Never mind, found the answer. Should’ve watched the V4 deep dive more closely, about the REST API at around the 5:07 mark. Strapi auto filters relations. To get relations if anyone is wondering is to use the populate field in the call. Example to get all relations is : GET /api/books?populate=*
I just tried out uploading image from url and accessing via the upload/file api call and it looks like it works. It might be that you need to open up some of the security settings for upload files.