Python Pyramid

Explicit, conflict-checked configuration. A Configurator records what you register (routes, views, predicates, tweens, security policy). Pyramid detects conflicting registrations at startup and resolves them with a clear rule, which makes config.include() a safe composition mechanism for large applications and add-ons.

Two ways to find a view. URL dispatch maps patterns such as /api/books/{id} to routes, and traversal walks a tree of resources, so the URL /shelves/ada/dune becomes a context object that carries its own permissions. Both can be combined in one application.

Security as a first-class layer. A single security policy decides who the user is and what they may do, and per-object access control lists are inherited down the resource tree.

know Python and want a framework that stays out of the way for small services but offers fine-grained authorization, hierarchical resources and extensibility for large ones

are coming from Flask or Django and want to understand what Pyramid does differently, and when it is the better choice (see Introduction & Architecture, the Flask introduction and the Django introduction)

maintain an existing Pyramid application and need the 2.x idioms (security policy, pyproject.toml, SQLAlchemy 2.0, JSON-only sessions) rather than the patterns in older tutorials

public shelves owned by users, addressed by traversal (/shelves/{shelf}/{book}), with access control lists inherited from the shelf: owners edit, everyone else reads

a JSON API under URL dispatch (/api/books/{id}) using the json renderer and __json__

SQLAlchemy 2.0 with pyramid_tm and Alembic (the cookiecutter sqlalchemy backend) and Jinja2 templates through pyramid_jinja2

a security policy built on AuthTktCookieHelper, CSRF protection on forms, and Deform and Colander forms

English and Spanish translations, a timing tween, the debug toolbar in development, WebTest functional tests, and Waitress or Gunicorn deployment