SOAP Security Policy Audit API Documentation

POSThttps://www.brainiac.software/api/v1/soap-security/soap-security-policy-audit$0.05 USDC

Audit SOAP security policy

Compare WS-Policy and WS-SecurityPolicy assertions across caller-supplied WSDL 1.1 bindings and operations. audit_status is valid, warnings, policy_conflicts, invalid, or incomplete. risk_level is low, medium, high, or critical. A declared policy is not evidence that a server enforces it. Imports are not fetched.

Body

Field	Required	Notes
`documents`	Yes	array; Array
`expected`	No	object; Object
`selection`	No	object; Object

Request exampleJSON

{
  "documents": [
    {
      "name": "account.wsdl",
      "role": "wsdl",
      "content": "<?xml version=\"1.0\"?>\n<definitions xmlns=\"http://schemas.xmlsoap.org/wsdl/\" xmlns:tns=\"urn:account\" xmlns:wsp=\"http://www.w3.org/ns/ws-policy\" xmlns:sp=\"http://docs.oasis-open.org/ws-sx/ws-securitypolicy/200702\" xmlns:wsu=\"http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd\" targetNamespace=\"urn:account\">\n  <wsp:Policy wsu:Id=\"BindingPolicy\">\n    <wsp:ExactlyOne>\n      <wsp:All>\n        <sp:AsymmetricBinding>\n          <wsp:Policy>\n            <sp:InitiatorToken><wsp:Policy><sp:X509Token/></wsp:Policy></sp:InitiatorToken>\n            <sp:RecipientToken><wsp:Policy><sp:X509Token/></wsp:Policy></sp:RecipientToken>\n            <sp:AlgorithmSuite><wsp:Policy><sp:Basic256Sha256/></wsp:Policy></sp:AlgorithmSuite>\n            <sp:IncludeTimestamp/>\n          </wsp:Policy>\n        </sp:AsymmetricBinding>\n        <sp:SignedParts><sp:Body/></sp:SignedParts>\n        <sp:EncryptedParts><sp:Body/></sp:EncryptedParts>\n        <sp:WeirdToken/>\n      </wsp:All>\n    </wsp:ExactlyOne>\n  </wsp:Policy>\n  <types>\n    <schema xmlns=\"http://www.w3.org/2001/XMLSchema\">\n      <import namespace=\"urn:account\" schemaLocation=\"types.xsd\"/>\n    </schema>\n  </types>\n  <binding name=\"AccountBinding\">\n    <wsp:PolicyReference URI=\"#BindingPolicy\"/>\n    <operation name=\"GetAccount\"><input message=\"tns:In\"/><output message=\"tns:Out\"/></operation>\n    <operation name=\"ResetPassword\">\n      <wsp:Policy><wsp:All><sp:UsernameToken/></wsp:All></wsp:Policy>\n    </operation>\n  </binding>\n  <service name=\"AccountService\">\n    <wsp:PolicyReference URI=\"#MissingPolicy\"/>\n    <port name=\"AccountPort\" binding=\"tns:AccountBinding\"/>\n  </service>\n</definitions>"
    },
    {
      "name": "types.xsd",
      "role": "xsd",
      "content": "<?xml version=\"1.0\"?><schema xmlns=\"http://www.w3.org/2001/XMLSchema\" targetNamespace=\"urn:account\"/>"
    }
  ]
}

Response exampleJSON

{
  "audit_status": "policy_conflicts",
  "risk_level": "critical",
  "operation_security_profiles": [
    {
      "service": "AccountService",
      "port": "AccountPort",
      "binding": "AccountBinding",
      "operation": "GetAccount",
      "tokens": [
        "x509"
      ],
      "sign_body": true,
      "encrypt_body": true,
      "transport": false,
      "timestamp": true,
      "inherited": true,
      "detail": "This profile is read from the supplied policy documents. It was not checked against a running server."
    },
    {
      "service": "AccountService",
      "port": "AccountPort",
      "binding": "AccountBinding",
      "operation": "ResetPassword",
      "tokens": [
        "username"
      ],
      "sign_body": false,
      "encrypt_body": false,
      "transport": false,
      "timestamp": false,
      "inherited": false,
      "detail": "This profile is read from the supplied policy documents. It was not checked against a running server."
    }
  ],
  "policy_conflicts": [
    {
      "binding": "AccountBinding",
      "operation": "ResetPassword",
      "code": "weaker_operation",
      "detail": "ResetPassword requires less than the outer policy for AccountBinding: sign_body, encrypt_body, timestamp, token:x509. This compares the supplied documents only."
    },
    {
      "binding": "AccountBinding",
      "operation": "GetAccount",
      "code": "token_inconsistent",
      "detail": "AccountBinding: The operations on this binding do not require the same tokens. This is a document comparison, not a runtime result."
    },
    {
      "binding": "AccountBinding",
      "operation": "GetAccount",
      "code": "sign_inconsistent",
      "detail": "AccountBinding: The operations on this binding do not sign the body in the same way. This is a document comparison, not a runtime result."
    },
    {
      "binding": "AccountBinding",
      "operation": "GetAccount",
      "code": "encrypt_inconsistent",
      "detail": "AccountBinding: The operations on this binding do not encrypt the body in the same way. This is a document comparison, not a runtime result."
    }
  ],
  "missing_requirements": [
    {
      "binding": "AccountBinding",
      "operation": "ResetPassword",
      "requirement": "sign_body",
      "detail": "ResetPassword does not repeat the outer sign_body requirement."
    },
    {
      "binding": "AccountBinding",
      "operation": "ResetPassword",
      "requirement": "encrypt_body",
      "detail": "ResetPassword does not repeat the outer encrypt_body requirement."
    },
    {
      "binding": "AccountBinding",
      "operation": "ResetPassword",
      "requirement": "timestamp",
      "detail": "ResetPassword does not repeat the outer timestamp requirement."
    },
    {
      "binding": "AccountBinding",
      "operation": "ResetPassword",
      "requirement": "token:x509",
      "detail": "ResetPassword does not repeat the outer token:x509 requirement."
    }
  ],
  "unsupported_assertions": [
    {
      "document": "account.wsdl",
      "name": "WeirdToken",
      "detail": "WeirdToken is not an implemented WS-SecurityPolicy assertion. It was not treated as protection."
    }
  ],
  "unresolved_references": [
    {
      "document": "account.wsdl",
      "reference": "#MissingPolicy",
      "detail": "This policy reference is not in the supplied documents. It was not fetched."
    }
  ],
  "findings": [
    {
      "code": "weaker_operation",
      "severity": "critical",
      "document": "account.wsdl",
      "binding": "AccountBinding",
      "operation": "ResetPassword",
      "detail": "ResetPassword requires less than the outer policy for AccountBinding: sign_body, encrypt_body, timestamp, token:x509. This compares the supplied documents only."
    },
    {
      "code": "token_inconsistent",
      "severity": "high",
      "document": "account.wsdl",
      "binding": "AccountBinding",
      "operation": "GetAccount",
      "detail": "AccountBinding: The operations on this binding do not require the same tokens. This is a document comparison, not a runtime result."
    },
    {
      "code": "sign_inconsistent",
      "severity": "high",
      "document": "account.wsdl",
      "binding": "AccountBinding",
      "operation": "GetAccount",
      "detail": "AccountBinding: The operations on this binding do not sign the body in the same way. This is a document comparison, not a runtime result."
    },
    {
      "code": "encrypt_inconsistent",
      "severity": "high",
      "document": "account.wsdl",
      "binding": "AccountBinding",
      "operation": "GetAccount",
      "detail": "AccountBinding: The operations on this binding do not encrypt the body in the same way. This is a document comparison, not a runtime result."
    },
    {
      "code": "policy_unresolved",
      "severity": "medium",
      "document": "account.wsdl",
      "detail": "Policy reference #MissingPolicy is not in the supplied documents. It was not fetched."
    },
    {
      "code": "assertion_unsupported",
      "severity": "medium",
      "document": "account.wsdl",
      "detail": "WeirdToken is not an implemented WS-SecurityPolicy assertion. It was not treated as protection."
    },
    {
      "code": "declared_only",
      "severity": "low",
      "detail": "These documents were supplied in the request. They were not fetched, and a declared policy is not evidence that a server enforces it."
    }
  ],
  "limitations": [
    "Documents are the XML strings in the request. Imports and policy references were not fetched.",
    "A declared policy is not evidence that a running SOAP server enforces it.",
    "Certificates and credentials are not validated.",
    "Implemented policy namespaces are WS-Policy 1.2 and 1.5, and WS-SecurityPolicy 1.2 and 1.3. Other assertions are reported and are not treated as protection.",
    "An operation with no attached policy inherits the nearest service, port, or binding policy. A policy with no security assertions is explicit, not missing.",
    "Only WSDL 1.1 is read."
  ]
}

cURL

curl -i -X POST "https://www.brainiac.software/api/v1/soap-security/soap-security-policy-audit" \
  -H 'content-type: application/json' \
  -H 'Idempotency-Key: <fresh-64-character-random-hex-key>' \
  --data-binary @- <<'JSON'
{
  "documents": [
    {
      "name": "account.wsdl",
      "role": "wsdl",
      "content": "<?xml version=\"1.0\"?>\n<definitions xmlns=\"http://schemas.xmlsoap.org/wsdl/\" xmlns:tns=\"urn:account\" xmlns:wsp=\"http://www.w3.org/ns/ws-policy\" xmlns:sp=\"http://docs.oasis-open.org/ws-sx/ws-securitypolicy/200702\" xmlns:wsu=\"http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd\" targetNamespace=\"urn:account\">\n  <wsp:Policy wsu:Id=\"BindingPolicy\">\n    <wsp:ExactlyOne>\n      <wsp:All>\n        <sp:AsymmetricBinding>\n          <wsp:Policy>\n            <sp:InitiatorToken><wsp:Policy><sp:X509Token/></wsp:Policy></sp:InitiatorToken>\n            <sp:RecipientToken><wsp:Policy><sp:X509Token/></wsp:Policy></sp:RecipientToken>\n            <sp:AlgorithmSuite><wsp:Policy><sp:Basic256Sha256/></wsp:Policy></sp:AlgorithmSuite>\n            <sp:IncludeTimestamp/>\n          </wsp:Policy>\n        </sp:AsymmetricBinding>\n        <sp:SignedParts><sp:Body/></sp:SignedParts>\n        <sp:EncryptedParts><sp:Body/></sp:EncryptedParts>\n        <sp:WeirdToken/>\n      </wsp:All>\n    </wsp:ExactlyOne>\n  </wsp:Policy>\n  <types>\n    <schema xmlns=\"http://www.w3.org/2001/XMLSchema\">\n      <import namespace=\"urn:account\" schemaLocation=\"types.xsd\"/>\n    </schema>\n  </types>\n  <binding name=\"AccountBinding\">\n    <wsp:PolicyReference URI=\"#BindingPolicy\"/>\n    <operation name=\"GetAccount\"><input message=\"tns:In\"/><output message=\"tns:Out\"/></operation>\n    <operation name=\"ResetPassword\">\n      <wsp:Policy><wsp:All><sp:UsernameToken/></wsp:All></wsp:Policy>\n    </operation>\n  </binding>\n  <service name=\"AccountService\">\n    <wsp:PolicyReference URI=\"#MissingPolicy\"/>\n    <port name=\"AccountPort\" binding=\"tns:AccountBinding\"/>\n  </service>\n</definitions>"
    },
    {
      "name": "types.xsd",
      "role": "xsd",
      "content": "<?xml version=\"1.0\"?><schema xmlns=\"http://www.w3.org/2001/XMLSchema\" targetNamespace=\"urn:account\"/>"
    }
  ]
}
JSON

POSThttps://www.brainiac.software/api/v1/soap-security/policy-strength$0.04 USDC

Score SOAP policy strength

Score a caller-supplied algorithm suite, body signature, body encryption, timestamp, and token kind. Basic256Sha256 contributes the most, TripleDes and None the least. A username token scores below an X.509 token. The grade follows that score. No certificate is validated and no policy file is fetched.

Body

Field	Required	Notes
`algorithm_suite`	Yes	string; One of: Basic256Sha256, Basic256, Basic128Sha256, Basic128, TripleDes, None
`body_signed`	Yes	boolean
`body_encrypted`	Yes	boolean
`timestamp`	Yes	boolean
`token`	Yes	string; One of: x509, username, none

Request exampleJSON

{
  "algorithm_suite": "Basic128",
  "body_signed": true,
  "body_encrypted": false,
  "timestamp": true,
  "token": "username"
}

Response exampleJSON

{
  "security_policy_grade": "D",
  "cryptographic_strength_score": 50
}

cURL

curl -i -X POST "https://www.brainiac.software/api/v1/soap-security/policy-strength" \
  -H 'content-type: application/json' \
  -H 'Idempotency-Key: <fresh-64-character-random-hex-key>' \
  --data-binary @- <<'JSON'
{
  "algorithm_suite": "Basic128",
  "body_signed": true,
  "body_encrypted": false,
  "timestamp": true,
  "token": "username"
}
JSON