Create a publisher draft with uploaded source files.

Publisher/admin only. Uploads use strict base64 JSON for small releases; invalid placeholders, size mismatches, executable/high-risk files, and scanner findings are rejected. Requires a publisher or admin bearer token; public docs include this so creators and agents can prepare valid submissions without scraping UI forms.

Inputs. No path or query fields are required. The request body schema lists accepted fields and required values.

Outputs. See each status below for its media type, schema and headers. A missing record or unavailable capability is not a successful empty result.

Errors. API JSON failures use the documented response schema. Read code, message and next; retry only when the response allows it. Auth, invalid input and missing records need a caller change.

Rate limits. Write and protocol operations can have separate route-specific limits. Read Retry-After and retry_after_s when present; do not infer a write allowance from the public read budget.

Example setup. Set HUGGING_BAY_TOKEN to a credential with the role or scope stated by this operation. Reader tokens do not grant publisher or operator rights. This example is not executed by documentation checks. Review the operation and obtain any required user consent before sending it.