This is a change in the upload API that happens somewhere between 6.3 and 7.1. I was able to use repos/<repo-id>/upload-link/ to get an upload URL and then use the parent_dir=<...> to specify the directoy I want to upload the file into.

Now in 7.1.1, if I don't give the p= parameter for thhe upload-link request, I get {"error": "Permission denied."} as return value (with status code 200 btw). If I only use p= in thte first request but not the parent_dir= in the second request, I get {"error": "Invalid URL. "} (with a new line before the closing quote, which might be invalid JSON, also 200 status code). I had to provide he directory in both requests. This is fine to work with but is a bit strange. The error return is also a bit strange and give no useful information.....