SOAP
A great deal of enterprise and government infrastructure still speaks SOAP, and an assistant that cannot work with it cannot reach some of the most valuable systems in the Kingdom.
A great deal of enterprise and government infrastructure still speaks SOAP, and an assistant that cannot work with it cannot reach some of the most valuable systems in the Kingdom.
What a SOAP service exposes, and why that matters here
SOAP predates REST and remains widespread in banking, government, telecom and large enterprise — precisely the systems that hold the most valuable operational data and are least likely to be replaced soon.
Support for it is a practical requirement rather than a preference. An assistant that only speaks modern interfaces is unable to connect to a large share of the systems that actually run large organisations here.
- Defined operations — the specific services exposed, formally described.
- Structured messages — strictly typed request and response formats.
- Service contracts — formal descriptions of what each operation does.
- Authentication — the credential mechanism the service expects.
- Fault handling — the defined error responses.
Questions Elbi can answer through a SOAP service
What is the status of this?
A record retrieved through a defined service operation.
Does this reference exist?
Validation against the authoritative system.
What are the details?
Structured data turned into a plain-language answer.
Has this been processed?
State from a system that may have no other interface.
What is the current value?
A live figure rather than a cached one.
Submit this
Where a write operation is deliberately enabled.
How Elbi works with a SOAP service
- The WSDL is the starting pointA SOAP service publishes a WSDL: a formal contract listing its operations, the XML messages each accepts and returns, and the type of every field. The connection is built from that contract, so there is no guessing about what an operation expects.
- A named subset of operationsServices often expose many operations. Elbi is given a short, named subset, typically enquiries such as retrieving an account's status or a case by reference, and nothing else in the WSDL is ever called.
- The security the service already expectsSOAP services commonly sit behind mutual TLS, WS-Security headers such as a username token or a message signed with a client certificate, an IP allowlist, or a combination of these. The connection uses whatever your service requires, with certificates and credentials issued by your team.
- Strict messages, checked both waysRequests are built to match the contract's schema, so a malformed reference is caught before it reaches the service. Responses are read by element name rather than position, which keeps the mapping stable when optional elements appear.
- Faults become plain answersSOAP reports errors as faults with a code and a reason. A "record not found" fault becomes "there is no account with that number"; an authentication or server fault becomes "I can't reach that system right now", with a handover to a person.
- Local formats handled in the mappingOlder systems in the Kingdom can carry Hijri dates, separate Arabic and English name fields, and status codes whose meaning lives in a manual. The mapping turns them into sentences a customer or employee understands.
SOAP operations, WS-Security and what stays yours
| Direction of access | Enquiry operations only by default. Operations that submit or change something are listed separately, enabled deliberately and able to wait for a person's confirmation. |
|---|---|
| Who can see what | The service account's rights in the back-end system set the ceiling. Where an operation accepts a customer or user identifier, the asker's verified identity is what gets passed, so the system returns only their records. |
| Credentials | Client certificates, WS-Security credentials and any service account are issued by your team, often through the same process as other integrations on your service bus. Revoking the certificate or disabling the account ends the connection. |
| Where data goes | Responses are read at the moment of the question and reduced to the fields an answer needs; nothing is copied into a second store. Conversation content is destroyed within 24 hours, and no external AI service receives any of it. |
| Audit | Each call is logged with the operation name, the outcome or fault code, the conversation and the agent, alongside whatever your service bus or gateway already records. |
| If it is unavailable | Long-lived systems have maintenance and batch windows. When the service is down or slow, Elbi says so and offers a person, and never presents a remembered value as current. |
What this replaces
The strength of SOAP in this context is that it is formally described. Operations are explicitly defined with strict types, which means the scope of a connection is unusually clear — there is a contract describing precisely what each operation does.
That makes the governance conversation easier than with more flexible interfaces. What the assistant may call is a finite, documented list rather than a matter of configuration discipline.
The practical reality is that these systems are frequently the ones holding the answers people most want: core banking, government registries, telecom provisioning. Reaching them is worth more than the interface being unfashionable.
Where SOAP connections matter most
Banking
Core systems that predate modern interfaces.
Government
Registries and national services.
Telecom
Provisioning and billing infrastructure.
Large enterprise
Established systems with no replacement planned.
Getting value from a SOAP service
The value of a SOAP connection is usually concentrated in a few enquiry operations that front-line staff already use through an internal screen: account status, case status, certificate validity, balance. Those are the questions customers call about, and the operation that answers them already exists.
Ask the team that owns the service which operations those internal screens call. That list is usually shorter and better tested than the full WSDL, and it avoids operations nobody has exercised in years.
Respect the system's capacity. Older back ends were sized for staff traffic, not for every customer question at once, so the first launch should stay within the operations and volumes the service owner is comfortable with, measured in testing first.
What connecting a SOAP service involves
- Obtain the WSDL and a test endpointYour team provides the service contract and access to a test or staging endpoint. Without one, every trial runs against production, which few owners of core systems will accept.
- Choose the operationsFrom real contact, pick the enquiry operations that answer the most common questions and write them down with the fields used. That document is the scope.
- Arrange network access and securityCertificates, WS-Security credentials, allowlisted addresses and any route through your service bus or gateway are set up by your team, following your usual integration process.
- Map fields, codes and formatsStatus codes, Hijri and Gregorian dates, Arabic and English name fields and any legacy text encoding are mapped to plain sentences in both languages.
- Test faults and capacityUnknown references, an expired certificate, schema validation faults, the service in a maintenance window, and requests at the volume you expect. Each should give a predictable answer, at a load the service owner is comfortable with.
- Launch narrow, then widenGo live on one or two enquiry operations, read a month of real traffic with the service owner, then add more.
Personal data in core-system responses
SOAP services in banking, government and telecom tend to return whole records: national ID, date of birth, address, account details, often far more than any single question needs. Under the Saudi Personal Data Protection Law, and any sector rules your regulator applies, what matters is what the assistant actually processes, so the field mapping is where privacy is decided.
Map only the fields an answer needs and discard the rest on receipt. If the service owner can offer a narrower enquiry operation, prefer it. The conversation in which the answer is given is destroyed within 24 hours.
What organisations typically see
SOAP, REST facades and the other routes in
A common modernisation pattern is to put a REST facade in front of a SOAP service, through an API gateway or an enterprise service bus. Where your organisation already has one, connecting to the facade is usually simpler and keeps authentication and logging where your team already manages them. Where it does not, connecting to the SOAP service directly is entirely workable and avoids a project nobody asked for.
Other routes exist, at a cost. Reading the back-end database directly bypasses the business rules the service enforces. Automating the staff screen, as robotic process automation tools do, breaks whenever the screen changes. For a system that already publishes a WSDL, the contract is usually the most stable way in.
The mistake to avoid is treating the whole WSDL as the scope because it arrived as one file. The contract describes what is possible; the scope is what was agreed.
Common questions
In the systems that matter most here, yes. Core banking, government registries and telecom infrastructure frequently speak it and are not being replaced soon.
Different rather than harder. Formal service descriptions actually make the scope of a connection clearer than more flexible interfaces do.
No. A named subset agreed at deployment, as with any connection.
Only the SOAP operations agreed at deployment are called, using certificates and credentials your team issues. Revoking the certificate or disabling the service account ends the connection, without going through us.
It happens, particularly with long-lived systems. The contract is checked against real responses from the test endpoint, and any gaps are documented in the mapping rather than guessed at.
Where you list a submit operation, and optionally only after a person confirms. For core banking or government systems, starting with enquiries alone is the sensible default.
Connect Elbi to your SOAP services
Enquiry operations on the systems that hold the answers, in Arabic and English.