---
schema_version: "1"
id: 23159aec47da1672ae32859a72cf4e2f3725cd48e8af00825d1371dc8033cfed
title: SOAP Schema Validation Policy
collection: mulesoft
version: current
locale: en-us
portal_url: https://docs.salesforce.com/mulesoft/current/en-us/gateway/latest/policies-included-soap-schema-validation.md
canonical_url: https://docs.mulesoft.com/gateway/latest/policies-included-soap-schema-validation
source_site: docs.mulesoft.com
content_type: documentation
content_hash: b8fe41fa1ace3f34cfa8698295dfb06a3a62d9de6c4252e9ef8523afd2c9a9fa
description: MuleSoft Documentation Site
release: "1.14"
latest: true
---
---
product: Omni Gateway
version: 1.14
is-latest-version: true
keywords: xml threat protection, api gateway, flex gateway, gateway, policy
---

# SOAP Schema Validation Policy

> For the full documentation index, see: https://docs.mulesoft.com/llms.txt

<table><colgroup><col> <col></colgroup><tbody><tr><td><p><strong>Policy Name</strong></p></td><td><p>SOAP Schema Validation</p></td></tr><tr><td><p><strong>Summary</strong></p></td><td><p>Validates incoming traffic against a specified WSDL schema</p></td></tr><tr><td><p><strong>Category</strong></p></td><td><p>Security</p></td></tr><tr><td><p><strong>First Omni Gateway version available</strong></p></td><td><p>v1.10.0</p></td></tr><tr><td><p><strong>Release Notes</strong></p></td><td><p><a href="https://docs.mulesoft.com/release-notes/gateway/policies/soap-schema-validation-release-notes">SOAP Schema Validation Policy</a></p></td></tr><tr><td><p><strong>Returned Status Codes</strong></p></td><td><p>The policy returns a <code>400</code> for a client error or <code>500</code> for a server error. Error messages are defined by SOAP standard responses.</p></td></tr></tbody></table>

## Summary

> [!NOTE] The Schema Validation policy only supports SOAP 1.1 and 1.2 APIs.

Use the SOAP Schema Validation policy to block incoming requests that don’t conform to the the
defined WSDL schema. This policy prevents malformed or malicious SOAP messages from reaching the
backend and enforces contract compliance between clients and services.

## Configuring Policy Parameters

### Omni Gateway Local Mode

When you apply the policy via declarative configuration files, Refer to the following policy
definition and table of parameters:

\- policyRef: name: soap-validation config: wsdlUrl: <string> // REQUIRED encoding: <string> //
REQUIRED, default 'UTF-8' serviceName: <string> // REQUIRED servicePort: <string> // REQUIRED

Determines if the schema is specified in this YAML resource, or if it’s specified in the API Context
from Exchange (Connected Mode only). Supported values: `inline` or `context`. You must specify
`inline` when configuring the policy in Local Mode.

<table><colgroup><col> <col> <col> <col></colgroup><thead><tr><th>Parameter</th><th>Required</th><th>Default Value</th><th>Description</th></tr></thead><tbody><tr><td><div><div><p><code>wsdlUrl</code></p></div></div></td><td><div><div><p>Yes</p></div></div></td><td><div><div><p>NA</p></div></div></td><td><div><div><p>URL of where to access the WSDL</p></div></div></td></tr><tr><td><div><div><p><code>encoding</code></p></div></div></td><td><div><div><p>Yes</p></div></div></td><td><div><div><p>UTF-8</p></div></div></td><td><div><div><p>Encoding of the WSDL</p></div></div></td></tr><tr><td><div><div><p><code>serviceName</code></p></div></div></td><td><div><div><p>Yes</p></div></div></td><td><div><div><p>NA</p></div></div></td><td><div><div><p>SOAP service name defined in the WSDL that validates requests</p></div></div></td></tr><tr><td><div><div><p><code>servicePort</code></p></div></div></td><td><div><div><p>Yes</p></div></div></td><td><div><div><p>NA</p></div></div></td><td><div><div><p>SOAP port name defined in the WSDL that validates requests</p></div></div></td></tr></tbody></table>

#### Resource Configuration Example

\- policyRef: name: soap-validation config: wsdlUrl: encoding: UTF-8 serviceName: servicePort:

### Managed Omni Gateway and Omni Gateway Connected Mode

When you apply the policy from the UI, the following parameters are displayed:

<table><colgroup><col> <col></colgroup><thead><tr><th>Field</th><th>Description</th></tr></thead><tbody><tr><td><div><div><p>Service Name</p></div></div></td><td><div><div><p>SOAP service name defined in the WSDL that validates requests</p></div></div></td></tr><tr><td><div><div><p>Service Port</p></div></div></td><td><div><div><p>SOAP port name defined in the WSDL that validates requests</p></div></div></td></tr></tbody></table>

## See Also

- [XML Threat Protection Policy](https://docs.mulesoft.com/gateway/latest/policies-included-xml-threat-protection)