Absolutely. Putting an intelligent intermediary in front of an API is an age-old pattern, and moving that logic into the backing system itself may have its own logistical challenges.

Working on a product in an adjacent space, we translated WS-Security-protected SOAP interactions to OAuth JSON request/responses. The responses had omitted information based on the authorizations given in the OAuth access token scope.

In some cases you would have to replace the XML gateway with an alternative system, for instance when it is combining information from multiple sources which aren't allowed access to one another (say, for PII separation/auditing reasons).