Ok, now pay close attention; this part gets real complicated.  The required elements of a notification message (that is, the shark-attack message sent to the subscriber) are as follows:

…

That’s right, there are no required elements.  Any SOAP message can be a valid notification.  The event source and the event sink (aka the subscriber) must agree on the notification format, and the WS-Eventing spec doesn’t mandate how that agreement is achieved.  A couple options occur to me off the top of my head.  Documentation can specify the format, and both sides can simply use the same documented format for the message.  Alternatively, the format could be published via WSDL at the event source, which the subscriber could use to process the notification message or generate a proxy for it.  (Or would that be a stub?)

If the subscriber really needs to know which subscription a particular notification is associated with, that subscriber can attach a tag to the subscription request.  That tag will then be included in all notification messages the event source sends to that subscriber.  The tag looks like this:

This will force the event source to add that tag as a header to every notification that it sends to that subscriber, like so: