Peter probably correctly guessed that they're misusing an endpoint and sending the message encoded improperly. An XML-signed request could never be delivered to the redirect endpoint without an error and that would probably be the kind you'd get. -- Scott