Merged last, so they override anything the rig sets — including x-webhook-secret.
For whatever auth the source needs: { "authorization": "Basic …" }.
data (hex){ device, data, seqNumber } — the downlink comes back in the response, no ack flag
Merged into every message, over the template — any top-level field the backend would send
(Sigfox: rssi, station, infoCode; LoRaWAN: received_at, fCnt…).