PagSeguro Notification API receiving error 403

Hello, I'm integrating the PagSeguro API transparently and in the Sandbox environment, when I make a change in the Transaction Status in the PagSeguro panel, their system sends a request, but in the status http received, from 403 (prohibited).

My question is, when their system accesses the respective controller of the notification link from my system, is it to give some kind of feedback? Here's what I've been doing so far:

    [HttpPost]
    public ActionResult Notifications(string notificationCode, string notificationType)
    {
        HttpContext.Response.AddHeader("Access-Control-Allow-Origin", "https://sandbox.pagseguro.uol.com.br");

        if (notificationCode.IsNullOrWhiteSpace())
            return Content("ERROR - Required code of transaction");

        try
        {
            EnvironmentConfiguration.ChangeEnvironment(isSandbox);

            AccountCredentials credentials = PagSeguroConfiguration.Credentials(isSandbox);

            Transaction transaction = NotificationService.CheckTransaction(credentials, notificationCode);

            var dados = db.PsTransactions.FirstOrDefault(t => t.code.Equals(transaction.Code));
            if (dados != null)
            {
                if (dados.lasteventdate.Equals(transaction.LastEventDate))
                    return Content("Transaction already exists");
                dados.date = transaction.Date;
                dados.lasteventdate = transaction.LastEventDate;
                dados.status = PagSeguro.TransactionStatusToString(transaction.TransactionStatus);

                db.Entry(dados).State = EntityState.Modified;
                db.SaveChanges();
            }
            Infraestrutura.Notifications.Transactions(dados);
            TransactionsHub.NotifyCurrentTransactions();
        }
        catch (PagSeguroServiceException ex)
        {
            return Content("ERROR - " + ex.Message);
        }

        return Content("SUCCESS - Transaction update");    
    }

And follow the SandBox notification log: