Comprehensive release notes for the SOAP-2-REST v1.0 General Availability release. Details features like bidirectional conversion, OpenAPI generation, and
Applies to1.7.7
{/* AUTO-GENERATED from the docs pipeline — do not edit by hand /}
{/ source doc_id: prd-s2r-docs-public-knowledgebase-releases-v1-0-ga · version: 1.7.7 */}
Overview
This document provides the comprehensive feature inventory for the v1.0 General Availability (GA) release of the SOAP-2-REST platform. This is the inaugural GA release.
The platform provides a complete solution for integrating legacy SOAP web services with modern REST-based architectures. It allows API publishers to create REST facades for existing SOAP backends or, conversely, to create SOAP facades for new or migrated REST backends. The entire system is designed to run within a customer's own Virtual Private Cloud (VPC).
Core capabilities delivered in v1.0 include:
Traffic-driven discovery of existing SOAP services.
Deterministic, full-field SOAP↔REST conversion in both directions.
Automatic generation of OpenAPI v3 specifications for REST facades.
In-app observability dashboards, logging, and SLO reporting.
How it Works
The platform operates in two primary modes on a single runtime: Publish and Consume.
Publish: Exposes a REST/JSON API to consumers, which the platform translates into SOAP requests for a backend web service. The consumer-facing contract is an OpenAPI v3 document.
Consume: Exposes a SOAP API to consumers, which the platform translates into REST/JSON requests for a backend service. This is typically used to maintain a stable SOAP contract for consumers while a backend has been migrated to REST. The consumer-facing contract is a WSDL served by the platform.
The following diagram illustrates the data flow for both modes:
flowchart TD
subgraph Publish Direction (REST Facade)
A[API Consumer] -- REST/JSON Request --> B(s2r Runtime)
B -- SOAP Request --> C(SOAP Backend)
C -- SOAP Response --> B
B -- REST/JSON Response --> A
D[OpenAPI v3] -- Defines Contract --> B
end
subgraph Consume Direction (SOAP Facade)
E[API Consumer] -- SOAP Request --> F(s2r Runtime)
F -- REST/JSON Request --> G(REST Backend)
G -- REST/JSON Response --> F
F -- SOAP Response --> E
H[WSDL] -- Defines Contract --> F
end
Mappings between SOAP and REST are generated deterministically from a source WSDL and are stored as immutable, versioned snapshots that can be activated or rolled back.
Key Features
Conversion
Bidirectional Operation: The runtime supports both Publish (REST in → SOAP out) and Consume (SOAP in → REST out) modes.
SOAP Version Support: The runtime automatically detects and handles SOAP 1.1 and SOAP 1.2, including the application/soap+xml content type and the two-level fault model of SOAP 1.2.
WSDL Message Styles: Supports document/literal (wrapped and bare) and rpc/literal styles.
Deterministic Mapping: Generates a full-field mapping from the source WSDL/XSD for the entire request and response structure.
Mapping Management: Mappings are versioned and immutable. Field-level overrides can be configured via the UI.
SOAP Headers: Supports per-operation injection of SOAP headers.
Fault Normalization: Normalizes SOAP faults into a deterministic REST error structure. WSDL-declared fault details are reflected in the generated OpenAPI schema.
Outbound Authentication (Consume Mode): Supports none, basic, bearer, OAuth2 client-credentials, API key in a header, and mutual TLS for outbound REST requests.
Conversion Options: A wide range of tunable behaviors can be set globally, per-service, per-operation, or per-field. See the Configuration Reference for a full list.
Multi-Backend and Resilience
Routing: Supports routing to multiple backends for a single service.
Failover: Provides backend failover capabilities, governed by backend health checks.
Transport Settings: Per-backend SOAP transport settings can be configured.
Timeouts and Retries: Per-operation timeouts and retries are configurable to manage backend performance and availability.
Payload Size Limit: A hard limit of 30 MB is enforced for synchronous payloads, which results in a clear rejection if exceeded.
OpenAPI v3 and WSDL Generation
OpenAPI v3 Generation (Publish Mode): Generates a standards-compliant OpenAPI v3 document for each published service. The schema reflects all configured conversion options and validation rules.
WSDL Serve-back (Consume Mode): Publishes a WSDL for the consumer-facing SOAP contract.
Discovery and Onboarding
Traffic-Driven Discovery: Discovers services by analyzing live traffic from connected gateways and load balancers. The discovery view provides request counts over 24-hour, 7-day, and 1-month periods, loaded from pre-computed aggregation tables for fast performance.
Consumer Attribution: Identifies consumers by resolving forwarded headers such as X-Client-IP, X-Forwarded-For, and Forwarded.
WSDL Onboarding: A wizard allows importing a WSDL from a file, URL, or pasted XML. It provides suggestions for the backend endpoint, SOAP version, and authentication based on the WSDL content.
Autopilot: A one-step process to generate a draft service, its operations, and corresponding mappings, including a readiness score for each operation.
Change Detection: When re-importing a WSDL, the platform detects breaking changes, added/removed operations, and other deltas.
Learned Examples: Captures real request/response payloads and headers from production traffic, which can be curated as examples for each operation.
WSDL Repair: Includes functionality to repair common issues in broken WSDL namespaces.
Connectors
The platform ships with connectors for traffic-driven discovery and ingest from various load balancers and API gateways. A generic HTTP receiver is also available for other sources.
API Gateways: IBM DataPower, CA/Broadcom Layer7, Software AG/IBM webMethods, Perforce Akana, TIBCO Mashery, Oracle API Gateway.
Generic-HTTP Receiver: A universal ingest endpoint with per-vendor parsers and a dead-letter queue for any edge device that can emit HTTP traffic logs.
NOTE
The Oracle API Gateway connector is included in v1.0, with its field-shape validation to be finalized based on initial customer deployments on that platform.
Observability
Dashboards: An operations dashboard provides KPI tiles, timeline charts, and per-service rollups.
SLO Reporting: Configure and monitor Service Level Objectives (SLOs) for availability and latency, with breach detection.
Searchable Logs: Runtime logs are searchable and keyed by correlation ID, result code, environment, service, and operation.
Live Traffic: A live traffic log provides full request/response payloads and headers for detailed analysis.
Contract Drift: Detects when backend responses deviate from the expected contract.
Asynchronous Callbacks: Provides tracking for the lifecycle and timing of asynchronous callbacks, including replay, manual reprocessing, and overdue detection.
Performance: All time-bucketed data surfaces read from pre-computed aggregation tables for fast query performance.
Data Retention: Log and metric retention is configurable, with a default of 60 days.
Security
RBAC: Role-Based Access Control with admin, operator, and reader roles, which can be mapped from an IdP, bound directly, or managed via a bootstrap list.
Identity Providers: Supports Google IAP, Azure AD, and standard SAML/OIDC.
Network Security: The platform has no public endpoint by default and operates on internal-only networks.
Credential Encryption: Backend credentials are encrypted (using pgcrypto) and are never logged or returned in plaintext.
Database Authentication: Supports IAM database authentication on Google Cloud.
Audit Trail: A full audit trail records all actions with the actor, role, and before/after state.
Correlation IDs: A correlation ID is maintained across the entire request lifecycle.
Licensing
Mechanism: Uses a JWKS-verified RS256 license JWT, which is re-verified periodically.
Capacity: Licensing is based on the number of discovered services and active (converted) services, measured over a rolling window.
Failure Modes: Telemetry reporting is fail-open (an outage will not disrupt traffic). Entitlement is fail-closed (an invalid or expired license will disable licensed write operations after a grace period).
Grace Period: An offline grace period of 14 days is provided before the platform enters a degraded (read-only) mode.
Telemetry Data: Outbound telemetry includes only numeric counts, versions, a hashed host fingerprint, an installation ID, a customer label, and a contact email. No PII, payloads, or hostnames are egressed.
Languages and Localization
Character Encoding: Full end-to-end UTF-8 support.
Localization: Supports Hebrew, including gendered forms and RTL rendering.
Timezone/Locale: Configurable on a per-tenant basis.
Deployment
Google Cloud: Native support for Cloud Run, Cloud SQL (PostgreSQL), Cloud Storage, and Cloud IAP. A GCP Marketplace listing is available.
Kubernetes/OpenShift: A Helm chart is provided for deployment.
Docker Compose: A standalone stack is available for local testing and CI.
Multi-Cloud: A cloud-adapter abstraction layer is provided for object storage, compute, and secrets management, with implementations for Google Cloud, Azure, and VMware. Sample Terraform environments are available for AWS, Azure, and a vSphere relay.
Performance
Baseline: Engineered and load-tested for a baseline of approximately 1 million calls per day (~12 rps sustained, ~100 rps burst).
UI Performance: Dashboards are designed for sub-second load times via pre-computed aggregation tables.
Configuration Reference
The platform includes several configurable settings for resilience and data conversion.
Resilience Settings
Name
Type
Default
Required
Description
timeout
integer
100 ms
No
Per-operation timeout for backend requests.
retries
integer
2
No
Number of retries for a failed backend request, per-operation.
Conversion Options
The following conversion behaviors can be configured globally or overridden at the service, operation, or field level. The source does not specify types or default values for these options.
Name
Description
date/time formatting
Controls the format of date and time fields during conversion.
numeric handling
Defines how numeric types are handled.
boolean handling
Defines how boolean values are represented.
null handling
Controls the representation of null or empty values.
array collapsing
Governs whether single-element arrays are collapsed into objects.
whitespace
Defines whitespace handling rules.
binary encoding
Controls the encoding for binary data.
duration
Defines the format for duration types.
field-name casing
Controls the casing of field names in the generated JSON.
SOAP header propagation
Defines rules for propagating SOAP headers.
response envelope shape
Controls the structure of the JSON response envelope.
JSON field ordering
Governs the order of fields in the output JSON.
error/fault shape
Defines the structure of error responses, with support for RFC 7807.
xsi:type discriminator handling
Controls how xsi:type attributes are used for type discrimination.
upstream-failure status
Defines the HTTP status code to return for upstream failures.
required handling
Controls how required constraints are enforced.
request/response validation
Defines validation modes for incoming requests and outgoing responses.
Troubleshooting and Failure Modes
Payload Size Limit: Requests with synchronous payloads exceeding 30 MB will be rejected.
Backend Failures: The platform can be configured with per-operation timeout and retries to manage transient backend issues. It also supports failover to alternate backends based on backend health checks.
SOAP Faults: SOAP faults from a backend are normalized into a deterministic REST error structure defined by the error/fault shape conversion option.
License Expiration: If the license cannot be verified after a 14-day grace period, the platform enters a degraded, read-only mode where configuration changes are disabled. Traffic flow is not affected by telemetry outages.
Generic Ingest: The generic-HTTP receiver includes a dead-letter queue for traffic logs that cannot be parsed.
Known Limitations
The following capabilities are intentionally out of scope for the v1.0 release and are typically handled as bespoke engagements.
RPC/Encoded Messages: Only document/literal and rpc/literal SOAP message styles are supported. SOAP encoding (rpc/encoded) is not.
Inbound WS-Security: The platform does not handle WS-Security message signing or encryption on the inbound path (Consume mode). Outbound mTLS from the runtime to a REST backend is supported.
Non-HTTP Transports: Only HTTP/HTTPS transports are supported. Message queues, SFTP, and other transports are not.
Air-Gapped Operation: The platform requires outbound HTTPS connectivity to the Specaria platform for licensing. A fully air-gapped deployment is not supported in v1.0.
Native Cloud Ports: While sample Terraform is available for AWS and Azure, first-class native ports for these clouds are on the roadmap. v1.0 is primarily GCP-native.
Upgrading
This is the inaugural General Availability release. There is no prior GA version to upgrade from.
