I’m not sure I understand your response here. I totally get what you’re saying about API’s being availble internally, not externally. I got that the first time.
All I said was, IF they don’t have any test boxes external to their network, they’re not actually doing any real testing, and they need to address this. Testing on their internal server network would be the first stage. But, you can’t learn what problems users will have until you test outside the development environment.
This is not an obscure bug. It’s a major issue with their test regimen if they don’t have test machines on external networks. And it would be ridiculous if they think that testing in the development environment is enough.