External APIs

Vendors

System Auth Used for

Au10tix BOS4 — AU10TIX_API_URL

Authorization: JWT {AU10TIX_TOKEN}

Identity-document verification: POST /IdentityDocuments/BeginProcessingRequest, POST /IdentityDocuments/CheckReadinessOfResults, GET /IdentityDocuments/Results/{id}. See Au10tix.

Entrust Identity Verification (Onfido) — ENTRUST_API_URL

Authorization: Token token={ENTRUST_TOKEN}

Applicants, workflow runs, captured artifacts, workflow-run steps. See Entrust / Onfido.

Thomson Reuters CLEAR S2S — THOMSON_REUTERS_API_URL

HTTP Basic + mutual TLS client certificate

EIDV person search, person/business search and reports (XML). See Thomson Reuters CLEAR.

HubSpot CRM — api.hubapi.com via hubspot-api-client

Private App token HUBSPOT_PRIVATE_APP_TOKEN

Contact search by supplierkey, PATCH entrust_verification_status. See HubSpot.

Payability internal systems

System Used for

Payability Internal API — PAYABILITY_INTERNAL_API_URL

Token validation, user permissions, supplier/owner lookup, and the supplier document store (list, upload, status PATCH). See Payability internal services.

PYB Documents — PYB_DOCUMENTS_URL

Fetching previously uploaded identity-document images for Au10tix.

B2B Task Manager — B2B_TASK_MANAGER_URL

Starting SWF workflow executions. See SWF orchestration.

All three authenticate through PybApiAuth (pyb-sdk), which exchanges PAYABILITY_AUTH_TOKEN for an X-Session-Token.

AWS services

DynamoDB, S3, SWF, EventBridge and CloudWatch at runtime; Secrets Manager, ECR, CodeBuild and CodeDeploy at build/deploy time. See AWS clients and Deployment.

Inbound callers

Caller Surface

Internal admin tooling (source = internal)

Every /tasks, /tools and /entrust/sessions route.

Supplier dashboard (source = supplier_dashboard)

POST /tasks/execute for its own supplier, GET /tools, POST /entrust/sessions for itself.

Supplier onboarding (source = onboarding)

POST /entrust/sessions.

Onfido / Entrust

POST /entrust/webhook (workflow_run.completed, HMAC-signed).

ALB health check

GET /health-check.

EventBridge consumers (outside this repository)

Subscribe to pyb.underwriting.events and pyb.internal.admin.events — EventBridge events.

Vendor specifications

The Onfido Public API v3.6 OpenAPI document is attached to this component for reference:

It is a vendor artifact, not generated from this codebase — refresh it from Onfido when their API version changes, and remember that ENTRUST_API_URL pins the version segment (/v3.6).

Au10tix and Thomson Reuters CLEAR specifications are not vendored here; consult the vendor portals. The CLEAR request shapes actually used are the XML templates in components/thomson_reuters/request_template/.