I did notice one potential flaw in the way your API/website works, though, which is that raw access to the uploaded files is enabled regardless of content type. This allows people to use your website to host scripts and other malicious files that they can reuse to execute XSS attacks against other websites. This is mostly a problem for the other website (which would lack proper security headers) but it could lead to Google blacklisting your website for "hosting malware". Some phone scammers leverage websites like yours that try to provide a simple, cheap service to host their fake virus warnings and such.

I'd personally recommend against allowing text content to be directly accessible with a single GET request from another source.

You've set up some protections against this (rate limiting mode) but that could be circumvented by pointing a browser at the file viewer and placing something heavy on the F5 key. I'd personally also check the origin/referrer headers for files that aren't images or video and block their direct inclusion in some way.