Comprehensive release notes for the SOAP-2-REST v1.0 General Availability release. Details features including bidirectional conversion, traffic-driven
Applies to1.xFrom 1.7.23
Release Notes: v1.0 (General Availability)
This document provides the complete feature inventory for version 1.0, the inaugural General Availability (GA) release of the SOAP-2-REST platform.
Overview
Version 1.0 is the first GA release, delivering a complete platform for modernizing SOAP-based services. It enables API publishers to create REST facades for existing SOAP backends or, conversely, create SOAP facades for modern REST backends, with all components running entirely within your VPC.
The platform's core capabilities include:
Traffic-Driven Discovery: Automatically identifies services and operations by observing live traffic from gateways and load balancers.
Bidirectional Conversion: Provides deterministic, full-field SOAP-to-REST and REST-to-SOAP conversion.
API Contract Generation: Generates OpenAPI v3 specifications for new REST facades and serves WSDL contracts for new SOAP facades.
Learned Examples: Captures real request and response payloads from traffic to build a library of examples.
Integrated Observability: Offers dashboards, SLO reporting, searchable logs, and live traffic inspection within the application.
Key Features
Conversion
The platform provides a single runtime for both conversion directions, with extensive customization options.
Bidirectional Operation:
Publish: Exposes a REST/JSON facade for a SOAP backend. The published API contract is an OpenAPI v3 document.
Consume: Exposes a SOAP facade for a REST backend. The published API contract is a WSDL served by the endpoint. Outbound REST requests support multiple authentication methods: none, basic, bearer token, OAuth2 client-credentials, API key in a header, and mutual TLS.
Deterministic Mapping: Mappings are generated from the source WSDL/XSD, covering the entire request and response structure. These mappings are versioned and immutable, with support for activation and rollback. Field-level overrides can be configured through the UI.
SOAP Protocol Support:
SOAP 1.1 and 1.2, including the application/soap+xml content type and two-level fault model for SOAP 1.2. The runtime automatically detects the version from the request body and Content-Type header.
WSDL message styles: document/literal (wrapped and bare) and rpc/literal.
Per-operation injection of SOAP headers and parsing/building of RPC-style envelopes.
Fault Handling: SOAP faults are normalized into a deterministic REST error structure. Fault details declared in the WSDL are reflected in the generated OpenAPI schema.
Conversion Options: A wide range of behaviors can be tuned globally, per-service, per-operation, or per-field. These include:
Date/time formatting
Numeric and boolean handling
Null value handling
Array collapsing
Whitespace processing
Binary encoding
Duration formatting
Field-name casing
SOAP header propagation
Response envelope shape
JSON field ordering
Error/fault shape (including RFC 7807)
xsi:type discriminator handling
Upstream failure status codes
Required field handling
Request/response validation modes
Multi-Backend and Resilience
Routing: Supports routing to multiple backends for a single service, with failover and backend health checks.
Configuration: Transport settings can be configured on a per-backend basis.
Timeouts and Retries: Per-operation timeouts and retries are configurable.
Timeout Default: 100 ms
Retries Default: 2
Payload Limit: The platform enforces a synchronous payload ceiling of 30 MB and rejects larger requests.
OpenAPI v3 Generation
For each service in the Publish direction (REST facade for a SOAP backend), the platform generates a standards-compliant OpenAPI v3 document.
The generated schema reflects all configured conversion options and validation rules.
Fault schemas are emitted for each operation based on the faults declared in the source WSDL.
Services in the Consume direction publish a WSDL, as the consumer-facing contract is SOAP.
Discovery and Onboarding
Traffic-Driven Discovery: Services are discovered by analyzing live traffic from your edge infrastructure. The discovery dashboard displays request counts per service over 24-hour, 7-day, and 1-month periods, with data loaded from pre-computed aggregation tables for fast performance.
Consumer Attribution: Identifies API consumers by resolving forwarded headers such as X-Client-IP, X-Forwarded-For, and Forwarded.
WSDL Onboarding Wizard: A no-code wizard allows importing a WSDL via file upload, URL, or pasted XML. It provides suggestions for the backend endpoint, SOAP version, and authentication based on the WSDL content.
Automated Setup:
Zero-Touch Autopilot: A single-step process to generate a draft service, its operations, and corresponding mappings, including a readiness score for each operation.
Change Detection: When re-importing a WSDL, the platform detects breaking changes, added or removed operations, and provides a per-operation delta.
WSDL Namespace Repair: Includes functionality to repair broken WSDLs.
Learned Examples: Captures and curates real request/response payloads and headers from production traffic for each service and operation.
Connectors
v1.0 ships with connectors that provide both management-API discovery and a traffic-ingest path.
API Gateways: IBM DataPower (via REST management interface and HTTP log target), CA/Broadcom Layer7, Software AG/IBM webMethods, Perforce Akana, TIBCO Mashery, Oracle API Gateway.
Generic HTTP Receiver: A universal ingest endpoint with per-vendor parsers and a dead-letter queue. It can be used with any edge component that emits accessible HTTP traffic logs.
NOTE
Discovery and ingest mechanisms vary by vendor. The Oracle API Gateway connector is included in v1.0; its field-shape validation is being finalized with the first customer using that platform.
Observability
Operations Dashboard: Provides KPI tiles, timeline charts, and per-service rollups.
SLO Reports: Configure availability and latency targets with breach detection.
Searchable Logs: Runtime logs are searchable and keyed by correlation ID, result code, environment, service, and operation.
Live Traffic: A live log viewer shows full request and response payloads and headers for detailed analysis.
Contract Drift Detection: Monitors backend responses for deviations from the expected contract.
Asynchronous Callback Tracking: Tracks the lifecycle and timing of asynchronous callbacks, with features for replaying stored callbacks, manual reprocessing, and overdue detection.
Performance: All time-bucketed data surfaces read from pre-computed aggregation tables, avoiding slow queries against raw logs.
Data Retention: Log and metric data is retained for 60 days by default, and this period is configurable.
Security
Role-Based Access Control (RBAC): Predefined roles of admin, operator, and reader. Roles can be mapped from IdP groups, assigned directly to principals in-app, or managed via an emergency bootstrap list.
Identity Management: Integrates with Google IAP, Azure AD, and standard SAML / OIDC providers.
Network Security: The platform has no public endpoint by default and is designed for internal-only networking.
Credential Management: Backend credentials are encrypted using pgcrypto and are never logged or returned in plaintext.
Database Authentication: Supports IAM database authentication on Google Cloud.
Audit Trail: A full audit trail logs all actions, including the actor, role, action, and before/after state.
Correlation IDs: A unique correlation ID is maintained across the entire request lifecycle.
Licensing
Model: The platform uses a Specaria-platform license, which is a JWKS-verified RS256 JWT. The license is re-verified periodically.
Grace Period: An offline grace period of 14 days is provided before the platform enters a degraded (read-only) mode.
Capacity Dimensions: Licensing is based on the number of discovered services and converted (active) services, counted over a rolling window.
Failure Modes: Telemetry outages do not disrupt traffic (fail-open). An invalid or expired license disables licensed write operations only after the grace period expires (fail-closed).
Telemetry Data: Outbound telemetry contains only numeric counts, versions, a hashed host fingerprint, an installation ID, a customer label, and a contact email. It does not egress PII, payloads, or hostnames.
Languages and Localization
Full end-to-end UTF-8 support for payloads, envelopes, database storage, generated contracts, and the UI.
Support for Hebrew, including gendered forms, Hebrew regex constraints, and right-to-left (RTL) rendering.
Timezone and locale can be configured on a per-tenant basis.
Deployment
GCP-Native: Deploys on Cloud Run, Cloud SQL (PostgreSQL with IAM DB Auth), Cloud Storage, and Cloud IAP.
Kubernetes / OpenShift: A Helm chart is provided for deployment.
GCP Marketplace: Available as a listing in the GCP Marketplace.
Standalone: A Docker Compose stack is available for running the control plane, runtime, worker, and PostgreSQL. It includes an automated CI smoke test.
Cloud Abstraction: A cloud-adapter abstraction layer is provided for object storage, compute provisioning, relay VMs, and secret stores. Adapters are available for Google Cloud, Azure, and VMware. Sample Terraform environments are provided for AWS, Azure, and a vSphere relay.
Performance
The platform is engineered and load-tested for a baseline of approximately 1 million calls per day (~12 rps sustained, ~100 rps burst).
Dashboards provide sub-second response times, even with large numbers of services, by querying pre-computed aggregation tables.
Known Limitations in v1.0
The following capabilities are intentionally out of scope for the standard v1.0 product and are handled as bespoke engagements:
RPC/encoded Messages: Only document/literal and rpc/literal SOAP message styles are supported.
WS-Security: Message signing and encryption on the inbound SOAP facade (Consume direction) are not supported. Outbound REST authentication, including mTLS, is supported.
Non-HTTP Transports: Only HTTP/HTTPS is supported. Transports like message queues or SFTP are not included.
Fully Air-Gapped Operation: The platform requires outbound HTTPS connectivity to the Specaria platform for licensing and updates. A 14-day offline grace period accommodates transient connectivity loss.
Native Deployments: VM appliance images and first-class native ports for AWS, Azure, and Oracle are not included. Sample Terraform for AWS, Azure, and vSphere is available.
Additional Integrations: Connectors for identity providers like Okta and Keycloak, and for modern API management platforms, are not included. The generic-HTTP receiver can be used for many unsupported platforms.
Upgrading
This is the inaugural GA release. There is no prior GA version to upgrade from.
