change photos to a get api since it will return the photo upload SAS