Can I send a SOAP request without a WSDL?

Yes. Enter the SOAP endpoint, choose SOAP 1.1 or 1.2, paste or edit the XML envelope, and send it directly. A WSDL is optional and helps generate operations and sample envelopes.

Does Bug Days receive my SOAP payload or credentials?

No. Normal test requests go from your browser directly to the endpoint you specify. Basic-auth fields and custom HTTP headers stay in the current page. Sharing is a separate explicit action, and users should review request XML for embedded secrets before sharing.

Why does my SOAP request show a CORS error?

Browsers enforce the target server’s CORS policy. If the SOAP server does not permit browser requests, use the optional Holy CORS bridge on your own machine or a desktop client for authentication methods that browsers cannot expose.

SOAP API Client

WSDL-aware workspace

Explore a contract or send an envelope directly. Build SOAP 1.1/1.2 requests, control authentication and headers, and inspect the full response without installing a desktop client.

SOAP 1.1 + 1.2 No account Direct to endpoint

Payload privacy

Requests go to the endpoint you enter—not to Bug Days.

Credential handling

Basic-auth fields stay in this tab; review XML before sharing.

No saved history

Refresh or close the tab to clear the in-memory session.

Start a SOAP session

Use a contract for generated requests, or work directly in the editor below.

Browser blocked by CORS? Configure the optional local bridge

Use local Holy CORS

Manual

New SOAP request

Basic-auth fields and HTTP headers are excluded from share links

POST

Authentication, SOAPAction, and HTTP headers

SOAPAction HTTP authentication Additional HTTP headers (one per line)

Request

text/xml; charset=utf-8

Response

Response inspector

Status, elapsed time, payload size, body, and HTTP headers will appear here after you send.

An online SOAP client for focused request debugging

Contract-driven when available

Import WSDL from a URL, local file, or pasted XML. Browse operations and start from generated envelopes, endpoint addresses, namespaces, and SOAPAction values.

Manual when it isn’t

A WSDL is optional. Direct mode keeps the endpoint, version, headers, authentication, request XML, and response inspector in one working surface.

Honest browser constraints

Target servers must permit browser CORS requests. For mTLS, NTLM/Kerberos, client certificates, WS-Security automation, or private-network policy controls, use an approved desktop or internal enterprise client.

Request path: Browser → your SOAP endpoint. When enabled, the path is Browser → Holy CORS on your computer → your SOAP endpoint. Normal requests are not relayed through Bug Days infrastructure.

WSDL tester or direct SOAP request

Load a WSDL when you want service names, ports, operations, endpoint addresses, namespaces, SOAPAction values, and starter envelopes. Switch to direct mode when you already have the endpoint and XML body or when a contract URL is unavailable.

SOAP 1.1 versus SOAP 1.2

SOAP 1.1 commonly sends text/xml plus a separate SOAPAction header. SOAP 1.2 uses application/soap+xml and can carry the action as a content-type parameter. Choosing the matching version avoids many otherwise opaque HTTP 415 and action-routing failures.

Need a walkthrough? Read how to test a SOAP API from WSDL and choose SOAP 1.1 or 1.2, then use the SOAP authentication guide to distinguish Basic auth, WS-Security, and mTLS. Useful companions include the X.509 certificate decoder, XML formatter, and CSV bulk API runner.