(backend, cfg, Left(srcId))(req, Some(itemId), Priority.Low, dsl)
+          )
+        } yield res).getOrElseF(NotFound())
     }
   }