Check the Authorization header before deserializing the notification, and read/parse the body manually. NRC probes a new abonnement's callback with a request that has neither the configured auth nor a valid notification body, and refuses to register unless it gets a 401 (not a 400) — ADR-0007. Mirrors the verify harness's sink contract. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>