Audit SOAP security policy API

Compare WS-Policy and WS-SecurityPolicy assertions across caller-supplied WSDL 1.1 bindings and operations. audit_status is valid, warnings, policy_conflicts, invalid, or incomplete. risk_level is low, medium, high, or critical. A declared policy is not evidence that a server enforces it. Imports are not fetched.

The Audit SOAP security policy operation is part of the SOAP Security Policy Audit API on BRAINIAC.software. Compare WS-Policy and WS-SecurityPolicy assertions across caller-supplied WSDL 1.1 bindings and operations. audit_status is valid, warnings, policy_conflicts, invalid, or incomplete. risk_level is low, medium, high, or critical. A declared policy is not evidence that a server enforces it. Imports are not fetched. It is exposed as POST /api/v1/soap-security/soap-security-policy-audit and priced at $0.05 USDC on Base. Payment uses the x402 exact scheme: an unpaid call returns HTTP 402 with payment requirements; after paying the exact USDC amount, retry the same request with a payment-signature header and Idempotency-Key. No account and no API key are required. Data sources for this product: Caller-supplied WSDL, XSD, and WS-Policy documents processed locally Limitations: Documents are the XML strings in the request. Imports and policy references are not fetched. A declared policy is not evidence that a running SOAP server enforces it. Implemented policy namespaces are WS-Policy 1.2 and 1.5, and WS-SecurityPolicy 1.2 and 1.3. Only WSDL 1.1 is read. Certificates and credentials are not validated. policy-strength scores the algorithm suite, signature, encryption, timestamp, and token kind supplied in the request. It does not validate a certificate. Outputs are compliance prechecks, drafts, or data lookups for human review. They are not official determinations, legal advice, identity confirmation, or certified filings. Related operations in this group include Score SOAP policy strength. Open the group documentation for the full request schema, field notes, and response examples before integrating.

POST$0.05 USDC
/api/v1/soap-security/soap-security-policy-audit

Example request

curl -i -X POST "https://www.brainiac.software/api/v1/soap-security/soap-security-policy-audit" \
  -H 'content-type: application/json' \
  -H 'Idempotency-Key: <fresh-64-character-random-hex-key>' \
  --data-binary @- <<'JSON'
{
  "documents": [
    {
      "name": "account.wsdl",
      "role": "wsdl",
      "content": "<?xml version=\"1.0\"?>\n<definitions xmlns=\"http://schemas.xmlsoap.org/wsdl/\" xmlns:tns=\"urn:account\" xmlns:wsp=\"http://www.w3.org/ns/ws-policy\" xmlns:sp=\"http://docs.oasis-open.org/ws-sx/ws-securitypolicy/200702\" xmlns:wsu=\"http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd\" targetNamespace=\"urn:account\">\n  <wsp:Policy wsu:Id=\"BindingPolicy\">\n    <wsp:ExactlyOne>\n      <wsp:All>\n        <sp:AsymmetricBinding>\n          <wsp:Policy>\n            <sp:InitiatorToken><wsp:Policy><sp:X509Token/></wsp:Policy></sp:InitiatorToken>\n            <sp:RecipientToken><wsp:Policy><sp:X509Token/></wsp:Policy></sp:RecipientToken>\n            <sp:AlgorithmSuite><wsp:Policy><sp:Basic256Sha256/></wsp:Policy></sp:AlgorithmSuite>\n            <sp:IncludeTimestamp/>\n          </wsp:Policy>\n        </sp:AsymmetricBinding>\n        <sp:SignedParts><sp:Body/></sp:SignedParts>\n        <sp:EncryptedParts><sp:Body/></sp:EncryptedParts>\n        <sp:WeirdToken/>\n      </wsp:All>\n    </wsp:ExactlyOne>\n  </wsp:Policy>\n  <types>\n    <schema xmlns=\"http://www.w3.org/2001/XMLSchema\">\n      <import namespace=\"urn:account\" schemaLocation=\"types.xsd\"/>\n    </schema>\n  </types>\n  <binding name=\"AccountBinding\">\n    <wsp:PolicyReference URI=\"#BindingPolicy\"/>\n    <operation name=\"GetAccount\"><input message=\"tns:In\"/><output message=\"tns:Out\"/></operation>\n    <operation name=\"ResetPassword\">\n      <wsp:Policy><wsp:All><sp:UsernameToken/></wsp:All></wsp:Policy>\n    </operation>\n  </binding>\n  <service name=\"AccountService\">\n    <wsp:PolicyReference URI=\"#MissingPolicy\"/>\n    <port name=\"AccountPort\" binding=\"tns:AccountBinding\"/>\n  </service>\n</definitions>"
    },
    {
      "name": "types.xsd",
      "role": "xsd",
      "content": "<?xml version=\"1.0\"?><schema xmlns=\"http://www.w3.org/2001/XMLSchema\" targetNamespace=\"urn:account\"/>"
    }
  ]
}
JSON

An unpaid probe returns HTTP 402 with x402 payment requirements. After paying the exact USDC amount on Base, retry the identical request with a payment-signature header.

FAQ

  • Do I need an API key? No. Pay the listed USDC amount with x402.
  • What network? Base (eip155:8453), USDC.
  • Is this an official determination? No. Results are for human review against the cited sources.

Related APIs

SOAP Security Policy Audit APIFull docsHow it works