Mint a presigned PUT for an upload. Expires in 900 seconds
Requires the scope media.write.
media.write.Authorizations
Tenant credential. This is sufficient by itself.
Headers
Tenant credential: optional and, when sent, must equal the shop bound to the key. Partner credential: required; it selects an organisation the user previously authorised.
Optional client-generated key for write retries. Reusing it with a different request returns 409; a replay includes Idempotency-Replayed: true.
1 - 200Body
Size of the file in bytes. Optional for now — omitting it keeps the old behaviour, where nothing bounds how much the presigned PUT may carry. When supplied it is checked against the per-type cap (25 MB image / 100 MB pdf) AND pinned into the signature, so the upload is rejected by S3 unless its Content-Length matches exactly. Send it whenever the size is known.

