• Glossary
  • What is SOAP (Simple Object Access Protocol)?

Security glossary

What is SOAP (Simple Object Access Protocol)?

SOAP (Simple Object Access Protocol) is a messaging protocol that lets applications exchange structured information as XML messages in web services. It defines an envelope format with optional headers and a body, and it is commonly carried over HTTP, though other transports are possible.

Let's simplify your DDI
Abstract isometric UI showing network ranges, usage bars, region names (EMEA/APAC), and a purple "Deploy" button
Key takeawaysKey takeaways are generated with AI assistance. Because automated summaries can occasionally contain errors or miss important context, always refer to the full blog post for complete information.

SOAP (Simple Object Access Protocol) is a messaging protocol that enables applications to exchange structured XML messages within enterprise web services, commonly transported over HTTP with optional WS-Security extensions for encryption and signing. Operations teams must maintain accurate DNS records, valid TLS certificates, and properly validated XML parsing to prevent silent failures, as stale endpoint records, certificate mismatches, and oversized payloads are common causes of service disruption in financial, telecommunications, and government integrations. Deliberate decisions about message-level protection versus transport-layer security, along with careful monitoring of WSDL contracts and hostname resolution, are essential to keep SOAP services reachable and prevent integration failures that often have no fallback mechanisms.

  • SOAP’s XML-based format requires careful capacity planning and input validation; unvalidated XML exposes services to XML external entity injection attacks and oversized payload denial-of-service attacks that can degrade CPU performance and create unexpected outbound DNS lookups.
  • WSDL documents embedded with internal hostnames or private addresses cause external client failures even when the contract imports successfully, necessitating careful alignment between generated service descriptions and externally resolvable endpoint locations.
  • Certificate hostname mismatches and long TTL values on stale A records create distinct failure modes where one client group experiences timeouts while others succeed, making DNS and TLS hygiene critical to preventing silent outages in mission-critical integrations.

SOAP at a glance

AttributeValue
Full nameSimple Object Access Protocol
CategoryMessaging protocol
Defined inW3C SOAP specifications (SOAP 1.1 note and SOAP 1.2 recommendation)
OSI layerApplication layer (layer 7)
Primary useExchanging structured XML messages between applications in web services
Related termsXML, HTTP, REST, WSDL, API, TLS

How SOAP works

SOAP structures every exchange as an XML message sent between a client and a service. The message format is fixed by the specification, while the transport underneath is flexible and is usually HTTP.

  1. Describe the service: The service publishes a contract, usually a WSDL document, that lists its operations and the message types each one accepts and returns.
  2. Build the envelope: The client wraps the request in a SOAP envelope. The envelope holds an optional header for metadata such as security or routing information and a required body with the request payload.
  3. Send over a transport: The client sends the envelope to the service endpoint, most often as the body of an HTTP POST request.
  4. Process the request: The receiving node parses the XML, handles any header blocks, and runs the requested operation.
  5. Return a response or fault: The service replies with a SOAP envelope containing the result. If processing fails, the body contains a fault element that describes the error.

SOAP messages can pass through intermediaries that act on header blocks before the final recipient receives them. Extensions such as WS-Security add message-level signing and encryption independent of the transport.

Why SOAP matters in enterprise networks

SOAP remains in use in enterprise systems such as financial, telecommunications and government integrations, where formal service contracts and strict message typing matter. Operations teams inherit these services and must keep them reachable, resolvable and monitored, since clients locate endpoints by hostname and a DNS failure or stale record can break an integration that has no other fallback.

Because SOAP messages are XML, they are larger and slower to parse than many alternatives, so capacity planning should account for payload size and parsing cost. Poorly validated XML input exposes services to attacks such as XML external entity injection and oversized or deeply nested payloads, so parsers should disable external entity resolution and enforce size limits.

The SOAP 1.2 specification is a W3C Recommendation, and its WS-Security extension is an OASIS standard that provides message-level integrity and confidentiality. Relying only on transport security protects data between hops but not inside intermediaries, so teams handling sensitive messages should decide deliberately where TLS ends and message-level protection begins. Unmanaged endpoints, expired certificates and outdated service descriptions are the common causes of silent failures.

Common SOAP issues

Clients usually have the service hostname configured or embedded in the WSDL, so a changed IP address with an old A record cached at a long TTL sends requests to the wrong host. Symptoms are connection timeouts or HTTP errors from one client group while others work.

SOAP over HTTPS fails the TLS handshake if the certificate name does not match the hostname the client uses. This often appears after a service is moved behind a new alias or load balancer address without reissuing the certificate.

Large envelopes with attachments or deeply nested elements can exceed proxy or gateway body size limits and cause request timeouts or HTTP 413 responses. Parsing large messages also raises CPU use on the service, which can look like a network problem.

Services that accept XML without schema validation or that allow external entity resolution can be exposed to XML external entity attacks and denial of service through crafted documents. The service may also make unexpected outbound DNS lookups.

A WSDL generated on the server often embeds an internal hostname or private address in its endpoint location. External clients import the contract successfully but then fail to resolve or reach the endpoint.

See how unified DDI simplifies network operations

Manage DNS, DHCP and IP addresses from one platform with automation, visibility and control built in.

Talk to us

SOAP FAQ

Related terms

Article

Transport layer security (TLS)

TLS (transport layer security) is a cryptographic protocol that provides communications security over a computer network.

Learn more
Article

SSL (secure sockets layer)

SSL (secure sockets layer) is a security technology for establishing an encrypted link between a server and a client.

Learn more
Article

DNS – Domain Name System

The Domain Name System (DNS) is a hierarchical naming system that resolves domain names to IP addresses, enabling communication across network devices.

Learn more
Article

A record

An A record is a DNS record that maps domain names to IPv4 addresses.

Learn more
Article

Fully Qualified Domain Name (FQDN)

A Fully Qualified Domain Name (FQDN) is a domain name that specifies its exact location in the DNS tree hierarchy.

Learn more
Article

Time to Live (TTL)

TTL (time to live) is a setting for each DNS record that specifies how long a resolver caches the DNS query before it expires.

Learn more
Article

TCP

TCP (transmission control protocol) is a protocol that provides reliable, ordered, and error-checked delivery of bytes between applications on an IP network.

Learn more
Article

DNS server

A DNS server stores DNS records and responds to DNS queries from devices, resolving domain names to IP addresses.

Learn more
Browse the full glossary