---
sourceDocument: Xanadu API Reference
sourceDocumentLink: https://servicenow-prod.fluidtopics.net/r/xanadu/api-reference

 Release :

    - xanadu

ft:locale :

    - en-US

ft:publication_title :

    - Xanadu API Reference

ft:clusterId :

    - crapiref

bundleId :

    - crapiref

workflow :

    - Creator


---

# Configure SOAP security

# Configure SOAP security {#ariaid-title1}

* Release version: Xanadu
* 
* Updated August 1, 2024
* 
* ![](https://www.servicenow.com/docs/portal-asset/ico-clock) 1 minute to read

Administrators can configure web service security for inbound SOAP requests made to
the ServiceNow instance.

## Before you begin

Role required: admin

## About this task

You can also set up web service security to use different certificates for different
web service clients. By enabling web service security, you can prevent
man-in-the-middle attacks.  
Note:  
After you configure a WS-security profile or a security policy, validation is performed on all incoming SOAP requests, including from the MID Server or ODBC driver. Disable validation for these types of requests by [marking the service accounts as internal integration users](https://servicenow-prod.fluidtopics.net/AT3IAwVE8KZx4aobQHOZkA "Allow internal integration communications to bypass the WSS authentication requirement by marking their user accounts as internal integration users.").

## Procedure

1. [Upload a certificate to an instance](https://www.servicenow.com/docs/access?context=t_UploadACertificateToAnInstance&version=xanadu&pubname=xanadu-platform-security&ft:locale=en-US).
2. [Create a WS-security profile](https://servicenow-prod.fluidtopics.net/85Y3~dBztWlbzl5ag3Qo2g "Create a new WS Security profile to define how to authenticate a web services message when WS-Security is enabled.").
3. [Create
   a security policy](https://servicenow-prod.fluidtopics.net/~n~W62mFcpqP5_rFoHwvWw "Administrators can specify which security profiles WS-Security communications must meet by creating a new security policy.").  
   Security policies define which WS-security profiles are used to evaluate a particular web service request. If no policy is defined, all WS-security profiles are used to evaluate all requests.
4. Set the value of the property `glide.soap.default_security_policy` to the name of the new security policy.