---
sourceDocument: Australia API Reference
sourceDocumentLink: https://servicenow-prod.fluidtopics.net/r/api-reference

 Release :

    - australia

ft:locale :

    - en-US

ft:publication_title :

    - Australia API Reference

ft:clusterId :

    - crapiref

bundleId :

    - crapiref

workflow :

    - Creator


---

# Configure secutiry

# Configure SOAP security {#ariaid-title1}

Release version: Australia  
Updated March 12, 2026  
![](https://www.servicenow.com/docs/portal-asset/ico-clock) 1 minute to read  
Administrators can configure web service security for inbound SOAP requests made to
the ServiceNow instance.

## Before you begin

Role required: admin

## About this task

You can also set up web service security to use different certificates for different
web service clients. By enabling web service security, you can prevent
man-in-the-middle attacks.  
Note:  
After you configure a WS-security profile or a security policy, validation is performed on all incoming SOAP requests, including from the MID Server or ODBC driver. Disable validation for these types of requests by [marking the service accounts as internal integration users](https://servicenow-prod.fluidtopics.net/tO5fcsVHQkyVsOLjv3Z6rg "Allow internal integration communications to bypass the WSS authentication requirement by marking their user accounts as internal integration users.").

## Procedure

1. [Upload a certificate to an instance](https://www.servicenow.com/docs/access?context=t_UploadACertificateToAnInstance&version=australia&pubname=australia-platform-security&ft:locale=en-US).
2. [Create a WS-security profile](https://servicenow-prod.fluidtopics.net/IY8NeJliU8oQgXL4QJu4og "Create a new WS Security profile to define how to authenticate a web services message when WS-Security is enabled.").
3. [Create
   a security policy](https://servicenow-prod.fluidtopics.net/0C_QYONoUy~w1CtHPzgDRg "Administrators can specify which security profiles WS-Security communications must meet by creating a new security policy.").  
   Security policies define which WS-security profiles are used to evaluate a particular web service request. If no policy is defined, all WS-security profiles are used to evaluate all requests.
4. Set the value of the property `glide.soap.default_security_policy` to the name of the new security policy.