Setting up a subscription

1. An org admin opens Settings → Organisation → Webhooks in the Mercura admin UI.
2. They click New webhook, enter the HTTPS endpoint your system exposes, pick which event types should fan out to that endpoint, and save. Mercura returns the signing secret exactly once at this moment — copy it into your secret store immediately, it cannot be retrieved later.
3. They click Send test event to fire a webhook.test event at the endpoint. Use this to validate signature verification end-to-end before going live.
4. Your endpoint then receives the event types you selected automatically, as they fire on the Mercura side (e.g. tender.completed / order.completed on completion, job.finished on a bulk-write job).

If the secret is lost, the admin can delete the subscription and create a new one — there is no rotate-in-place flow.