Create Records

Accept a JSON array of records for the authenticated entity.

202, not 201: the records are stored as source data, and turning them into accounting objects is a separate transform — so this reports acceptance, not that anything has been booked.

All-or-nothing: any invalid record rejects the whole batch and writes nothing, so a caller never has to work out which half landed.

def, NOT async def — do not "fix" this by adding an await. Everything below is blocking: session.commit() is psycopg2, and push_cores is a requests.post with a 60-second timeout. On the event loop those two would stall every other request sharing the worker, so one slow Leapfin becomes an outage rather than one slow submission. FastAPI runs a sync endpoint in its threadpool, which is where blocking work belongs.

The body read still happens on the loop, as an async DEPENDENCY: FastAPI awaits those before dispatching the endpoint, and the two choices are independent. So the size guard keeps its streaming behaviour — taking the body as Body(bytes) instead would let Starlette buffer an unbounded body before any check of ours ran, which is the whole thing _read_within_limit prevents.