By Oscar Rodriguez, Veracode Senior Principal Solutions Architect 

Veracode has been asked constantly to be able to scan SOAP APIs as part of the scope of DAST solution. While the ability to scan web applications and REST APIs is well known today, there is a way to scan SOAP APIs with current Veracode DAST capabilities. 

After some executed tests, we found a way to scan SOAP APIs by “translating“ the WSDL specification into a well-formed Veracode DAST supported specification (Postman Collection, OpenAPI, etc.); for that purpose our engineering team was investigating some tools for doing that conversion, and found the following tools (these are tools created and maintained by third-parties, so Veracode does not have responsibility on maintenance them): 

• GitHub - wso2/soap-to-rest: Library capable of converting SOAP backend service to REST backends  
• GitHub - anhthang/soap-converter: Instantly convert SOAP/WSDL definitions to REST API specifications for use with Postman, OpenAPI/Swagger, and other API development tools.  

Recently we got involved in a technical challenge in which we were required to run DAST on a SOAP API, and looking for other options to get the well-formed API specification, we found out that using IA (Copilot for example) we could have a pretty easy way to convert WSDL spec into an OpenAPI spec supported by Veracode, so we could use that generated spec uploading it into scan configuration to run the scan and having as a result the execution of DAST for that SOAP API. 

If you need to run a DAST scan on a SOAP API, you could follow any of these methods to get your well-formed API spec supported by Veracode and get your scan running.