Rolf,
I assume your organization created the web service. If so, you created its interface (input / output signature) and perhaps a WSDL file that describes that in web services terms. You also set the security model according to the needs of your application presumably in compliance with your organization’s security policies.
Assuming the above is true, you control what represents a valid request for the service you are providing not the consumer.
Now perhaps the consumer is an internal one who is following your orgnaization’s web services security policy more closely than your application is at this moment. In that case, I would accept that you need to handle the existing request differently to correctly process the header they are sending and requiring you to understand.
Mark
#API-Management#webMethods#soa