SOAP
ActiveSOAP (Simple Object Access Protocol) is a W3C protocol for exchanging structured information in web services using XML. A SOAP message is an XML envelope containing a mandatory Body (the actual payload) and an optional Header (metadata, auth, routing). WSDL (Web Services Description Language) describes the service contract. SOAP dominated enterprise integration from 2000–2010 and remains widely used in banking, insurance, government, healthcare (HL7/FHIR), and legacy ERP systems.
In one line
SOAP (W3C SOAP 1.2, 2003) is an XML-based messaging protocol for web services. Every SOAP message is an XML Envelope containing a Header (optional: auth, routing, tracing) and a Body (required: the actual request or response payload). Faults carry error details. WSDL defines the service contract (operations, message types, binding). SOAP runs over HTTP, SMTP, or JMS. Still dominant in banking, insurance, HL7 healthcare, and SAP/Oracle enterprise systems.
Quick Reference
| Field | Size | Description |
|---|---|---|
| Envelope | Root XML element | The mandatory root element of every SOAP message. Contains the Header and Body. xmlns:soap namespace must be declared. SOAP 1.1: xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/". SOAP 1.2: xmlns:soap="http://www.w3.org/2003/05/soap-envelope". |
| Header | Optional | Extension mechanism. Contains authentication tokens (WS-Security), routing (WS-Addressing), transaction IDs, and custom metadata. Each header block can be marked mustUnderstand="1" – if the receiver doesn't understand it, it MUST return a fault. |
| Body | Required | Contains the actual message payload – the operation name and parameters (request) or the return value (response). Also contains the Fault element on error. |
| Fault | Inside Body on error | SOAP 1.1: faultcode, faultstring, faultactor, detail. SOAP 1.2: Code (Value + Subcode), Reason, Node, Role, Detail. Equivalent to HTTP 4xx/5xx but carried in the XML body. |
| Content-Type | SOAP 1.1 vs 1.2 | SOAP 1.1: text/xml; charset=utf-8. SOAP 1.2: application/soap+xml; charset=utf-8. The SOAPAction HTTP header is required in SOAP 1.1 (can be empty string). |
| WSDL | Service contract | Web Services Description Language defines the service interface: operations, message types (using XML Schema), bindings (SOAP over HTTP), and service endpoints. Generated from code or hand-authored. Enables code generation for clients. |
| HTTP binding | POST only | SOAP messages are always POSTed to a single endpoint URL. There is no URL structure – all operations go to the same URL. The operation is identified by the SOAPAction header or the XML body element name. |
| WS-Security | OASIS standard | XML Digital Signatures and XML Encryption for message-level security. Used by banking/financial services for non-repudiation. Complements but does not replace HTTPS transport security. |
Key Characteristics
Contract-first design
SOAP services are defined by a WSDL contract. Client stubs are generated from WSDL. The contract is the single source of truth – clients and servers are generated independently from it.
Message-level security
WS-Security provides XML Digital Signatures for non-repudiation and XML Encryption for message-level confidentiality – independent of transport. Required by many banking and government regulations.
Verbose XML overhead
A simple SOAP request can be 10–50x larger than an equivalent REST/JSON or gRPC/protobuf request. XML parsing is slow compared to binary formats. The verbosity is the primary reason REST replaced SOAP for new APIs.
Enterprise integration
SOAP's built-in support for transactions (WS-AtomicTransaction), reliable messaging (WS-ReliableMessaging), and addressing (WS-Addressing) make it the right choice for enterprise ERP integration, healthcare HL7, and banking.
Message Format
<!-- SOAP 1.1 request over HTTP POST -->
POST /ws/CustomerService HTTP/1.1
Host: api.example.com
Content-Type: text/xml; charset=utf-8
SOAPAction: "http://example.com/GetCustomer"
<?xml version="1.0" encoding="UTF-8"?>
<soap:Envelope
xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/"
xmlns:ex="http://example.com/customer">
<soap:Header>
<wsse:Security xmlns:wsse="http://schemas.xmlsoap.org/ws/2002/12/secext">
<wsse:UsernameToken>
<wsse:Username>alice</wsse:Username>
<wsse:Password>secret</wsse:Password>
</wsse:UsernameToken>
</wsse:Security>
</soap:Header>
<soap:Body>
<ex:GetCustomerRequest>
<ex:CustomerId>cust-123</ex:CustomerId>
</ex:GetCustomerRequest>
</soap:Body>
</soap:Envelope><!-- SOAP 1.1 success response -->
HTTP/1.1 200 OK
Content-Type: text/xml; charset=utf-8
<?xml version="1.0"?>
<soap:Envelope xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/">
<soap:Body>
<ex:GetCustomerResponse>
<ex:Customer>
<ex:Id>cust-123</ex:Id>
<ex:Name>Alice</ex:Name>
<ex:Email>[email protected]</ex:Email>
</ex:Customer>
</ex:GetCustomerResponse>
</soap:Body>
</soap:Envelope>
<!-- SOAP Fault on error (always HTTP 500) -->
<soap:Envelope xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/">
<soap:Body>
<soap:Fault>
<faultcode>soap:Client</faultcode>
<faultstring>Customer not found: cust-999</faultstring>
</soap:Fault>
</soap:Body>
</soap:Envelope>