See the full guide: CKO-03 Direct Delivery and CKO-03 Home-Drop Delivery.

Endpoint

Authentication

X-Webhook-Secret header — your pre-shared webhook secret. When the subscriber arrived via a kurnl Marketplace redirect, you have a session_id (from the ?session_id= query parameter). The session is the source of truth for the provider, plan, location/unit, delivery mode, and MAC address — you only supply the subscriber PII:
If both the session and your payload carry a location_hash or mac_address and they disagree, the session value wins (the conflict is logged). Idempotent: a second call with the same session_id returns the existing subscription without re-provisioning.

Request body — explicit fields (no session)

For flows that do not go through a Marketplace session, pass the provisioning fields yourself:

Response — 200 OK (direct delivery)

Response — 200 OK (home-drop)

Error codes