Merged last, so they override anything the rig sets — including x-webhook-secret.
For whatever auth the source needs: { "authorization": "Basic …" }.
data (hex)Merged into every message, over the template — any top-level field the backend would send
(Sigfox: rssi, station, infoCode; LoRaWAN: received_at, fCnt…).