---
schema_version: "1"
id: 24aeb491a8f5a9bdfb093a65b0f14012f9b5ab30271209cd2b8fd98e71ffc8aa
title: SOAP Schema Validation Policy
collection: mulesoft
version: current
locale: en-us
portal_url: https://docs.salesforce.com/mulesoft/current/en-us/gateway/1.13/policies-included-soap-schema-validation.md
canonical_url: https://docs.mulesoft.com/gateway/1.13/policies-included-soap-schema-validation
source_site: docs.mulesoft.com
content_type: documentation
content_hash: 0a8897f34b064847f78fba88cf2c30d1e0940db12366e116a992fb2db9ecb9bc
description: MuleSoft Documentation Site
release: "1.13"
latest: false
---
---
product: Omni Gateway
version: 1.13
keywords: xml threat protection, api gateway, flex gateway, gateway, policy
---

# SOAP Schema Validation Policy

> For the full documentation index, see: https://docs.mulesoft.com/llms.txt

<table><colgroup><col> <col></colgroup><tbody><tr><td><p><strong>Policy Name</strong></p></td><td><p>SOAP Schema Validation</p></td></tr><tr><td><p><strong>Summary</strong></p></td><td><p>Validates incoming traffic against a specified WSDL schema</p></td></tr><tr><td><p><strong>Category</strong></p></td><td><p>Security</p></td></tr><tr><td><p><strong>First Omni Gateway version available</strong></p></td><td><p>v1.10.0</p></td></tr><tr><td><p><strong>Release Notes</strong></p></td><td><p><a href="https://docs.mulesoft.com/release-notes/gateway/policies/soap-schema-validation-release-notes">SOAP Schema Validation Policy</a></p></td></tr><tr><td><p><strong>Returned Status Codes</strong></p></td><td><p>The policy returns a <code>400</code> for a client error or <code>500</code> for a server error. Error messages are defined by SOAP standard responses.</p></td></tr></tbody></table>

## Summary

> [!NOTE] The Schema Validation policy only supports SOAP 1.1 and 1.2 APIs.

Use the SOAP Schema Validation policy to block incoming requests that don’t conform to the the
defined WSDL schema. This policy prevents malformed or malicious SOAP messages from reaching the
backend and enforces contract compliance between clients and services.

## Configuring Policy Parameters

### Omni Gateway Local Mode

When you apply the policy via declarative configuration files, Refer to the following policy
definition and table of parameters:

\- policyRef: name: soap-validation config: wsdlUrl: <string> // REQUIRED encoding: <string> //
REQUIRED, default 'UTF-8' serviceName: <string> // REQUIRED servicePort: <string> // REQUIRED

Determines if the schema is specified in this YAML resource, or if it’s specified in the API Context
from Exchange (Connected Mode only). Supported values: `inline` or `context`. You must specify
`inline` when configuring the policy in Local Mode.

<table><colgroup><col> <col> <col> <col></colgroup><thead><tr><th>Parameter</th><th>Required</th><th>Default Value</th><th>Description</th></tr></thead><tbody><tr><td><div><div><p><code>wsdlUrl</code></p></div></div></td><td><div><div><p>Yes</p></div></div></td><td><div><div><p>NA</p></div></div></td><td><div><div><p>URL of where to access the WSDL</p></div></div></td></tr><tr><td><div><div><p><code>encoding</code></p></div></div></td><td><div><div><p>Yes</p></div></div></td><td><div><div><p>UTF-8</p></div></div></td><td><div><div><p>Encoding of the WSDL</p></div></div></td></tr><tr><td><div><div><p><code>serviceName</code></p></div></div></td><td><div><div><p>Yes</p></div></div></td><td><div><div><p>NA</p></div></div></td><td><div><div><p>SOAP service name defined in the WSDL that validates requests</p></div></div></td></tr><tr><td><div><div><p><code>servicePort</code></p></div></div></td><td><div><div><p>Yes</p></div></div></td><td><div><div><p>NA</p></div></div></td><td><div><div><p>SOAP port name defined in the WSDL that validates requests</p></div></div></td></tr></tbody></table>

#### Resource Configuration Example

\- policyRef: name: soap-validation config: wsdlUrl: encoding: UTF-8 serviceName: servicePort:

### Managed Omni Gateway and Omni Gateway Connected Mode

When you apply the policy from the UI, the following parameters are displayed:

<table><colgroup><col> <col></colgroup><thead><tr><th>Field</th><th>Description</th></tr></thead><tbody><tr><td><div><div><p>Service Name</p></div></div></td><td><div><div><p>SOAP service name defined in the WSDL that validates requests</p></div></div></td></tr><tr><td><div><div><p>Service Port</p></div></div></td><td><div><div><p>SOAP port name defined in the WSDL that validates requests</p></div></div></td></tr></tbody></table>

## See Also

- [XML Threat Protection Policy](https://docs.mulesoft.com/gateway/1.13/policies-included-xml-threat-protection)