The preferred way to upload files from a webservice is be to upload to a draft area and then call a specific function to copy from the draft area to the proper component area in Moodle (and apply restrictions at that time).

Currently there is support for uploading direct to the users private files area, but we should deprecate that and provide an alternative which uses the draft area.