What could be the problem when sending a privatbank API request?

Question

Python

Hello.
Need help with privatbank api.
did everything according to the documentation - https://api.privatbank.ua/#p24/balance

from requests import post
from hashlib import sha1,md5
from re import sub,search

url = "https://api.privatbank.ua/p24api/balance"
xml_string = open('test.xml','r').read()
sign = str(search('\w{32}',xml_string).group())
sha1_md5_sign = sha1(md5(sign).hexdigest()).hexdigest()
data = str(sub(sign, sha1_md5_sign, xml_string))
res = post(url, data=data, headers={'Content-Type':'application/xml; charset=UTF-8'})

print data
print res.text

what I send ( data ):

<?xml version="1.0" encoding="UTF-8"?>
<request version="1.0">
  <merchant>
    <id>133777</id>
    <signature>ec57cf1953d1027e0aae08e1d09f05fbcf3e6c20</signature>
  </merchant>
  <data>
    <oper>cmt</oper>
    <wait>0</wait>
    <test>0</test>
    <payment id="">
    <prop name="cardnum" value="1337133713371337" />
    <prop name="country" value="UA" />
    </payment>
  </data>
</request>

test.xml:

<?xml version="1.0" encoding="UTF-8"?>
<request version="1.0">
  <merchant>
    <id>133777</id>
    <signature>p99CtLx7FR2rZ7ux78C41xmlGGjHfsec</signature>
  </merchant>
  <data>
    <oper>cmt</oper>
    <wait>0</wait>
    <test>0</test>
    <payment id="">
    <prop name="cardnum" value="1337133713371337" />
    <prop name="country" value="UA" />
    </payment>
  </data>
</request>

The password is normally encrypted in sha1md5, 40 characters, in theory everything should be fine.
But, as a result, I get the answer:

<?xml version="1.0" encoding="UTF-8"?><response version="1.0"><data><error message ="invalid signature" /></data></response>

Removed tabs, spaces, wrote in one line, always one answer "invalid signature"