Learning here. Did not realize at first that the Http calls are all external only and not through the hub. Was not the authorization that was the problem, but the fact that my local IPs and DNSs are not visible to the Http calls of SmartThings.
HubAction … it is. Just very painful do deal with it as the API is very much incomplete. Finally found solutions for the 10.x.x.x IP address problem, as well as the HEX conversion - none of which should be required in the first place, but it is what it is. Many thanks to @pstuart for his research and various solutions.
Also realized that I probably cannot do a custom device type for INSTEON over ISY but require a fairly elaborate and complex Service Manager. Nothing is ever as easy as it seems at first.