These days, VoIP is very complex. It is hard for some people to make a difference where some elements start their role and when others end. This is the case of provisioning; provisioning is the fact of letting the SIP Endpoints pull the needed information (SIP credentials, contacts, buttons actions and more).
Usually, an IP telephone tries to pull the information using a file storage protocol like FTP, TFTP or HTTP. HTTP (or HTTPS) is the most common. I will talk about it because FusionPBX supports it out of the box, however, you are free to use whatever you want. This call depends on your IP phone brand.
The endpoint will send an HTTP request using a specific URL. Some phones will do something like 0123456789af.xml (using the mac address in the GET URL) or a static request with a specific user agent string like Grandstream phones with a value of Grandstream Model HW GXP2135 SW 1.0.7.97 DevId 000b828aa872.
When the request arrives, the PHP scripts from the FusionPBX will pull data from the database. I am assuming there is no HTTP authentication in this article. The provisioning script will answer with a 200 error code and the correct payload. If you are using FusionPBX you can type a command like wget -O - 'http://domain/app/provisioning/index.php?mac=0123456789ab' to verify the payload.
The provisioning is done. From this point, the SIP REGISTER event is in the normal SIP flow, regardless if you are using provisioning or not.
The IP phone will then send a REGISTER event. The first time, the payload will not have the proper registration information. The PBX will answer with a 401 error code.
The endpoint will send a second REGISTER event with the proper authentication information. The PBX will then query the database, confirm the authentication and send a 200 error code.
Good luck!
";