Do we need this REST endpoint to be available on the global admin router?

Also maybe, `/api/publications/created/:userId` as you don't necessarily have to *upload* something?