XML and SOAP in TR-069

TR-069 uses the extensible markup language in three different ways:

  • To define the syntax of its message calls and responses, message ID, and faults
  • To define its remote procedure calls and their arguments and
  • To define the data model of CWMP endpoint objects

While XML is used most often to define and describe information, TR-069 also uses it directly over the wire when transmitting messages. This means that the ACS and CPE pass XML documents back and forth over HTTP during a TR-069 session.

How a particular XML document is structured is defined in an XML schema. In TR-069, there exist several schemas - one for the basic protocol and RPCs, one that describes how TR-069 data models are to be constructed, one that describes how device type documents are to be constructed, and several more that were defined for extensions such as IPDR for bulk data upload, XMPP connection requests, and more. XML schemas, like computer languages, can inherit using a “namespace”.

TR-069 uses the Simple Object Access Protocol as an intermediary for packaging its remote procedure calls, message ID argument, and providing a mechanism for faults. SOAP is defined in XML by the W3 Consortium.

Let’s look at the basic structure of a CWMP message over SOAP.


First is the SOAP envelope. Within it are attributes that explain which namespaces will be used by the elements within it. The string after the colon in the listing states how it will be referred to later. First, the envelope has a reference to the SOAP envelope and SOAP encoding namespaces, referred to by SOAP-ENV and SOAP-ENC prefixes, respectively. Next, the base XML schemas from W3C are referenced with the xsi and xsd prefixes. Lastly, the namespace for cwmp itself is listed using the official broadband forum namespace - when TR-069 was created, this was still the dsl forum, so the namespace has stuck for now. 

The SOAP header, in CWMP, is used mostly for the message ID element. This is pulled from the cwmp namespace and is used to coordinate calls and responses.

The SOAP Body then contains the remote procedure call or response sent by the ACS or CPE, and the arguments that are expected. For example, the SetParameterValues RPC takes an array defined in the cwmp namespace as “ParameterValueStruct”. It consists of an element called “ParameterList” that contains an array of Name/Value pairs, and an element called “ParameterKey” that is used by the ACS as helpful metadata for its requests.

Lastly, SOAP defines its own structure for fault handling, which TR-069 uses. TR-069 ACS faults use the 8000 series, and CPE faults are in the 9000 series. Faults are defined in the CWMP xml schema and listed in section A.5 of TR-069.

That’s the basics of TR-069 XML. You can find all of the xml schemas and documents related to TR-069 on the Broadband Forum website at


Building or deploying TR-069?

Develop your solution even faster with the industry standard in automated, expert testing.

Learn more