External tool does not get a signed URL, for an `allowedApiCall` with a POST request, when issued for a public file

What steps does it take to reproduce the issue?
I am developping an External Tool that is configured for files and as an explore tool, via GET.

  "scope": "file",
  "types": [
    "explore"
  ],
  "toolUrl": "https://dev.ssh.datastations.nl/custom/synth-file-tool.html",
  "contentType": "text/tab-separated-values",
  "httpMethod":"GET",

The callback request works, and I do get URL's that work for doing GET requests on the file or Auxiliary files.
But when I want to create an auxiliary file I get an 'unauthorised' error.
Below the allowedApiCalls fragment I use:

    {
      "name":"uploadAuxFile",
      "httpMethod":"POST",
      "urlTemplate":"/api/v1/access/datafile/{fileId}/auxiliary/synthJson/0.1",
      "timeOut":270
    }

It might be that for explore types signed URL's for POST and PUT are somehow disabled, I would like to have that working, at least for the auxiliary files.
If the curent functionality is expected behaviour by design, and not changed, it should at least be more explicitly mentioned in the documentation.

• When does this issue occur?
  When the file I am 'running' the tool on is publicly available, so not restricted and not in Draft.

So for restricted and Draft it works, which beats the idea that it would be missing because I am not supposed to mutate stuff while 'exploring'.

• What happens?
  The signedUrl value contains jsut a normal URL

• What did you expect to happen?
  I expected a real signed URL, at least for my POST request, which now does not work.

Which version of Dataverse are you using?
version 6.9

Reproduce the allowedApiCall against /api/v1/access/datafile/{fileId}/auxiliary/synthJson/0.1 with a public file, comparing the signedUrl returned for GET and POST. Trace the handling of explore tools and public versus restricted or Draft files; done means the POST receives a usable signed URL, or the limitation is explicitly documented.