A transaction request is failed if the «dynamic_descriptor» contains a dot.
E.g.: MAGE2.PRO
The API response:
{"code":107,"details":{"body.dynamic_descriptor":"is invalid or missing"},"message":"at least one parameter is malformed (truncated...)
So it looks like Spryng have provided me an incomplete set of the forbidden characters.