I found the issue: my query included a variable definition, that was not part of
the mutation, and server side, this variable is removed when calculating the
body hash. So AppSync actually parses the request body and manipulates it before
calculating the hash.