# SOAP Security API

> Compare WS-Policy and WS-SecurityPolicy assertions in caller-supplied WSDL 1.1 documents. No network calls are made.

Each POST has a fixed USDC price on Base, paid with the x402 exact scheme. The request is validated first, and payment settles only after a successful (2xx) result. Failed calls are not charged.

1. POST JSON matching the requestBody. Invalid input returns 400 with no payment challenge.
2. A valid unpaid call returns 402 with the exact amount and payTo.
3. Pay and retry with payment-signature. Payment settles only if the operation returns 2xx. A 4xx/5xx is not charged.

- Product: https://www.brainiac.software/api/soap-security
- Docs: https://www.brainiac.software/api/soap-security/docs
- OpenAPI: https://www.brainiac.software/api/soap-security/openapi.json
- Contact: support@brainiac.software (https://www.brainiac.software/contact)

## Operations

### POST /api/v1/soap-security/soap-security-policy-audit

$0.05 USDC. Compare WS-Policy and WS-SecurityPolicy assertions across caller-supplied WSDL 1.1 bindings and operations. audit_status is valid, warnings, policy_conflicts, invalid, or incomplete. risk_level is low, medium, high, or critical. A declared policy is not evidence that a server enforces it. Imports are not fetched.

Inputs: documents, expected?, selection?

Docs: https://www.brainiac.software/api/soap-security/docs#soap-security-soap-security-policy-audit

Example request:

```json
{
  "documents": [
    {
      "name": "account.wsdl",
      "role": "wsdl",
      "content": "<?xml version=\"1.0\"?>\n<definitions xmlns=\"http://schemas.xmlsoap.org/wsdl/\" xmlns:tns=\"urn:account\" xmlns:wsp=\"http://www.w3.org/ns/ws-policy\" xmlns:sp=\"http://docs.oasis-open.org/ws-sx/ws-securitypolicy/200702\" xmlns:wsu=\"http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd\" targetNamespace=\"urn:account\">\n  <wsp:Policy wsu:Id=\"BindingPolicy\">\n    <wsp:ExactlyOne>\n      <wsp:All>\n        <sp:AsymmetricBinding>\n          <wsp:Policy>\n            <sp:InitiatorToken><wsp:Policy><sp:X509Token/></wsp:Policy></sp:InitiatorToken>\n            <sp:RecipientToken><wsp:Policy><sp:X509Token/></wsp:Policy></sp:RecipientToken>\n            <sp:AlgorithmSuite><wsp:Policy><sp:Basic256Sha256/></wsp:Policy></sp:AlgorithmSuite>\n            <sp:IncludeTimestamp/>\n          </wsp:Policy>\n        </sp:AsymmetricBinding>\n        <sp:SignedParts><sp:Body/></sp:SignedParts>\n        <sp:EncryptedParts><sp:Body/></sp:EncryptedParts>\n        <sp:WeirdToken/>\n      </wsp:All>\n    </wsp:ExactlyOne>\n  </wsp:Policy>\n  <types>\n    <schema xmlns=\"http://www.w3.org/2001/XMLSchema\">\n      <import namespace=\"urn:account\" schemaLocation=\"types.xsd\"/>\n    </schema>\n  </types>\n  <binding name=\"AccountBinding\">\n    <wsp:PolicyReference URI=\"#BindingPolicy\"/>\n    <operation name=\"GetAccount\"><input message=\"tns:In\"/><output message=\"tns:Out\"/></operation>\n    <operation name=\"ResetPassword\">\n      <wsp:Policy><wsp:All><sp:UsernameToken/></wsp:All></wsp:Policy>\n    </operation>\n  </binding>\n  <service name=\"AccountService\">\n    <wsp:PolicyReference URI=\"#MissingPolicy\"/>\n    <port name=\"AccountPort\" binding=\"tns:AccountBinding\"/>\n  </service>\n</definitions>"
    },
    {
      "name": "types.xsd",
      "role": "xsd",
      "content": "<?xml version=\"1.0\"?><schema xmlns=\"http://www.w3.org/2001/XMLSchema\" targetNamespace=\"urn:account\"/>"
    }
  ]
}
```

Example response:

```json
{
  "audit_status": "policy_conflicts",
  "risk_level": "critical",
  "operation_security_profiles": [
    {
      "service": "AccountService",
      "port": "AccountPort",
      "binding": "AccountBinding",
      "operation": "GetAccount",
      "tokens": [
        "x509"
      ],
      "sign_body": true,
      "encrypt_body": true,
      "transport": false,
      "timestamp": true,
      "inherited": true,
      "detail": "This profile is read from the supplied policy documents. It was not checked against a running server."
    },
    {
      "service": "AccountService",
      "port": "AccountPort",
      "binding": "AccountBinding",
      "operation": "ResetPassword",
      "tokens": [
        "username"
      ],
      "sign_body": false,
      "encrypt_body": false,
      "transport": false,
      "timestamp": false,
      "inherited": false,
      "detail": "This profile is read from the supplied policy documents. It was not checked against a running server."
    }
  ],
  "policy_conflicts": [
    {
      "binding": "AccountBinding",
      "operation": "ResetPassword",
      "code": "weaker_operation",
      "detail": "ResetPassword requires less than the outer policy for AccountBinding: sign_body, encrypt_body, timestamp, token:x509. This compares the supplied documents only."
    },
    {
      "binding": "AccountBinding",
      "operation": "GetAccount",
      "code": "token_inconsistent",
      "detail": "AccountBinding: The operations on this binding do not require the same tokens. This is a document comparison, not a runtime result."
    },
    {
      "binding": "AccountBinding",
      "operation": "GetAccount",
      "code": "sign_inconsistent",
      "detail": "AccountBinding: The operations on this binding do not sign the body in the same way. This is a document comparison, not a runtime result."
    },
    {
      "binding": "AccountBinding",
      "operation": "GetAccount",
      "code": "encrypt_inconsistent",
      "detail": "AccountBinding: The operations on this binding do not encrypt the body in the same way. This is a document comparison, not a runtime result."
    }
  ],
  "missing_requirements": [
    {
      "binding": "AccountBinding",
      "operation": "ResetPassword",
      "requirement": "sign_body",
      "detail": "ResetPassword does not repeat the outer sign_body requirement."
    },
    {
      "binding": "AccountBinding",
      "operation": "ResetPassword",
      "requirement": "encrypt_body",
      "detail": "ResetPassword does not repeat the outer encrypt_body requirement."
    },
    {
      "binding": "AccountBinding",
      "operation": "ResetPassword",
      "requirement": "timestamp",
      "detail": "ResetPassword does not repeat the outer timestamp requirement."
    },
    {
      "binding": "AccountBinding",
      "operation": "ResetPassword",
      "requirement": "token:x509",
      "detail": "ResetPassword does not repeat the outer token:x509 requirement."
    }
  ],
  "unsupported_assertions": [
    {
      "document": "account.wsdl",
      "name": "WeirdToken",
      "detail": "WeirdToken is not an implemented WS-SecurityPolicy assertion. It was not treated as protection."
    }
  ],
  "unresolved_references": [
    {
      "document": "account.wsdl",
      "reference": "#MissingPolicy",
      "detail": "This policy reference is not in the supplied documents. It was not fetched."
    }
  ],
  "findings": [
    {
      "code": "weaker_operation",
      "severity": "critical",
      "document": "account.wsdl",
      "binding": "AccountBinding",
      "operation": "ResetPassword",
      "detail": "ResetPassword requires less than the outer policy for AccountBinding: sign_body, encrypt_body, timestamp, token:x509. This compares the supplied documents only."
    },
    {
      "code": "token_inconsistent",
      "severity": "high",
      "document": "account.wsdl",
      "binding": "AccountBinding",
      "operation": "GetAccount",
      "detail": "AccountBinding: The operations on this binding do not require the same tokens. This is a document comparison, not a runtime result."
    },
    {
      "code": "sign_inconsistent",
      "severity": "high",
      "document": "account.wsdl",
      "binding": "AccountBinding",
      "operation": "GetAccount",
      "detail": "AccountBinding: The operations on this binding do not sign the body in the same way. This is a document comparison, not a runtime result."
    },
    {
      "code": "encrypt_inconsistent",
      "severity": "high",
      "document": "account.wsdl",
      "binding": "AccountBinding",
      "operation": "GetAccount",
      "detail": "AccountBinding: The operations on this binding do not encrypt the body in the same way. This is a document comparison, not a runtime result."
    },
    {
      "code": "policy_unresolved",
      "severity": "medium",
      "document": "account.wsdl",
      "detail": "Policy reference #MissingPolicy is not in the supplied documents. It was not fetched."
    },
    {
      "code": "assertion_unsupported",
      "severity": "medium",
      "document": "account.wsdl",
      "detail": "WeirdToken is not an implemented WS-SecurityPolicy assertion. It was not treated as protection."
    },
    {
      "code": "declared_only",
      "severity": "low",
      "detail": "These documents were supplied in the request. They were not fetched, and a declared policy is not evidence that a server enforces it."
    }
  ],
  "limitations": [
    "Documents are the XML strings in the request. Imports and policy references were not fetched.",
    "A declared policy is not evidence that a running SOAP server enforces it.",
    "Certificates and credentials are not validated.",
    "Implemented policy namespaces are WS-Policy 1.2 and 1.5, and WS-SecurityPolicy 1.2 and 1.3. Other assertions are reported and are not treated as protection.",
    "An operation with no attached policy inherits the nearest service, port, or binding policy. A policy with no security assertions is explicit, not missing.",
    "Only WSDL 1.1 is read."
  ]
}
```

### POST /api/v1/soap-security/policy-strength

$0.04 USDC. Score a caller-supplied algorithm suite, body signature, body encryption, timestamp, and token kind. Basic256Sha256 contributes the most, TripleDes and None the least. A username token scores below an X.509 token. The grade follows that score. No certificate is validated and no policy file is fetched.

Inputs: algorithm_suite, body_signed, body_encrypted, timestamp, token

Docs: https://www.brainiac.software/api/soap-security/docs#soap-security-policy-strength

Example request:

```json
{
  "algorithm_suite": "Basic128",
  "body_signed": true,
  "body_encrypted": false,
  "timestamp": true,
  "token": "username"
}
```

Example response:

```json
{
  "security_policy_grade": "D",
  "cryptographic_strength_score": 50
}
```