We are planning/spec'ing a REST API for communication with an iOS app an external team is building. For most calls, the API key hardcoded into the application and a session ID produced on our side after user authentication are required or else the call is ignored (401, 403 or similar).
There is one endpoint we are planning, however, for error reporting. Errors in the app can occur during authentication, and if we want to use this endpoint to receive reports on those, this call cannot require a session id.
The goal, and the question, is to find a way to detect and ignore "spam" by attackers who have sniffed the API and pound on it with garbage reports. I know this won't prevent a full-on DoS as the API must digest the call to determine if it's legit, but it will reduce pollution of the error logging store on our servers.
The simplest answer I can think of is, don't use it for pre-authentication errors. We can log authentication attempts, pass or fail, as we receive those calls, and if we don't receive those calls from the app we likely wouldn't receive the resulting error report either.
Are there any good alternatives to allow the app to report errors encountered prior to successful user authentication while still avoiding this method being too open to spamming?