For a BPM / BAW developer the differences that matter in practice:
| SOAP | REST |
|---|
| Contract | WSDL + XSD, strict typing, versioned operations | Swagger / OpenAPI (optional), JSON resources, HTTP verbs |
| Transport | HTTP (also JMS); envelope, headers (WS-Security, WS-Addressing) | HTTP only; verbs GET/POST/PUT/DELETE, status codes, headers |
| Security | WS-Security (signatures, encryption, tokens), policy sets in WebSphere | TLS + HTTP auth (basic, bearer / OAuth 2, API keys); CSRF tokens for browser calls |
| Payload | XML, larger, schema validated | JSON (usually), lighter, validated by the application |
| Tooling in BAW | Web service integration (import WSDL → business objects), Web Service exposure of services | REST external service (import Swagger), BPMRESTRequest, BAW's own REST APIs; coaches call REST directly |
| Typical use | Legacy enterprise back ends, ESB (IIB), transactions with WS-AT | Modern APIs, mobile / SPA clients, microservices, cloud services |
Example of the same call:
SOAP: POST /CustomerService Content-Type: text/xml
<soapenv:Envelope><soapenv:Body><cus:getCustomer><id>42</id></cus:getCustomer></soapenv:Body></soapenv:Envelope>
REST: GET /customers/42 Accept: application/json Authorization: Bearer ...
{ "id": 42, "name": "Ana Perez" }In BAW both are integration services in a service flow; choose SOAP when the provider offers WSDL and needs WS-Security, REST for everything else. BAW's own APIs are REST (classic /rest/bpm/wle/v1, v2 /bpm, Operations /ops).
References