Settings & secrets reference

Generated by settings_setup.py (non-secret) and config_setup.py (secret). Loading model and gotchas: Configuration & secrets.

default block

Environment-independent values, written for every environment.

Setting Value

ENV_NAME

The ENV_NAME environment variable (also echoed here).

PROJECT_NAME

automatic-uw-tool

SENTRY_DSN

The shared Sentry DSN.

ENTRUST_API_URL

https://api.us.onfido.com/v3.6

ENTRUST_WORKFLOW_ID

41aa2ce5-7c0e-4dbe-91c3-12e058a2d1cf

THOMSON_REUTERS_PERMISSIBLE_PURPOSE_GLB

B

THOMSON_REUTERS_PERMISSIBLE_PURPOSE_DPPA

3

THOMSON_REUTERS_PERMISSIBLE_PURPOSE_VOTER

5

THOMSON_REUTERS_CERT_FILE_PATH

config/thomson_reuters/cert.pem

THOMSON_REUTERS_KEY_FILE_PATH

config/thomson_reuters/key.pem

THOMSON_REUTERS_BASE64_PFX_FILE_PATH

config/thomson_reuters/file.pfx.base64

THOMSON_REUTERS_PFX_FILE_PATH

config/thomson_reuters/main.pfk

SWF_APP_THREADS

5

SWF_WORKFLOW_TYPE

Update Amazon SC Earnings

SWF_WORKFLOW_TYPE_VERSION

1.1

SWF_AUTOMATIC_UW_TOOL_TASK_LIST

automatic-uw-tool-task-list

ENTRUST_API_URL and ENTRUST_WORKFLOW_ID live in default, so dev environments talk to the same Onfido workflow as production — only the ENTRUST_TOKEN differs (it comes from the account’s own secret).

Per-environment block

Setting release dev (<env>)

AUTOMATIC_UW_TOOL_URL

https://automatic-uw-tool.payability.com

https://<env>.dev.payability.com/automatic-uw-tool-web-api

THOMSON_REUTERS_API_URL

https://s2s.thomsonreuters.com/api

https://s2s.beta.thomsonreuters.com/api

AU10TIX_API_URL

https://payability.au10tixservices.com/Au10tixBos4

https://payability.au10tixservicesstaging.com/Au10tixBos4

SWF_DOMAIN

B2B

<env>

B2B_TASK_MANAGER_URL

https://workflow.payability.com/b2btaskmanager

https://<env>.dev.payability.com/b2btaskmanager

B2B_TASK_MANAGER_GCI

1

The first six digits of sha1(<env>)

PYB_DOCUMENTS_URL

https://pyb-documents.payability.com

https://<env>.dev.payability.com/pyb-documents

PAYABILITY_INTERNAL_API_URL

https://api.payability.com/v1/mp

https://<env>.dev.payability.com/database_v2

S3_DATALAKE_BUCKET

payability-datalake

dev-payability-datalake

EVENT_BUS_NAME

prod_workers

<env>

EVENT_LOGGER_URL

https://api.payability.com/eventlogger/

An API Gateway stage URL (https://drkrpkdxe4.execute-api.us-east-1.amazonaws.com/stage/)

EVENT_LOGGER_INSTANCE_ID

8001

8001

SENTRY_ENV

production

<env>

SUPPLIER_DATA_VALIDATION_TASK_TABLE_NAME

automatic-uw-tool-task

automatic-uw-tool-task-<env>

FINAL_STATUS_TABLE_NAME

automatic-uw-tool-final-status

automatic-uw-tool-final-status-<env>

TOOL_TABLE_NAME

automatic-uw-tool-tool

automatic-uw-tool-tool-<env>

CHANGELOG_TABLE_NAME

automatic-uw-tool-changelog

automatic-uw-tool-changelog-<env>

FAST_API_DOCS_URL

None

/docs

FAST_API_REDOC_URL

None

/redoc

FAST_API_ROOT_PATH

/

/automatic-uw-tool-web-api

FAST_API_CORS_ALLOW_ORIGIN

.*.payability.com

.*.dev.payability.com

Secrets

Written to config/.secrets.json by config_setup.py, then read as ordinary settings.* keys.

Setting Source Used by

everything in the automatic_uw_tool secret

Secrets Manager automatic_uw_tool

Copied verbatim — any key added there becomes settings.<KEY>.

AU10TIX_TOKEN

prod/au10tix/token (prod) or test/au10tix/token (dev)

Authorization: JWT … on Au10tix calls.

THOMSON_REUTERS_USER, THOMSON_REUTERS_PASSWORD

automatic_uw_tool

HTTP Basic auth on CLEAR calls.

PAYABILITY_AUTH_TOKEN

automatic_uw_tool

PybApiAuth in every internal client — exchanged for an X-Session-Token carrying PermCode.INT_LOGIN.

ENTRUST_TOKEN

automatic_uw_tool

Authorization: Token token=… on Onfido calls.

ENTRUST_WEBHOOK_TOKEN

automatic_uw_tool

HMAC key for the X-SHA2-Signature on POST /entrust/webhook.

HUBSPOT_PRIVATE_APP_TOKEN

automatic_uw_tool

HubSpot Private App token for the entrust_verification_status sync.

EVENT_LOGGER_KEY

automatic_uw_tool

Auth key for the internal EventLogger service that supplier events are emitted to.

Supplier-event emission needs all three of EVENT_LOGGER_URL, EVENT_LOGGER_INSTANCE_ID and EVENT_LOGGER_KEY. Leaving the URL empty is a supported way to disable emission in an environment — the client logs a warning once and becomes a permanent no-op for that process.

Thomson Reuters certificate material

Environment Path

release

The secret /thomsonreuters/s2s/production/v3 provides base64_pfx and pfx_pass → config/thomson_reuters/file.pfx.base64 and pfx_password.txt. The build decodes the PFX and extracts cert.pem / key.pem with openssl.

dev

The secret thomsonreuters/s2s/test provides ready-made PEMs under crt.pem / key.pem, written straight to config/thomson_reuters/cert.pem and key.pem (escaped newlines restored).

Environment variables (not Dynaconf)

Variable Purpose

ENV_NAME

Chooses the environment block that settings_setup.py writes. Required.

ENV_FOR_DYNACONF

Chooses the block Dynaconf reads. Must equal ENV_NAME.

ENV_TYPE

Build-time only: dev selects the dev AWS account in buildspec.yml.

GIT_TOKEN

Installs the private pyb-sdk / eventlogger dependencies.

AWS_ACCOUNT, ROOT_PATH, NAME_TAG, APP_NAMES

Build/tagging inputs for buildspec.yml and docker-compose.yml.

API_HOST, API_PORT

Makefile-only, for make run-api.

Adding a setting or a secret

  1. Non-secret — add it to settings_setup.py (default block if it is environment-independent, otherwise both branches), regenerate config/settings.json, and document it above.

  2. Secret — add the key to the automatic_uw_tool Secrets Manager entry in both AWS accounts. config_setup.py copies it through automatically; no code change is needed. Document it above.

  3. Read it as settings.<KEY> — never os.getenv. If a missing value must not crash the process, read it defensively (getattr(settings, 'KEY', None)) as the webhook secret does.