Start with what a submission stores and how to read or export one: the levels it is stored at, the flattened answers, and exporting without turning an export into a leak. File uploads and retention and privacy both build on that: where an uploaded file goes and who can open it, then what the platform keeps, for how long, and how to delete it on request.
Submitting a form through the API comes last: sending a submission from a front end Core dna does not serve at all, with the same three routes, statuses and submission models a page's own form already uses behind the scenes (Multi-step forms).