feat(events): add event posting

Cargo.toml

@@ -170,6 +170,7 @@ jaq-json = { version = "2.0.1", features = ["serde"] }
 
 [target.'cfg(not(target_arch = "wasm32"))'.dependencies]
 reqwest = { version = ">=0.13, <0.13.3", features = ["stream"] }
+gethostname = "1"
 
 [dev-dependencies]
 mockito = "1"

docs/COMMANDS.md

@@ -38,7 +38,7 @@ pup <domain> <subgroup> <action> [options] # Nested commands
 | static-analysis | custom-rulesets (get, update, delete), custom-rules (get, create, delete, revisions, revision) | src/commands/static_analysis.rs | ✅ |
 | downtime | list, get, cancel | src/commands/downtime.rs | ✅ |
 | tags | list, get, add, update, delete | src/commands/tags.rs | ✅ |
-| events | list, search, get | src/commands/events.rs | ✅ |
+| events | post, list, search, get | src/commands/events.rs | ✅ |
 | on-call | teams (CRUD, memberships) | src/commands/on_call.rs | ✅ |
 | audit-logs | list, search | src/commands/audit_logs.rs | ✅ |
 | api-keys | list, get, create, delete | src/commands/api_keys.rs | ✅ |
@@ -125,6 +125,7 @@ pup events search --query="@user.id:12345"
 pup <domain> create [--flags]
 pup <domain> update <id> [--flags]
 pup <domain> delete <id> [--yes]
+pup events post --tags="version:1,application:web" --no_host --type=my_apps --aggregation_key=application:web --alert_type=info "Something big happened!" "And let me tell you all about it here!"
 ```
 
 ### Nested Commands
@@ -144,7 +145,7 @@ pup infrastructure hosts list
 - **dbm** - Database Monitoring query samples (samples search)
 - **traces** - APM spans metrics (list, get, create, update, delete)
 - **rum** - Real User Monitoring (apps, metrics, retention-filters, sessions)
-- **events** - Infrastructure events (list, search, get)
+- **events** - Infrastructure events (post, list, search, get)
 - **ddsql** - DDSQL queries and discovery (table, time-series, spec, schema)
 - **symdb** - Symbol Database queries (search scopes, probe locations)
 

src/client.rs

@@ -724,6 +724,14 @@ static OAUTH_EXCLUDED_ENDPOINTS: &[EndpointRequirement] = &[
         path: "/api/ui/profiling/",
         method: "GET",
     },
+    // Events intake (1)
+    // Posting an event uses the V1 intake endpoint, which authenticates with the
+    // API key and does not accept OAuth2 bearer tokens. Listing/getting events
+    // (GET) is fine over OAuth, so only POST is excluded.
+    EndpointRequirement {
+        path: "/api/v1/events",
+        method: "POST",
+    },
 ];
 
 // ---------------------------------------------------------------------------
@@ -1288,6 +1296,13 @@ mod tests {
         assert!(!requires_api_key_fallback("POST", "/api/v2/events/search"));
     }
 
+    #[test]
+    fn test_fallback_for_events_post() {
+        // Posting an event (V1 intake) requires API keys; reading events does not.
+        assert!(requires_api_key_fallback("POST", "/api/v1/events"));
+        assert!(!requires_api_key_fallback("GET", "/api/v1/events"));
+    }
+
     #[test]
     fn test_no_fallback_for_standard_endpoints() {
         assert!(!requires_api_key_fallback("GET", "/api/v1/monitor"));
@@ -1324,7 +1339,7 @@ mod tests {
 
     #[test]
     fn test_oauth_excluded_count() {
-        assert_eq!(OAUTH_EXCLUDED_ENDPOINTS.len(), 54);
+        assert_eq!(OAUTH_EXCLUDED_ENDPOINTS.len(), 55);
     }
 
     #[test]