A subscription-validation handshake — echo ValidationToken back as text/plain 200.
The exact token to echo back (Graph rejects the subscription on any mismatch).
A real change notification whose clientState matched the expected shared secret — process it.
Reject — either a missing/blank token on a handshake, or a clientState mismatch on a notification.
A short machine-readable reason (for logging; never surfaced to the caller).
The result of the Graph change-notification validation-token handshake. When Microsoft Graph creates (or renews) a subscription, it first calls the notification URL with a
?validationToken=…query param and expects the endpoint to echo that exact token back astext/plainwith200. validateGraphNotification returns this discriminated result so the router can either echo the token (handshake) or proceed to process a real notification (with theclientStatealready verified).