Currently an API can be of type "SOAP", but in reality we don't do any additional handling for soap apis vs. rest apis. However, when an api is soap, we should process the start of the soap envelope and make the following information available to policies:

• the soap encoding type
• the soap action
• all of the soap headers

In addition, policies should be able to not only access the soap headers but also modify them.