How to verify a token in the url of a drupal 7 site against an external web service and skip the login form all together?
So, I don't have a working solution for this (yet!) but I'm working on a similar use case. From what I've read, you can't really have an authenticated user do anything on a Drupal site without passing them through the user module, creating a user, and storing info about them in the database. 

I believe you need to write a module that passes a user object based of the email in your json response to user_external_login_register passing in some sort of programmatically populated dummy text for the extra fields you need, and then programmatically create the user and log them in in the background. In theory, all you need to do is pass the user object based off of your 200 response, and proceed to create and log the user in.