skip to content

SOAP

An XML envelope over HTTP or JMS, described by WSDL and extended by WS-* standards for security, addressing and reliability. Interviewers ask when legacy or regulated integrations still use it.

part ofAPI stylesoverview, primer and where to startread it →
on this pageshow

explore

questions

page 1 of 2

What does a SOAP envelope contain, which of its parts are mandatory, and how does it tell a receiver which SOAP version it uses?

level: juniorimportance: must knowfreq 35%

answer

  1. one root, at most two children
  2. one optional, one mandatory
  3. Header first, Body straight after
  4. no version number anywhere
  5. the Envelope's namespace URI decides

basics

~20 s

A SOAP envelope is the root element: an optional Header of namespace-qualified header blocks, then a mandatory Body. The Envelope's namespace URI, not a version number, says SOAP 1.1 or 1.2; an unsupported one draws a VersionMismatch fault.

solid answer

~40 s

Every SOAP message is one `Envelope` element. Inside it comes an optional `Header`, which if present MUST be the first child, and then a mandatory `Body`. Each child of the Header is a header block (SOAP 1.1 calls it a header entry) and MUST be namespace-qualified; the Body carries the payload for the ultimate receiver, or a `Fault`. There is no version attribute: SOAP 1.1 puts the Envelope in `http://schemas.xmlsoap.org/soap/envelope/` and SOAP 1.2 in `http://www.w3.org/2003/05/soap-envelope`. A receiver that does not support the namespace it finds answers with a `VersionMismatch` fault, and a SOAP 1.2 node SHOULD add an `Upgrade` header block listing the envelopes it does accept. SOAP 1.2 also tightened the shape: nothing may follow the Body, which SOAP 1.1 had allowed.

code

xml · 11 lines
xml
<env:Envelope xmlns:env="http://www.w3.org/2003/05/soap-envelope">
  <env:Header>
    <tx:TransactionContext xmlns:tx="http://example.org/tx"
        env:mustUnderstand="true">tx-5001</tx:TransactionContext>
  </env:Header>
  <env:Body>
    <o:GetOrderStatus xmlns:o="http://example.org/orders">
      <o:OrderId>A-1042</o:OrderId>
    </o:GetOrderStatus>
  </env:Body>
</env:Envelope>

go deeper

for a junior

Recall the three elements, which one is optional, the order they must appear in, and that the Envelope's namespace URI distinguishes SOAP 1.1 from SOAP 1.2.

for a middle

Explain what a receiver does with an unexpected envelope namespace in each version, including the VersionMismatch fault and SOAP 1.2's Upgrade header block with SupportedEnvelope entries.

for a senior

Show how you would diagnose a partner call failing with VersionMismatch: read the namespace actually sent, establish which versions each side supports, and whether the endpoint can process both.

for a principal

Weigh accepting both envelope versions at an integration edge against standardising on one, remembering that the versioning model covers only the envelope, not header blocks, encodings or bindings.

## What a SOAP message is A **SOAP message** is one XML document whose root element is the **`Envelope`**. Everything SOAP itself defines lives inside it: an optional **`Header`** for extensions and a mandatory **`Body`** for the payload. SOAP 1.1 is a W3C Note; SOAP 1.2 is a W3C Recommendation that redefines the message as an XML infoset rather than as one particular serialization, but the three-element shape is the same in both versions. ## The three elements | Element | Required? | Position | Holds | |---|---|---|---| | `Envelope` | yes | the document element | a `Header` (optional) and a `Body` | | `Header` | no | first child of `Envelope` when present | header blocks (SOAP 1.1: header entries) | | `Body` | yes | directly after `Header`, otherwise first child | the payload for the ultimate receiver, or a `Fault` | - **Header blocks** are how SOAP is extended without prior agreement between the parties: a transaction context, a security token, a correlation identifier. Each one is identified by its fully qualified name, the namespace URI plus the local name, so both versions require every immediate child of the Header to be namespace-qualified. - Header blocks may carry attributes that say **which node** should process them and **whether processing is mandatory**; those rules are the processing model, separate from the envelope's shape. - **Body children** are the application's message: a request, a response or a one-way document. SOAP 1.1 says they MAY be namespace-qualified; SOAP 1.2 says they SHOULD be. - The **`Fault`** is the one Body child SOAP defines itself; it reports an error in place of a normal result. ## Rules a receiver can rely on 1. The Header, if present, comes first and the Body follows it immediately; a Body before a Header is not a SOAP message. 2. SOAP 1.1 lets the Envelope carry extra namespace-qualified elements after the Body; SOAP 1.2 permits none, because its Envelope has exactly one or two children, Header and Body. 3. Neither version allows a document type declaration. SOAP 1.1 forbids processing instructions outright; SOAP 1.2 forbids an initial sender to include them, and a receiver that finds one SHOULD answer with a fault whose Code is `env:Sender`. 4. SOAP 1.1 allows the `encodingStyle` attribute on any element; SOAP 1.2 names the elements where it may appear, and the `Envelope` is not one of them. ## The namespace is the version There is no version number in a SOAP message. SOAP 1.1 says outright that it does not define a major/minor versioning model. The **XML namespace of the `Envelope` element** is the version signal: | Version | Envelope namespace | |---|---| | SOAP 1.1 | `http://schemas.xmlsoap.org/soap/envelope/` | | SOAP 1.2 | `http://www.w3.org/2003/05/soap-envelope` | Two elements with the same local name in different namespaces are simply different elements, so a processor knows which rule book applies before it reads anything else. SOAP 1.2's versioning model covers **only the Envelope**: it does not version header blocks, encodings or protocol bindings. A node MAY support several envelope versions, but it MUST process each message with the semantics of the version that message declares. ## What happens on a mismatch - **SOAP 1.1:** a receiver that finds the Envelope in any other namespace MUST treat it as a version error and discard the message; over a request/response protocol such as HTTP it MUST reply with a fault whose `faultcode` is `VersionMismatch`, using the SOAP 1.1 namespace. - **SOAP 1.2:** a node that does not support the message's version MUST generate a fault whose Code `Value` is `env:VersionMismatch`, and SHOULD include an **`Upgrade`** header block whose `SupportedEnvelope` children name, by `qname`, the envelopes it accepts, most preferred first. Any other malformation of the message construct is an `env:Sender` fault instead. - **Crossing versions:** the transition appendix of SOAP 1.2 Part 1 says a SOAP 1.1 node receiving a 1.2 message answers with a SOAP 1.1 VersionMismatch fault. A SOAP 1.2 node receiving a 1.1 message MAY process it as 1.1 if it supports that version; otherwise it MUST answer with a VersionMismatch fault built as a SOAP 1.1 message, which SHOULD carry an `Upgrade` block advertising SOAP 1.2, so the older sender can actually read the refusal. ## Why interviewers ask The question checks whether a candidate sees SOAP as a message format with rules rather than as "XML over HTTP". Knowing that the Header is optional and the Body is not, that header blocks must be namespace-qualified, and that the namespace rather than a version attribute decides which rules apply explains a classic first-day failure with a new partner: a client built for one version calls an endpoint that speaks only the other and gets a VersionMismatch fault back. How each version is labelled on the wire, through the media type and the action, is the transport binding's business and sits on top of the envelope rather than inside it.

  • Is a SOAP message with an empty Body valid?
    Yes. Both versions require the `Body` element itself but allow it to have no children: SOAP 1.1 says it MAY contain body entries, and SOAP 1.2 allows zero or more child elements. What an empty Body means is up to the application contract, not to SOAP.
  • Why does SOAP signal its version with a namespace instead of a version attribute?
    Because the namespace changes the element's identity: a SOAP 1.2 `Envelope` and a SOAP 1.1 `Envelope` are different expanded names, so a processor recognises the version from the root element before interpreting anything. SOAP 1.1 explicitly declines a major/minor numbering model, and SOAP 1.2's versioning model is directed only at the Envelope element.
  • What can a SOAP 1.2 node add to a VersionMismatch fault to help the sender recover?
    An `Upgrade` header block containing one or more `SupportedEnvelope` elements, each with a `qname` attribute naming an envelope it understands, ordered from most to least preferred. When the offending message was SOAP 1.1, the fault itself is built as a SOAP 1.1 message so the sender can parse it.

saying these in an interview costs you the question

  • Every SOAP message must contain a Header, even an empty one.
  • The SOAP version is carried in a version attribute on the Envelope.
  • Header blocks can be plain elements with no namespace.
  • The Body may come before the Header when both are present.
  • SOAP 1.2 still allows extra elements after the Body.
open as a page

What is the core difference between SOAP and REST, and why is comparing the two not quite like-for-like?

level: juniorimportance: must knowfreq 50%

basics

~20 s

SOAP is a messaging protocol: an XML envelope carrying operations, usually described by a WSDL contract, over HTTP or other transports. REST is an architectural style: resources at URIs, acted on through HTTP's uniform methods and status codes.

open as a page

What does a WSDL 1.1 document describe, and which of its elements say what a service does, how to reach it and where?

level: juniorimportance: must knowfreq 40%

basics

~20 s

A WSDL 1.1 document is an XML contract for a web service: types and message define the data, portType lists the abstract operations, binding fixes protocol and format, and service groups ports, each a binding at one address.

open as a page

In WS-Security, what is the wsse:Security SOAP header block, and what kinds of security information does it carry?

level: juniorimportance: must knowfreq 30%

basics

~20 s

wsse:Security is the SOAP header block WS-Security defines for security data aimed at one recipient: tokens such as a UsernameToken, an X.509 certificate or a SAML assertion, a wsu:Timestamp, and the signatures and encryption keys protecting chosen parts.

open as a page

When the same operation moves from SOAP 1.1 to SOAP 1.2 over HTTP, what changes in the HTTP request and response?

level: middleimportance: must knowfreq 30%

basics

~20 s

SOAP 1.1 sends text/xml with a mandatory SOAPAction header and returns faults with HTTP 500. SOAP 1.2 sends application/soap+xml with an optional action parameter, returns Sender faults with 400 and other faults with 500, and also permits GET.

open as a page

In a WSDL 1.1 SOAP binding, what do document versus rpc style and literal versus encoded use decide, and why did document/literal wrapped win?

level: middleimportance: must knowfreq 28%

basics

~20 s

Style decides whether the Body holds documents or an operation-named wrapper of parameters; use decides whether a schema fixes the XML (literal) or encoding rules generate it (encoded). Document/literal wrapped won: schema-valid, cleanly dispatched, profile-conformant.

open as a page

How does a SOAP 1.2 Fault differ from a SOAP 1.1 Fault in its child elements and its standard fault codes?

level: middleimportance: must knowfreq 28%

basics

~20 s

SOAP 1.1 Faults carry faultcode, faultstring, optional faultactor and detail, coded VersionMismatch, MustUnderstand, Client or Server. SOAP 1.2 uses Code (Value, nested Subcode), Reason (Text per xml:lang), optional Node, Role and Detail, renames Client/Server to Sender/Receiver and adds DataEncodingUnknown.

open as a page

In the WS-Security UsernameToken profile, how does PasswordDigest differ from PasswordText, and what stops a captured token from being replayed?

level: middleimportance: must knowfreq 25%

basics

~20 s

PasswordText sends the password, or an equivalent, as is; PasswordDigest sends Base64(SHA-1(nonce + created + password)). Replay is stopped by the receiver, which rejects stale Created times and caches used nonces for that freshness window.

open as a page

What are the four WSDL 1.1 operation types, and which of them can a SOAP-over-HTTP service actually expose?

level: juniorimportance: should knowfreq 14%

basics

~10 s

WSDL 1.1 defines one-way, request-response, solicit-response and notification operations. WSDL 1.1 itself binds only one-way and request-response, and WS-I Basic Profile forbids the other two, so a SOAP-over-HTTP service exposes those two.

open as a page

In SOAP, what must a node do with a mustUnderstand header block targeted at it that it does not understand, and why?

level: middleimportance: should knowfreq 22%

basics

~20 s

It must not process the message and must generate a MustUnderstand fault instead. The flag marks an extension that changes what the message means, so a node that silently skipped it could act on the wrong semantics.

open as a page

How does a SOAP service over HTTP report an error compared with a REST API, and what can generic HTTP infrastructure learn from each?

level: middleimportance: should knowfreq 28%

basics

~20 s

SOAP puts the error in a Fault element inside the envelope, under a coarse HTTP status: 500 in SOAP 1.1, 400 or 500 in SOAP 1.2. REST makes the status code itself the main signal and adds details in the body.

open as a page

Why does SOAP over HTTP usually get no benefit from HTTP caches when a REST API can, and what does SOAP 1.2 offer instead?

level: middleimportance: should knowfreq 22%

basics

~20 s

HTTP caches reuse responses to safe GET requests identified by URI, but SOAP over HTTP typically sends every operation as a POST to one endpoint, naming the resource inside the envelope. SOAP 1.2 allows plain GET for safe retrievals.

open as a page

Why does WSDL 1.1 separate abstract messages and portTypes from concrete bindings and ports, and what does a stub generator read from each?

level: middleimportance: should knowfreq 25%

basics

~20 s

WSDL 1.1 keeps operations and messages abstract so one portType can be bound to several protocols and deployed at many addresses; a generator takes signatures and data types from the abstract half, wire format and a default address from the concrete half.

open as a page

In WS-Addressing 1.0, how does a SOAP order service deliver its confirmation asynchronously to a client's callback endpoint, and which headers correlate the reply?

level: middleimportance: should knowfreq 14%

basics

~20 s

WS-Addressing puts routing into SOAP headers: the request carries To, Action, a MessageID and a ReplyTo endpoint reference naming the callback; the service later sends a separate message to that address carrying RelatesTo with the request's MessageID.

open as a page

Why does a valid WS-Security signature not stop a recorded SOAP message from being replayed, and what does a signed wsu:Timestamp add?

level: middleimportance: should knowfreq 10%

basics

~20 s

A signature proves who produced the bytes and that they are unchanged, so an exact copy verifies again. A signed wsu:Timestamp adds Created and Expires times the receiver can check, bounding how long a copy works and how much history it must remember.

open as a page

In WS-Security, how does a wsse:BinarySecurityToken carry an X.509 certificate, and how does a signature identify the certificate it used?

level: middleimportance: should knowfreq 12%

basics

~20 s

A wsse:BinarySecurityToken carries the Base64-encoded certificate, its ValueType naming the format (#X509v3, #X509PKIPathv1, #PKCS7). The signature's ds:KeyInfo holds a wsse:SecurityTokenReference pointing to that token by ID, or to the certificate by subject key identifier or issuer and serial number.

open as a page

A client generated from a partner's WSDL 1.1 fails against the service although both stacks claim SOAP 1.1; which WS-I Basic Profile binding rules would you check, and why?

level: seniorimportance: should knowfreq 16%

basics

~20 s

Check the binding against WS-I Basic Profile 1.1: literal use only, rpc-literal or document-literal with at most one document part, a distinct operation signature per operation, a quoted SOAPAction matching the binding, POST, and HTTP 500 for faults.

open as a page

When designing a SOAP 1.2 service's error contract, how should Sender versus Receiver, Subcode and Detail be used so clients can act on a Fault?

level: seniorimportance: should knowfreq 14%

basics

~20 s

Use Sender when the request is wrong and must change before it is resent, Receiver when processing failed and a later resend could succeed. Put the service's own categories in Subcode QNames and machine-readable data in Detail; Reason is for humans.

open as a page

A SOAP 1.2 message crosses a forwarding intermediary before its ultimate receiver; how do role, mustUnderstand and relay decide what the intermediary processes, removes or forwards?

level: seniorimportance: should knowfreq 12%

basics

~20 s

The intermediary handles only header blocks whose role it plays, next or custom roles it assumes. When forwarding, it removes blocks it processed unless reinserted, removes targeted blocks it ignored unless relay="true", and passes on blocks aimed at other roles.

open as a page

When choosing between SOAP and REST for a new tax-authority integration that offers both, which factors should decide, and when is SOAP the better answer?

level: seniorimportance: should knowfreq 30%

basics

~20 s

Decide on the integration's needs: SOAP wins where a strict WSDL contract, protection that must survive intermediaries, a non-HTTP transport or the counterpart's own SOAP estate matters. Otherwise REST's HTTP semantics, caching and lighter tooling usually win.

open as a page

A partner republishes its WSDL 1.1 contract with a new targetNamespace for version 2 — what changes for your generated client, and what changes on the wire?

level: seniorimportance: should knowfreq 14%

basics

~20 s

The WSDL's targetNamespace names portTypes, messages, bindings and services, which a generated client is built around but a document/literal message never carries; the wire changes only if the schema namespace, the soapAction values or the address change too.

open as a page

Over WS-ReliableMessaging 1.2, an RM Source receives a SequenceAcknowledgement with ranges 1-4 and 6-9 — what does that prove, and what does it not?

level: seniorimportance: should knowfreq 8%

basics

~20 s

It proves the RM Destination accepted messages 1-4 and 6-9 and has not accepted 5, so the RM Source should retransmit 5. It does not prove the application received or processed anything: acknowledgement is between the RM endpoints.

open as a page

A SOAP 1.2 claim message crosses two intermediaries before its ultimate receiver; how should WS-Security sign and encrypt it so the Body stays protected end to end?

level: seniorimportance: should knowfreq 15%

basics

~20 s

TLS ends at each intermediary, so the sender signs the Body, Timestamp and any header the receiver relies on, and encrypts the Body's content for the ultimate receiver's key, leaving intermediaries only the headers aimed at their own roles.

open as a page

When a WSDL 1.1 contract is split across files, when do you use wsdl:import versus xsd:import, and what goes wrong when they are mixed up?

level: middleimportance: nice to knowfreq 8%

basics

~20 s

wsdl:import brings in another WSDL description; XML Schema comes in through xsd:import inside an xsd:schema in wsdl:types. The WS-I Basic Profile requires that split, although the WSDL 1.1 Note's own example imports an XSD with wsdl:import.

open as a page

What did WSDL 2.0 change from WSDL 1.1 in how a service's operations, messages and endpoints are described?

level: middleimportance: nice to knowfreq 7%

basics

~20 s

WSDL 2.0 renamed portType to interface and port to endpoint, dropped the message element so operations reference XSD elements directly, named each operation's message exchange pattern by URI, and added interface inheritance; most contracts in use stayed on WSDL 1.1.

open as a page

In WS-Policy 1.5, what does a wsp:ExactlyOne holding two wsp:All alternatives, attached to a WSDL 1.1 binding, tell a client to do?

level: middleimportance: nice to knowfreq 6%

basics

~10 s

It offers two policy alternatives for that endpoint: the client may pick either, must pick exactly one per interaction, and must then satisfy every assertion inside the wsp:All it picked.

open as a page

Why would you send a large binary field of a SOAP 1.2 message with MTOM/XOP instead of inline base64, and what does it preserve?

level: seniorimportance: nice to knowfreq 9%

basics

~20 s

Inline base64 inflates binary by about a third and is parsed as text. MTOM/XOP moves canonical base64Binary element content into raw MIME parts referenced by xop:Include, while the Infoset, and so its signatures, stays as if inline.

open as a page

What does the W3C SOAP over JMS binding define in place of what SOAP over HTTP gets from HTTP itself, and what does it leave out?

level: seniorimportance: nice to knowfreq 6%

basics

~20 s

SOAP over JMS carries what HTTP headers and status provide as SOAPJMS_* message properties, names destinations with a jms: URI, and correlates replies via JMSReplyTo and JMSCorrelationID. It leaves out cross-provider interoperation and any wire format.

open as a page

In the WS-Security SAML Token Profile, how do holder-of-key and sender-vouches subject confirmation differ, and what must the receiver verify for each?

level: seniorimportance: nice to knowfreq 7%

basics

~20 s

With holder-of-key, the sender proves it knows a key named in the assertion's subject confirmation, usually by signing message content with it. With sender-vouches, a separate attesting entity the receiver already trusts signs assertion and message together, vouching for the subject.

open as a page

An insurer runs many partner-facing SOAP services; how would you decide which to migrate to REST and which to keep on SOAP?

level: principalimportance: nice to knowfreq 9%

basics

~20 s

Decide service by service: migrate where partners want it and the service uses plain request-response, and keep SOAP where partners' certified clients depend on the WSDL or where message-level security, reliable messaging or queue transport is genuinely in use.

open as a page

showing 1–30 of 31