REST API

ApiFunction serves a flask-restx API plus a few plain Flask views. The current contract is the set of endpoints listed below; the flask-restx Swagger document and UI are disabled.

Base URLs

Environment Base URL

Production (custom domain)

https://api.payability.com/eventlogger_v2

Production (direct)

https://<RulesApiId>.execute-api.us-east-1.amazonaws.com/prod/eventlogger_v2

Staging

https://<RulesApiId>.execute-api.us-east-1.amazonaws.com/stage

Routes live under API_BASE_PREFIX (/eventlogger_v2 in production, empty in staging). /track and /tracking/…​ are also served without the prefix, for the track and tracking base paths on api.payability.com that older clients use. RulesApiId is a stack output.

Authentication

Every method of RulesApi goes through PayabilityAPIGatewayAuthorizer first, the same Lambda request authorizer (pyb-api-gateway-authorizer:live) the Zappa API used. It is keyed on the Host header and caches its decision for an hour. The deployed version allows every request, so today it changes nothing; it is there so the API picks up any rule added to it later.

Authentication of the caller comes from pyb-flask-utils and differs per endpoint group:

Endpoints Authentication

flask-restx namespaces (rules, templates, history, constants, simulate, trigger, events)

X-Session-Token, validated against the internal API (/token/validate), plus X-InstanceId, which the caller must be authorised for

/capture-message

Instance authentication (requires_auth)

/es/<path>, /es-changelog

RSA-signed JWT (requires_auth_jwt_rsa, key AUTH_JWT_RSA_PUBLIC_KEY)

/track, /tracking/, /tracking/history/

None: used by the JavaScript SDK’s tracking pixel

Endpoints

Path (under the base URL) Methods Purpose

/event_rules/

GET, POST

List and create rules (at most EVENT_RULE_LIMIT rules in total, 100)

/event_rules/<uuid>/

GET, PUT, PATCH, DELETE

Read, replace, update or delete a rule

/action_templates/

GET, POST

List and create action templates

/action_templates/<uuid>/

GET, PUT, DELETE

Read, replace or delete an action template

/event_rules_history/event_rule/<uuid>/

GET

Executions of one rule

/event_rules_history/target/<uuid>/

GET

Executions for one target (for example a supplier)

/constants/rules, /constants/actions, /constants/statuses

GET

Selectors, operators, actions and statuses for the CRM rule editor

/simulate/filters, /simulate/rules

POST

Evaluate filters or rules against a sample event, without running actions

/trigger/rules

POST

Run the rules for an event now, including their actions

/events/stream

POST

Event search; answers 503 while search is disabled

/capture-message

GET, POST

Capture an event (stage 0)

/track

POST

Capture a tracking event (stage 0)

/tracking/, /tracking/history/

GET

Tracking data and first contact for a target or owner

/es/<path>, /es-changelog

GET, POST, PUT

Search passthrough and object changelog

/trigger/rules, /capture-message and /track have side effects in the target environment: they publish real events or run real actions. Use /simulate/…​ to test rules.

Response format

Responses use the pyb-flask-utils envelope:

{
  "data": {},
  "meta": {"errors": []},
  "status_code": 200
}

Validation errors and authentication failures put a list of {"message", "type"} objects in meta.errors.