Loading…
Loading…
Learn how the Consume direction acts as a SOAP facade, converting inbound SOAP requests to REST for migrated backends while preserving legacy client
The Consume direction provides a SOAP facade that allows API publishers to modernize a backend service to REST while maintaining compatibility with legacy SOAP clients. When a service is configured in the Consume direction, the platform ingests inbound SOAP envelopes from API consumers, transforms each call into a REST request, and sends it to the migrated REST backend. It then wraps the REST response from the backend into a SOAP envelope and returns it to the original consumer.
This mechanism enables a backend migration to REST without requiring a coordinated, simultaneous cutover of all its clients. The API consumer continues to interact with a SOAP endpoint, unaware of the backend modernization.
The Consume direction is the inverse of the Publish direction, which exposes a REST facade for a SOAP backend. The direction is configured per service and is fixed once set.
Use the Consume direction when you have migrated a backend service from SOAP to REST but cannot immediately update the clients that depend on it. This is common in scenarios involving:
The SOAP facade allows the backend to be migrated independently, decoupling its evolution from the client's lifecycle.
The platform acts as a stateful intermediary, performing a bidirectional transformation between the SOAP and REST protocols. This process is guided by a mapping synthesized from multiple sources to ensure accuracy.
flowchart TD
subgraph Legacy Consumer
A[SOAP Client]
end
subgraph API Platform
B(SOAP Facade)
end
subgraph Migrated Backend
C[REST Service]
end
A -- 1. SOAP Request --> B
B -- 2. Converts to REST Request --> C
C -- 3. REST Response --> B
B -- 4. Converts to SOAP Response/Fault --> AA reliable SOAP-to-REST mapping requires more than just the two API contracts (WSDL and OpenAPI), as field names, data structures, and semantics may have changed during the migration to REST. A mapping based solely on the contracts could silently produce incorrect data.
To prevent this, the platform's mapping engine requires four distinct inputs to create a safe, production-ready service.
The onboarding wizard guides the API publisher through providing these four inputs in order:
A service cannot be published until at least one example payload is provided for each operation. These examples can be uploaded manually or ingested automatically from gateway traffic logs.
The onboarding wizard enforces the collection of these inputs before a service can be published. The high-level flow is as follows:
Service identity → Old WSDL → REST OpenAPI → REST backend config (incl. auth) → Example payloads → Mapping review → Publish
Because the consumer-facing contract is SOAP, the platform serves a WSDL document at the service's runtime endpoint. This WSDL is derived from the original WSDL provided during setup, but the platform modifies the <soap:address location="..."> attribute to point to the correct runtime URL for the service.
The derived WSDL is available for download at both the draft and published stages of the service's lifecycle.
NOTE
A Consume service does not have a generated OpenAPI document. Providing one would misrepresent the service's contract, as the endpoint accepts SOAP, not REST.
The inbound SOAP listener accepts both SOAP 1.1 and SOAP 1.2 requests. The runtime automatically detects the version from the request's Content-Type header and body.
| SOAP Version | Characteristics |
|---|---|
| SOAP 1.1 | Content-Type: text/xml. Uses faultcode, faultstring, and detail elements for faults. Relies on the SOAPAction header. |
| SOAP 1.2 | Content-Type: application/soap+xml. Uses a two-level fault model. |
The platform resolves the target operation using the message's qualified name (QName) and SOAPAction header, cross-referencing them with the service's configuration. Any faults generated by the platform (e.g., due to a malformed request) will match the fault structure of the inbound SOAP version.
WARNING
As of v1.0, WS-Security features like message signing and encryption are not supported on the inbound SOAP facade path. For more details, see SOAP & XSD support.
All invocations of a Consume service use a direction-prefixed runtime URL. The path structure is:
/consume/{environment}/{serviceKey}/{operationPath...}
A request to a path that does not include the /consume prefix will be rejected with an HTTP 400 error.
| Parameter | Description |
|---|---|
environment | The name of the deployment environment (e.g., dev, staging, prod). |
serviceKey | The unique identifier for the service. |
operationPath | The path segment(s) that identify the specific SOAP operation being invoked. |
The platform supports several authentication methods for the outbound REST call to your migrated backend. These are the same types available for a Publish direction service.
| Auth type | Description |
|---|---|
none | For unauthenticated backends, typically in a trusted network segment. |
basic | Standard HTTP Basic authentication (username and password). |
bearer | A static, externally-provisioned bearer token sent in the Authorization header. |
oauth2_client_credentials | The platform performs an OAuth2 client credentials grant flow to obtain a token, which it then caches and refreshes automatically. |
api_key_header | An API key sent in a custom-named HTTP header. |
| mTLS | A mutual TLS client certificate, which can be used in combination with any of the other authentication types. |
All credentials are encrypted at rest and are never exposed in logs or API responses.
| Condition | Trigger | Resolution |
|---|---|---|
HTTP 400 Bad Request | A request is made to a runtime URL without the /consume direction prefix. | Ensure the client is configured to send SOAP requests to the full, correct path, including the /consume segment. |
| SOAP Fault | The inbound request is malformed, does not match the WSDL, or an error occurs during processing. | The platform returns a SOAP Fault in the same SOAP version (1.1 or 1.2) as the request. The fault details will indicate the nature of the error. |
| WS-Security errors | A client attempts to use WS-Security message signing or encryption. | This feature is not supported. The client must be configured to send standard SOAP messages without WS-Security headers. |