1. The server authenticates the client.

2. If a session already exists for the client, the server uses the existing session. If one does not exist, the server creates a session.

3. The server determines the content-type of the service request so it can prepare data for the requested service.

4. The server uses the supplied service name to look up the service.

5. The server determines whether access to the requested service is being controlled based on the port on which the request came in. If there is no restriction, the server continues with the execution of the service.

6. The server checks whether the requested HTTP method is allowed for the service. If it is not, the server sends an back an error message, else the server continues with the execution of the service.

7. The server looks up the Access Control List (ACL) for the service and determines whether the client is to be granted access to the service. If the ACL indicates that the client is allowed to access the service, the server continues with the execution of the service.

8. If auditing is enabled, the server adds an entry to the Audit Log to mark the start of the request.

9. The server starts gathering service statistics for the service.

10. The server checks to see if the results for this service are in the service-results cache. If service results are cached and the inputs for the cached results match the inputs for this request, the server returns the cached results. If matching results are not cached, the server invokes the service. If the service is a flow service, which can consist of several services, it invokes each service in the flow.

11. The server ends the gathering of server statistics for the service.

12. If auditing is enabled, the server adds an entry to the Audit Log to mark the end of the request.

13. The server encodes the service results as specified by the content type.

14. The server returns the results to the client.