Accepts one row per observed pull from a registry collector. Rows are keyed on the source CloudTrail event_id, so resubmitting the same events is a no-op and at-least-once delivery is safe. The tenant is taken from the API key, never the body. Does not trigger scans and does not consume the scan quota.

Rows are validated individually: a malformed row is reported in rejections rather than failing the batch, so a poison row cannot strand a whole delivery.