You can upgrade appliances by POSTing an upgrade package (.npf or .rpm) using the REST service.
If you point a browser to this URL, the web page lets you select an upgrade package to upload.
Is this something a customer would ever do? Wouldn't they just go through the "regular" upgrade process? Is this the kind of thing internal RSA people might do to save time, rather than a typical workflow for a customer or client?