---
schema_version: "1"
id: 965ce297ac800358509ea14461b0c7cb9245027994a8fe796e752bc920474385
title: SOAP Schema Validation Policy
collection: mulesoft
version: current
locale: en-us
portal_url: https://docs.salesforce.com/mulesoft/current/en-us/gateway/1.12/policies-included-soap-schema-validation.md
canonical_url: https://docs.mulesoft.com/gateway/1.12/policies-included-soap-schema-validation
source_site: docs.mulesoft.com
content_type: documentation
content_hash: 5d887f262786d7b73768a57cc4308e2418f4cc17f0481e6300a2e612f4335a4e
description: MuleSoft Documentation Site
release: "1.12"
latest: false
---
---
product: Omni Gateway
version: 1.12
keywords: xml threat protection, api gateway, flex gateway, gateway, policy
---

# SOAP Schema Validation Policy

> For the full documentation index, see: https://docs.mulesoft.com/llms.txt

<table><colgroup><col> <col></colgroup><tbody><tr><td><p><strong>Policy Name</strong></p></td><td><p>SOAP Schema Validation</p></td></tr><tr><td><p><strong>Summary</strong></p></td><td><p>Validates incoming traffic against a specified WSDL schema</p></td></tr><tr><td><p><strong>Category</strong></p></td><td><p>Security</p></td></tr><tr><td><p><strong>First Flex Gateway version available</strong></p></td><td><p>v1.10.0</p></td></tr><tr><td><p><strong>Returned Status Codes</strong></p></td><td><p>The policy returns a <code>400</code> for a client error or <code>500</code> for a server error. Error messages are defined by SOAP standard responses.</p></td></tr></tbody></table>

## Summary

> [!NOTE] The Schema Validation policy only supports SOAP 1.1 and 1.2 APIs.

Use the SOAP Schema Validation policy to block incoming requests that don’t conform to the the
defined WSDL schema. This policy prevents malformed or malicious SOAP messages from reaching the
backend and enforces contract compliance between clients and services.

## Configuring Policy Parameters

### Flex Gateway Local Mode

When you apply the policy via declarative configuration files, Refer to the following policy
definition and table of parameters:

\- policyRef: name: soap-validation config: wsdlUrl: <string> // REQUIRED encoding: <string> //
REQUIRED, default 'UTF-8' serviceName: <string> // REQUIRED servicePort: <string> // REQUIRED

Determines if the schema is specified in this YAML resource, or if it’s specified in the API Context
from Exchange (Connected Mode only). Supported values: `inline` or `context`. You must specify
`inline` when configuring the policy in Local Mode.

<table><colgroup><col> <col> <col> <col></colgroup><thead><tr><th>Parameter</th><th>Required</th><th>Default Value</th><th>Description</th></tr></thead><tbody><tr><td><div><div><p><code>wsdlUrl</code></p></div></div></td><td><div><div><p>Yes</p></div></div></td><td><div><div><p>NA</p></div></div></td><td><div><div><p>URL of where to access the WSDL</p></div></div></td></tr><tr><td><div><div><p><code>encoding</code></p></div></div></td><td><div><div><p>Yes</p></div></div></td><td><div><div><p>UTF-8</p></div></div></td><td><div><div><p>Encoding of the WSDL</p></div></div></td></tr><tr><td><div><div><p><code>serviceName</code></p></div></div></td><td><div><div><p>Yes</p></div></div></td><td><div><div><p>NA</p></div></div></td><td><div><div><p>SOAP service name defined in the WSDL that validates requests</p></div></div></td></tr><tr><td><div><div><p><code>servicePort</code></p></div></div></td><td><div><div><p>Yes</p></div></div></td><td><div><div><p>NA</p></div></div></td><td><div><div><p>SOAP port name defined in the WSDL that validates requests</p></div></div></td></tr></tbody></table>

#### Resource Configuration Example

\- policyRef: name: soap-validation config: wsdlUrl: encoding: UTF-8 serviceName: servicePort:

### Managed Flex Gateway and Flex Gateway Connected Mode

When you apply the policy from the UI, the following parameters are displayed:

<table><colgroup><col> <col></colgroup><thead><tr><th>Field</th><th>Description</th></tr></thead><tbody><tr><td><div><div><p>Service Name</p></div></div></td><td><div><div><p>SOAP service name defined in the WSDL that validates requests</p></div></div></td></tr><tr><td><div><div><p>Service Port</p></div></div></td><td><div><div><p>SOAP port name defined in the WSDL that validates requests</p></div></div></td></tr></tbody></table>

## See Also

- [XML Threat Protection Policy](https://docs.mulesoft.com/gateway/1.12/policies-included-xml-threat-protection)