Step 1 of the three-step direct upload. File bytes never travel through this API; they go straight to storage.

1. POST /files/upload-url — declare usage, content_type and size_bytes. The response carries the new file_id and a presigned url, and the file starts in status pending.
2. PUT the bytes to that url, with Content-Type equal to the declared content_type and Content-Length equal to size_bytes. Both are signed into the URL, so storage rejects a PUT that deviates from either. Send no API credentials on this request.
3. POST /files/{file_id}/confirm — the file flips to uploaded and can be used.

kind is derived from content_type and must be one the declared usage allows; size_bytes must fit that kind's limit. GET /files/constraints lists both. Past expires_at the URL no longer works — request a new one, which creates a new file.