Start an upload session

Starts a single-use link that a person sends one photo through, with no API key: for an agent that never holds the photo. Send the upload_url to the person; they open it to choose the photo, or send it with curl -T photo.jpg <upload_url>. Treat the link as opaque, like a presigned URL: it takes a PUT of the image bytes with their Content-Type and no API key, and answers 201 with the stored session. The first stored photo wins and a later send answers 409 UPLOAD_ALREADY_USED; a refused body (413, 415, 422) leaves the link usable; an unknown, expired or revoked link answers 404 UPLOAD_NOT_FOUND. The link works once and expires at expires_at (15 minutes); the photo is held to max_bytes and content_types, the limits of POST /v1/assets. Read the session until it is stored, then retain its asset_id as evidence. upload_url carries the link’s secret, which is stored only as a digest: it is in this answer only. Send an Idempotency-Key: it is required, and a retry with the same key answers the same session with upload_url null and Idempotency-Replayed: true; start a new session for a new link. Requires the digitisation.write scope; served only where digitisation and upload sessions are enabled for your environment.