I can't see any restrictions in the documentation about authentication methods working for GET but not for POST.
Specifically, if I GET the attendance using GET /:urlname/events/:id/attendance with the "key" parameter set to my API key, I get a valid response (all the attendance of the event).
But if I use POST to try to set an attendance using POST /:urlname/events/:id/attendance also with the "key" parameter set to my API key, it comes back with JSON body:
{"errors":[{"code":"authentication_error","message":"Authenticated member required"}]}
In both GET and POST I am testing just using "curl" on a Linux server, so the format of the underlying HTTP should be fine.
I am an Assistant Organizer in this group, and I can successfully take attendance, etc., through the web.
This is the first POST API that I have tried, but I have used GET APIs for several years without issues.