The specification states that the request body should contain the Service Provider ID, but this is implicit in the authentication header which will also contain the SP ID.

Current embodiments of the DE don’t require the body to contain the SP ID, and ignore it.