Endpoint
Authentication
X-Webhook-Secret header — your pre-shared webhook secret.
Request body — session-based (recommended)
When the subscriber arrived via a kurnl Marketplace redirect, you have asession_id
(from the ?session_id= query parameter). The session is the source of truth for the
provider, plan, location/unit, delivery mode, and MAC address — you only supply the
subscriber PII:
location_hash or mac_address and they
disagree, the session value wins (the conflict is logged).
Idempotent: a second call with the same session_id returns the existing subscription
without re-provisioning.