signature is passed in the json, not in the headers