In the Sandbox the "Validation-Token" is NOT returned in the Header (as described in the documentation) - in the RequestBody the Validation-Token is delivered:

{"validationToken":"d52ca641-1297-4784-ac69-5e04062f161b"}

In the Production environment this is different. There the token ist correctly delivered in the Header as "Validation-Token".

There seems to be a difference between Sandbox and Production environment!

Note: There must have been a change in the Sandbox lately because this also worked in the Sandbox in the past.