Correct. Pass it in as a markdown link.
Nope, because this is the same workflow that is used in the composer UI. You will have to make two api calls, one for the upload and the other to include the URL in post payload.