Writing something directly to the OneBox database is not worth it (even "not allowed").
OneBox is not software that is written "from the database". Not so simple.
The OneBox database itself is not normalized according to all the canons of ANSI SQL. It's the price of performance for OneBox to be able to digest tens of millions of contacts and tens of millions of orders.
In simple words (for those who are not in the subject of SQL'a) - the same data can be duplicated in different cells of different tables. For sample performance.
The OneBox database is controlled by the so-called ORM SQLObject. This is an important story:
when OneBox is updated, SQLObject looks at which columns to add, which to remove, for which to change the data type. If you add a column to the database, it's okay, SQLObject won't touch it. But, if you manually change the column, SQLObject will return the data type in place in 1 minute according to the ORM configuration.
No one should be tied to OneBox'a database - because we are changing it.
We can easily rename the table, create a new table structure and convert data between them even within the same version, and the client will not even notice it.
---
Knowing how the billing systems of providers are usually arranged, I can say that the database there changes incredibly rarely. And it is much more correct and reliable to use such options:
Option 1 is the correct one
OneBox knocks on the billing API and changes what is needed there.
If there is no API, you can make quite specific php/perl/python/cgi scripts that will accept GET/POST parameters and run the required SQL.
Option 2
There is a certain script on the billing side (or close to it), which knocks on the OneBox API, receives the data, then changes the SQL in the billing.
Option 3
Transfer billing to OneBox'a side.
I understand that you will not agree to this now, but in fact even the first version of OneBox'a
https://crm-onebox.com/en/version/ started with billing for the Internet provider and OneBox directly conducted billing and controlled raduis servers . Ah, those were good times :)
---
The coolest option 1 - make on your side a mega-simple API, without authorization (well, or IP restricted authorization), which will only do the necessary addition of a user update.
I understand that this is not an easy task.
Give the contact of a techie who cuts billing directly - and I will solve it. Only a techie directly, if there is some kind of manager and he will coordinate something - oh, that's all :)