Hi Armin,
On the correlation API: For an explanation what a business key is, see this forum post. You probably already read that post. In addition to that, a business key can be set when a process is started and setting it is optional.
In the correlation API, the paramters businessKey and correlationKeys can be used as criteria to restrict the correlation to process instance instances that match them.
Using the request body above, the request would correlate the message aMessageName to a process instance which has business key aBusinessKey and a variable named aVariable with value aValue but not to other process instances. Note that all parameters are optional, so you do not have to provide a businessKey or correlationKeys parameter for it to work.
On the process model: Yes, you should connect the two activities with sequence flow, since you only want the receive task to become active after Dokument editieren has been executed. If you do not connect the tasks, the BPMN semantics are that this activity is instantiated when the process starts. This would not be dynamic (i.e. would not work if multiple documents could be edited at the same time) and the process engine does not support that either.
Cheers,
Thorben