Every delivery is a POST from Mercura to your endpoint with this shape:
POST https://your-erp.example.com/mercura/webhooks
Content-Type: application/json
User-Agent: Mercura-Webhooks/1.0
Mercura-Event: tender.completed
Mercura-Event-Id: 4a2b9d1c-7e8f-4a3b-9c1d-2e3f4a5b6c7d
Mercura-Delivery-Id: 9c1f77a2-8b3e-4d5f-a6c7-1b2c3d4e5f60
Mercura-Delivery-Attempt: 1
Mercura-Timestamp: 1747742400
Mercura-Signature-256: sha256=4f3a9e...
{
"event_id": "4a2b9d1c-7e8f-4a3b-9c1d-2e3f4a5b6c7d",
"event_type": "tender.completed",
"delivered_at": "2026-05-20T12:00:00Z",
"data": { ... }
}| Header | Purpose |
|---|---|
Mercura-Event | The event type. Same as event_type in the body. |
Mercura-Event-Id | Stable across delivery attempts. Use this for dedup: if you see the same Mercura-Event-Id twice, process it once. |
Mercura-Delivery-Id | Unique per delivery attempt. Useful when quoting an attempt in a support ticket. |
Mercura-Delivery-Attempt | 1 for the first attempt, incremented on each retry. |
Mercura-Timestamp | Unix seconds at the moment Mercura signed the payload. Used in the signature and for replay protection. |
Mercura-Signature-256 | sha256= followed by the hex HMAC-SHA256 of <timestamp>.<raw_body> keyed by your subscription secret. |
Respond with any 2xx to acknowledge — Mercura ignores the response body. A 4xx (other than 408 / 429) marks the delivery as permanently failed; a 5xx, 408, 429, or network error triggers the retry schedule below.