From the Apple Docs.
- If request is authorized, return HTTP status 200 with a payload of the pass data.
- If the request is not authorized, return HTTP status 401.
- Otherwise, return the appropriate standard HTTP status.
The "payload of the pass data" means the .pkpass bundle.