---
title: "SOAP API Configuration"
description: "Utilize a SOAP WSDL definition to accelerate HawkScan"
url: https://docs.stackhawk.com/hawkscan/configuration/soap-configuration/
---

# SOAP API Configuration

The [SOAP Protocol](https://www.w3schools.com/XML/xml_soap.asp) was designed to use XML-envelope style requests, schema definitions and published WSDL endpoints in order to describe the behaviors of an API. When provided a schema, either by published endpoint or definition file, HawkScan will generate SOAP-specific payloads while scanning.

Some key points to note about scanning a SOAP endpoint:

- SOAP APIs respond to specific XML payloads at a predefined endpoint
- The SOAP [WSDL](https://en.wikipedia.org/wiki/Web_Services_Description_Language) provides definitions for valid actions and responses available in the API
- Fuzzing a SOAP endpoint for functional behavior is challenging due to the structure of requests
- Standard scans typically rely on spidering, path enumeration, or brute forcing to illuminate routes
- The schema definition file can also be provided to HawkScan as an alternative to the WSDL endpoint (.xsd)

### Example SOAP API WSDL

The WSDL should be published to an available endpoint in the app (e.g. `http://example.com/ws/features.wsdl`). The SOAP schema definition file (.xsd) can also be provided.

A simple example showing the structure of a SOAP schema definition:

```xml
<wsdl:definitions xmlns:wsdl="http://schemas.xmlsoap.org/wsdl/"> 

<xs:schema xmlns:xs="http://www.w3.org/2001/XMLSchema" xmlns:tns="https://www.example.com/xml/school"
           targetNamespace="https://www.example.com/xml/school" elementFormDefault="qualified">

    <xs:element name="StudentDetailsRequest">
        <xs:complexType>
            <xs:sequence>
                <xs:element name="name" type="xs:string"/>
            </xs:sequence>
        </xs:complexType>
    </xs:element>

    <xs:element name="StudentDetailsResponse">
        <xs:complexType>
            <xs:sequence>
                <xs:element name="Student" type="tns:Student"/>
            </xs:sequence>
        </xs:complexType>
    </xs:element>

    <xs:complexType name="Student">
        <xs:sequence>
            <xs:element name="name" type="xs:string"/>
            <xs:element name="standard" type="xs:int"/>
            <xs:element name="address" type="xs:string"/>
        </xs:sequence>
    </xs:complexType>

</xs:schema>

</wsdl:definitions>
```

## Using a SOAP API Spec File in HawkScan

Configure in HawkScan using the following `stackhawk.yml` parameters:

```yaml
# in the "app" config...
app:
  # specify the relative path to an SOAP API WSDL
  # prefix the path with / to pull from the target host
  soapConf:
    path: /ws/features.wsdl # OR... 
    filePath: features.xsd
```