Payability internal API

Setting

PAYABILITY_INTERNAL_API_URL — https://internal.payability.com/bin/internal/ (prod), https://staging.dev.payability.com/database_v2/internal/ (stage)

Code

tools/utils.py, validators in pyb_flask_utils.access

Uses, all with the caller’s X-Session-Token:

Call Purpose

Call	Purpose
`OwnerValidator("CRM_ADMIN", …)`	May this user change owner-only fields of an item? (tasks, comments, files)
`UserReadOnlyValidator`	Read-only users.
`PermissionCheckingValidator`	`GET /settings/`.
`SupplierReadUpdateValidator`	May this user read/update this supplier? (notifications)
`GET /logins/<uuid>` (`get_user`)	Owner email for notifications; creator email when a task is resolved.

OwnerValidator("CRM_ADMIN", …)

May this user change owner-only fields of an item? (tasks, comments, files)

UserReadOnlyValidator

Read-only users.

PermissionCheckingValidator

GET /settings/.

SupplierReadUpdateValidator

May this user read/update this supplier? (notifications)

GET /logins/<uuid> (get_user)

Owner email for notifications; creator email when a task is resolved.

pyb_flask_utils.auth also reads PAYABILITY_INTERNAL_API_URL at import time — it must be set before the app is imported (it is: secrets_loader and the Lambda environment).

Both environments run in a VPC so this call is not made from a public Lambda IP. Production uses subnet-adecc0c8, subnet-4f415d16, and sg-6c6f230a. Stage uses the dev VPC (subnet-0f2f29c7510986dd0, subnet-0b027bfee9b60750e, sg-05fdec837243c8245); staging.dev.payability.com returns 403 to public Lambda addresses and 200 to that NAT.