See CKO-03 Anonymous for the full guide.

Endpoint

Authentication

X-Webhook-Secret header. This is the flow the kurnl Marketplace uses. With session_id set, the session supplies the plan, location/unit, MAC address, and delivery mode — only external_subscription_id is additionally required. Any of the explicit fields below included alongside a session_id are ignored in favor of the session.
Unlike /external-checkout/complete, this endpoint routes on the session’s delivery_mode (direct → provision immediately, home_dropPENDING_INSTALL + operator install job) — building line type does not apply here.

Request body — explicit fields (no session)

external_subscription_id is your own per-subscription identifier and acts as the idempotency key. contact_email (optional, either path) is an e-mail for the household behind the line. It is stored on the subscription only — no customer record is created. For a home_drop order in a building whose installs need a technician on site (third line), this is the address the technician booking link is e-mailed to; the customer picks and manages the visit window from that link. Without it the order still succeeds, but the install job lands in the kurnl operator queue flagged “No contact e-mail” until the operator adds an address. Later it also serves the provider’s own outage notices. Leave it out if you do not want to share it; the provider can add or change it in the portal.

Response — 200 OK

No subscriber_id is returned — no subscriber record is created. Replays (same external_subscription_id or already-completed session_id) report the subscription’s real current status — e.g. PENDING_INSTALL for a home-drop order still awaiting install.

Error codes