Do you think there's any of these still in use?
Working on a product in an adjacent space, we translated WS-Security-protected SOAP interactions to OAuth JSON request/responses. The responses had omitted information based on the authorizations given in the OAuth access token scope.
In some cases you would have to replace the XML gateway with an alternative system, for instance when it is combining information from multiple sources which aren't allowed access to one another (say, for PII separation/auditing reasons).
I actually came across this wiki page when searching for the backstory behind JSONx, IBM's standard for representing JSON as XML.[^1]
[1]: https://www.ibm.com/docs/en/datapower-gateway/7.6?topic=json...