Endpoint
Authentication
X-Webhook-Secret header.
Request body — session-based (recommended)
This is the flow the kurnl Marketplace uses. Withsession_id set, the session
supplies the plan, location/unit, MAC address, and delivery mode — only
external_subscription_id is additionally required. Any of the explicit fields
below included alongside a session_id are ignored in favor of the session.
Unlike
/external-checkout/complete,
this endpoint routes on the session’s delivery_mode (direct → provision
immediately, home_drop → PENDING_INSTALL + operator install job) — building
line type does not apply here.Request body — explicit fields (no session)
external_subscription_id is your own per-subscription identifier and acts as the idempotency key.
contact_email (optional, either path) is an e-mail for the household behind the line. It is stored on the
subscription only — no customer record is created. For a home_drop order in a building whose installs need a
technician on site (third line), this is the address the technician booking link is e-mailed to; the
customer picks and manages the visit window from that link. Without it the order still succeeds, but the install
job lands in the kurnl operator queue flagged “No contact e-mail” until the operator adds an address. Later
it also serves the provider’s own outage notices. Leave it out if you do not want to share it; the provider can
add or change it in the portal.
Response — 200 OK
No
subscriber_id is returned — no subscriber record is created.
Replays (same external_subscription_id or already-completed session_id) report the
subscription’s real current status — e.g. PENDING_INSTALL for a home-drop order
still awaiting install.