Not really an API Key, but a JWS Detached signature of the whole body.
Body
Notifications, sent by Shinkansen
Responses
200
Message correctly received. Does NOT mean the transaction was succesful. Further responses might be sent back on another message.
No content
400
Invalid message (e.g: invalid signature)
409
Message ignored, because it was already seen and processed before by the receiver. Typically happens when a message is re-sent because the sender isn't sure if it was correctly received (e.g: network failure when the 2xx response was in flight)'