I have a SOAP service that I'd like to expose. I have policy wrapped around it to enforce the use use of API Keys; however, I see that the WSDL is still accessible. Is there a way for me to require an API Key for it as well?
WSDL download service is configured on listen ports' properties.
You may try disable the WSDL download service, and manually publish the WSDL with requirement of the API Key.