diff --git a/README.md b/README.md
index 17424dd..2ba40d2 100644
--- a/README.md
+++ b/README.md
@@ -85,9 +85,9 @@ The SOAP client module introduces a robust framework for configuring security me
 
 There are two primary security configurations available for SOAP clients:
 
-- `inboundSecurity`: This configuration is applied to the SOAP envelope when a request is made. It includes various ws security policies such as Username Token, Timestamp Token, X509 Token, Symmetric Binding, Asymmetric Binding, and Transport Binding, either individually or in combination with each other.
+- `outboundSecurity`: This configuration is applied to the SOAP envelope when a request is made. It includes various ws security policies such as Username Token, Timestamp Token, X509 Token, Symmetric Binding, Asymmetric Binding, and Transport Binding, either individually or in combination with each other.
 
-- `outboundSecurity`: This configuration is applied to the SOAP envelope when a response is received. Its purpose is to decrypt the data within the envelope and verify the digital signature for security validation.
+- `inboundSecurity`: This configuration is applied to the SOAP envelope when a response is received. Its purpose is to decrypt the data within the envelope and verify the digital signature for security validation.
 
 ### Policies
 
@@ -133,7 +133,7 @@ These policies empower SOAP clients to enhance the security of their web service
 
 #### Outbound Security Configurations
 
-- `OutboundSecurityConfig`: Represents the record for outbound security configurations to verify and decrypt SOAP envelopes.
+- `InboundSecurityConfig`: Represents the record for outbound security configurations to verify and decrypt SOAP envelopes.
   - Fields:
     - `crypto:PublicKey` verificationKey : The public key to verify the signature of the SOAP envelope
     - `crypto:PrivateKey`|`crypto:PublicKey` decryptionKey : The private key to decrypt the SOAP envelope
@@ -153,7 +153,7 @@ import ballerina/soap.soap11;
 public function main() returns error? {
     soap11:Client soapClient = check new ("https://www.secured-soap-endpoint.com", 
         {
-            inboundSecurity: [
+            outboundSecurity: [
             {
                 username: "username",
                 password: "password",
@@ -190,13 +190,13 @@ public function main() returns error? {
 
     soap12:Client soapClient = check new ("https://www.secured-soap-endpoint.com",
     {
-        inboundSecurity: {
+        outboundSecurity: {
                 signatureAlgorithm: soap:RSA_SHA256,
                 encryptionAlgorithm: soap:RSA_ECB,
                 signatureKey: clientPrivateKey,
                 encryptionKey: serverPublicKey,
         },
-        outboundSecurity: {
+        inboundSecurity: {
                 verificationKey: serverPublicKey,
                 signatureAlgorithm: soap:RSA_SHA256,
                 decryptionKey: clientPrivateKey,
diff --git a/ballerina/Module.md b/ballerina/Module.md
index f7aa647..4c5718a 100644
--- a/ballerina/Module.md
+++ b/ballerina/Module.md
@@ -77,9 +77,9 @@ The SOAP client module introduces a robust framework for configuring security me
 
 There are two primary security configurations available for SOAP clients:
 
-- `inboundSecurity`: This configuration is applied to the SOAP envelope when a request is made. It includes various ws security policies such as Username Token, Timestamp Token, X509 Token, Symmetric Binding, Asymmetric Binding, and Transport Binding, either individually or in combination with each other.
+- `outboundSecurity`: This configuration is applied to the SOAP envelope when a request is made. It includes various ws security policies such as Username Token, Timestamp Token, X509 Token, Symmetric Binding, Asymmetric Binding, and Transport Binding, either individually or in combination with each other.
 
-- `outboundSecurity`: This configuration is applied to the SOAP envelope when a response is received. Its purpose is to decrypt the data within the envelope and verify the digital signature for security validation.
+- `inboundSecurity`: This configuration is applied to the SOAP envelope when a response is received. Its purpose is to decrypt the data within the envelope and verify the digital signature for security validation.
 
 ### Policies
 
@@ -125,7 +125,7 @@ These policies empower SOAP clients to enhance the security of their web service
 
 #### Outbound Security Configurations
 
-- `OutboundSecurityConfig`: Represents the record for outbound security configurations to verify and decrypt SOAP envelopes.
+- `InboundSecurityConfig`: Represents the record for outbound security configurations to verify and decrypt SOAP envelopes.
   - Fields:
     - `crypto:PublicKey` verificationKey : The public key to verify the signature of the SOAP envelope
     - `crypto:PrivateKey`|`crypto:PublicKey` decryptionKey : The private key to decrypt the SOAP envelope
@@ -145,7 +145,7 @@ import ballerina/soap.soap11;
 public function main() returns error? {
     soap11:Client soapClient = check new ("https://www.secured-soap-endpoint.com", 
         {
-            inboundSecurity: [
+            outboundSecurity: [
             {
                 username: "username",
                 password: "password",
@@ -182,13 +182,13 @@ public function main() returns error? {
 
     soap12:Client soapClient = check new ("https://www.secured-soap-endpoint.com",
     {
-        inboundSecurity: {
+        outboundSecurity: {
                 signatureAlgorithm: soap:RSA_SHA256,
                 encryptionAlgorithm: soap:RSA_ECB,
                 signatureKey: clientPrivateKey,
                 encryptionKey: serverPublicKey,
         },
-        outboundSecurity: {
+        inboundSecurity: {
                 verificationKey: serverPublicKey,
                 signatureAlgorithm: soap:RSA_SHA256,
                 decryptionKey: clientPrivateKey,
diff --git a/ballerina/Package.md b/ballerina/Package.md
index 9b4ce35..d9959ae 100644
--- a/ballerina/Package.md
+++ b/ballerina/Package.md
@@ -77,9 +77,9 @@ The SOAP client module introduces a robust framework for configuring security me
 
 There are two primary security configurations available for SOAP clients:
 
-- `inboundSecurity`: This configuration is applied to the SOAP envelope when a request is made. It includes various ws security policies such as Username Token, Timestamp Token, X509 Token, Symmetric Binding, Asymmetric Binding, and Transport Binding, either individually or in combination with each other.
+- `outboundSecurity`: This configuration is applied to the SOAP envelope when a request is made. It includes various ws security policies such as Username Token, Timestamp Token, X509 Token, Symmetric Binding, Asymmetric Binding, and Transport Binding, either individually or in combination with each other.
 
-- `outboundSecurity`: This configuration is applied to the SOAP envelope when a response is received. Its purpose is to decrypt the data within the envelope and verify the digital signature for security validation.
+- `inboundSecurity`: This configuration is applied to the SOAP envelope when a response is received. Its purpose is to decrypt the data within the envelope and verify the digital signature for security validation.
 
 ### Policies
 
@@ -125,7 +125,7 @@ These policies empower SOAP clients to enhance the security of their web service
 
 #### Outbound Security Configurations
 
-- `OutboundSecurityConfig`: Represents the record for outbound security configurations to verify and decrypt SOAP envelopes.
+- `InboundSecurityConfig`: Represents the record for outbound security configurations to verify and decrypt SOAP envelopes.
   - Fields:
     - `crypto:PublicKey` verificationKey : The public key to verify the signature of the SOAP envelope
     - `crypto:PrivateKey`|`crypto:PublicKey` decryptionKey : The private key to decrypt the SOAP envelope
@@ -145,7 +145,7 @@ import ballerina/soap.soap11;
 public function main() returns error? {
     soap11:Client soapClient = check new ("https://www.secured-soap-endpoint.com", 
         {
-            inboundSecurity: [
+            outboundSecurity: [
             {
                 username: "username",
                 password: "password",
@@ -182,13 +182,13 @@ public function main() returns error? {
 
     soap12:Client soapClient = check new ("https://www.secured-soap-endpoint.com",
     {
-        inboundSecurity: {
+        outboundSecurity: {
                 signatureAlgorithm: soap:RSA_SHA256,
                 encryptionAlgorithm: soap:RSA_ECB,
                 signatureKey: clientPrivateKey,
                 encryptionKey: serverPublicKey,
         },
-        outboundSecurity: {
+        inboundSecurity: {
                 verificationKey: serverPublicKey,
                 signatureAlgorithm: soap:RSA_SHA256,
                 decryptionKey: clientPrivateKey,
diff --git a/ballerina/configs.bal b/ballerina/configs.bal
index 85d067e..8242714 100644
--- a/ballerina/configs.bal
+++ b/ballerina/configs.bal
@@ -19,10 +19,10 @@ import ballerina/http;
 # SOAP client configurations.
 #
 # + httpConfig - HTTP Configuration
-# + inboundSecurity - Web service security configurations for SOAP requests
-# + outboundSecurity - Web service security configurations to decrypt and verify SOAP responses
+# + outboundSecurity - Web service security configurations for SOAP requests
+# + inboundSecurity - Web service security configurations to decrypt and verify SOAP responses
 public type ClientConfig record {|
     http:ClientConfiguration httpConfig = {};
-    InboundSecurityConfig|InboundSecurityConfig[] inboundSecurity = NO_POLICY;
-    OutboundSecurityConfig outboundSecurity = {};
+    OutboundSecurityConfig|OutboundSecurityConfig[] outboundSecurity = NO_POLICY;
+    InboundSecurityConfig inboundSecurity = {};
 |};
diff --git a/ballerina/modules/soap11/Module.md b/ballerina/modules/soap11/Module.md
index 6d34c9f..4c0a972 100644
--- a/ballerina/modules/soap11/Module.md
+++ b/ballerina/modules/soap11/Module.md
@@ -69,9 +69,9 @@ The SOAP client module introduces a robust framework for configuring security me
 
 There are two primary security configurations available for SOAP clients:
 
-- `inboundSecurity`: This configuration is applied to the SOAP envelope when a request is made. It includes various ws security policies such as Username Token, Timestamp Token, X509 Token, Symmetric Binding, Asymmetric Binding, and Transport Binding, either individually or in combination with each other.
+- `outboundSecurity`: This configuration is applied to the SOAP envelope when a request is made. It includes various ws security policies such as Username Token, Timestamp Token, X509 Token, Symmetric Binding, Asymmetric Binding, and Transport Binding, either individually or in combination with each other.
 
-- `outboundSecurity`: This configuration is applied to the SOAP envelope when a response is received. Its purpose is to decrypt the data within the envelope and verify the digital signature for security validation.
+- `inboundSecurity`: This configuration is applied to the SOAP envelope when a response is received. Its purpose is to decrypt the data within the envelope and verify the digital signature for security validation.
 
 ### Policies
 
@@ -117,7 +117,7 @@ These policies empower SOAP clients to enhance the security of their web service
 
 #### Outbound Security Configurations
 
-- `OutboundSecurityConfig`: Represents the record for outbound security configurations to verify and decrypt SOAP envelopes.
+- `InboundSecurityConfig`: Represents the record for outbound security configurations to verify and decrypt SOAP envelopes.
   - Fields:
     - `crypto:PublicKey` verificationKey : The public key to verify the signature of the SOAP envelope
     - `crypto:PrivateKey`|`crypto:PublicKey` decryptionKey : The private key to decrypt the SOAP envelope
@@ -141,13 +141,13 @@ public function main() returns error? {
 
     soap11:Client soapClient = check new ("http://www.secured-soap-endpoint.com",
     {
-        inboundSecurity: {
+        outboundSecurity: {
                 signatureAlgorithm: soap:RSA_SHA256,
                 encryptionAlgorithm: soap:RSA_ECB,
                 signatureKey: clientPrivateKey,
                 encryptionKey: serverPublicKey,
         },
-        outboundSecurity: {
+        inboundSecurity: {
                 verificationKey: serverPublicKey,
                 signatureAlgorithm: soap:RSA_SHA256,
                 decryptionKey: clientPrivateKey,
diff --git a/ballerina/modules/soap11/soap11.bal b/ballerina/modules/soap11/soap11.bal
index f6f5979..c33e59a 100644
--- a/ballerina/modules/soap11/soap11.bal
+++ b/ballerina/modules/soap11/soap11.bal
@@ -23,8 +23,8 @@ import ballerina/jballerina.java;
 # Object for the basic SOAP 1.1 client endpoint.
 public isolated client class Client {
     private final http:Client soapClient;
-    private final readonly & soap:InboundSecurityConfig|soap:InboundSecurityConfig[] inboundSecurity;
-    private final readonly & soap:OutboundSecurityConfig outboundSecurity;
+    private final readonly & soap:OutboundSecurityConfig|soap:OutboundSecurityConfig[] outboundSecurity;
+    private final readonly & soap:InboundSecurityConfig inboundSecurity;
 
     # Gets invoked during object initialization.
     #
@@ -36,8 +36,8 @@ public isolated client class Client {
             check soap:validateTransportBindingPolicy(config);
             self.soapClient = check new (url, config.httpConfig);
             readonly & soap:ClientConfig readonlyConfig = soap:getReadOnlyClientConfig(config);
-            self.inboundSecurity = readonlyConfig.inboundSecurity;
             self.outboundSecurity = readonlyConfig.outboundSecurity;
+            self.inboundSecurity = readonlyConfig.inboundSecurity;
         } on fail var err {
             return error Error(SOAP_CLIENT_ERROR, err);
         }
@@ -71,7 +71,7 @@ public isolated client class Client {
             xml mimeEntity = body is xml ? body : check body[0].getXml();
             lock {
                 xml envelope = body is xml ? body.clone() : mimeEntity.clone();
-                securedBody = check soap:applySecurityPolicies(self.inboundSecurity.clone(), envelope.clone(), false);
+                securedBody = check soap:applySecurityPolicies(self.outboundSecurity.clone(), envelope.clone(), false);
             }
             xml|mime:Entity[] response;
             if body is mime:Entity[] {
@@ -81,13 +81,13 @@ public isolated client class Client {
                 response = check soap:sendReceive(securedBody, self.soapClient, action, headers, path, false);
             }
             lock {
-                soap:OutboundSecurityConfig? outboundSecurity = self.outboundSecurity.clone();
+                soap:InboundSecurityConfig? inboundSecurity = self.inboundSecurity.clone();
                 do {
-                    if outboundSecurity is soap:OutboundSecurityConfig && outboundSecurity != {} {
+                    if inboundSecurity is soap:InboundSecurityConfig && inboundSecurity != {} {
                         if response is xml {
-                            return check soap:applyOutboundConfig(outboundSecurity.clone(), response.clone(), false);
+                            return check soap:applyOutboundConfig(inboundSecurity.clone(), response.clone(), false);
                         } else {
-                            return check soap:applyOutboundConfig(outboundSecurity.clone(), 
+                            return check soap:applyOutboundConfig(inboundSecurity.clone(), 
                                                                   check response[0].getXml().clone(), false);
                         }
                     }
@@ -119,7 +119,7 @@ public isolated client class Client {
             xml mimeEntity = body is xml ? body : check body[0].getXml();
             lock {
                 xml envelope = body is xml ? body.clone() : mimeEntity.clone();
-                securedBody = check soap:applySecurityPolicies(self.inboundSecurity.clone(), envelope.clone(), false);
+                securedBody = check soap:applySecurityPolicies(self.outboundSecurity.clone(), envelope.clone(), false);
             }
             return check soap:sendOnly(securedBody, self.soapClient, action, headers, path, false);
         } on fail error soapError {
diff --git a/ballerina/modules/soap11/tests/soap11_client_test.bal b/ballerina/modules/soap11/tests/soap11_client_test.bal
index 2bbe88d..979a908 100644
--- a/ballerina/modules/soap11/tests/soap11_client_test.bal
+++ b/ballerina/modules/soap11/tests/soap11_client_test.bal
@@ -209,8 +209,8 @@ function testSendOnlyError() returns error? {
 function testSendReceive() returns error? {
     Client soapClient = check new ("http://localhost:9090",
         {
-            inboundSecurity: NO_POLICY,
-            outboundSecurity: {}
+            outboundSecurity: NO_POLICY,
+            inboundSecurity: {}
         }
     );
 
@@ -235,8 +235,8 @@ function testSendReceive() returns error? {
 function testSendReceiveWithInvalidAction() returns error? {
     Client soapClient = check new ("http://localhost:9090",
         {
-            inboundSecurity: NO_POLICY,
-            outboundSecurity: {}
+            outboundSecurity: NO_POLICY,
+            inboundSecurity: {}
         }
     );
 
@@ -287,7 +287,7 @@ function testSendReceiveWithHeaders() returns error? {
 }
 function testTransportBindingError() returns error? {
     Client|Error soapClient = new ("http://localhost:9090",
-        inboundSecurity = TRANSPORT_BINDING
+        outboundSecurity = TRANSPORT_BINDING
     );
     test:assertTrue(soapClient is Error);
     test:assertEquals((<Error>soapClient).message(), SOAP_CLIENT_ERROR);
@@ -298,7 +298,7 @@ function testTransportBindingError() returns error? {
 }
 function testTransportBindingError2() returns error? {
     Client|Error soapClient = new ("http://localhost:9090",
-        inboundSecurity = [
+        outboundSecurity = [
             TRANSPORT_BINDING
         ]
     );
@@ -332,7 +332,7 @@ function testSendReceiveError() returns error? {
 function testSendReceiveWithTimestampTokenSecurity() returns error? {
     Client soapClient = check new ("http://localhost:9091",
         {
-            inboundSecurity: [
+            outboundSecurity: [
                 {
                     timeToLive: 600
                 }
@@ -364,12 +364,12 @@ function testSendReceiveWithTimestampTokenSecurity() returns error? {
 function testSendReceiveWithUsernameTokenSecurity() returns error? {
     Client soapClient = check new ("http://localhost:9091",
         {
-            inboundSecurity: {
+            outboundSecurity: {
                 username: "user",
                 password: "password",
                 passwordType: soap:TEXT
             },
-            outboundSecurity: {}
+            inboundSecurity: {}
         }
     );
     xml body = xml `<soap:Envelope
@@ -410,7 +410,7 @@ function testSendReceiveWithAsymmetricBindingSecurity() returns error? {
 
     Client soapClient = check new ("http://localhost:9091",
         {
-            inboundSecurity: {
+            outboundSecurity: {
                 signatureAlgorithm: soap:RSA_SHA256,
                 encryptionAlgorithm: soap:RSA_ECB,
                 signatureKey: clientPrivateKey,
@@ -456,7 +456,7 @@ function testSendReceiveWithSymmetricBindingSecurity() returns error? {
 
     Client soapClient = check new ("http://localhost:9091",
         {
-            inboundSecurity: {
+            outboundSecurity: {
                 signatureAlgorithm: soap:RSA_SHA256,
                 encryptionAlgorithm: soap:RSA_ECB,
                 symmetricKey: symmetricKey,
@@ -491,7 +491,7 @@ function testSoapEndpoint() returns error? {
     string password = "password";
     Client soapClient = check new ("http://localhost:9090",
         {
-            inboundSecurity: {
+            outboundSecurity: {
                 username: username,
                 password: password,
                 passwordType: wssec:TEXT
@@ -509,13 +509,13 @@ function testSoapEndpoint() returns error? {
 function testSoapReceiveWithSymmetricBindingAndOutboundConfig() returns error? {
     Client soapClient = check new ("http://localhost:9090",
         {
-            inboundSecurity: {
+            outboundSecurity: {
                 signatureAlgorithm: wssec:RSA_SHA256,
                 encryptionAlgorithm: wssec:RSA_ECB,
                 symmetricKey: symmetricKey,
                 servicePublicKey: serverPublicKey
             },
-            outboundSecurity: {
+            inboundSecurity: {
                 verificationKey: publicKey,
                 signatureAlgorithm: wssec:RSA_SHA256,
                 decryptionAlgorithm: wssec:RSA_ECB,
@@ -534,13 +534,13 @@ function testSoapReceiveWithSymmetricBindingAndOutboundConfig() returns error? {
 function testSendReceiveWithAsymmetricBindingAndOutboundConfig() returns error? {
     Client soapClient = check new ("http://localhost:9090",
         {
-            inboundSecurity: {
+            outboundSecurity: {
                 signatureAlgorithm: soap:RSA_SHA256,
                 encryptionAlgorithm: soap:RSA_ECB,
                 signatureKey: clientPrivateKey,
                 encryptionKey: serverPublicKey
             },
-            outboundSecurity: {
+            inboundSecurity: {
                 verificationKey: serverPublicKey,
                 signatureAlgorithm: soap:RSA_SHA256,
                 decryptionAlgorithm: soap:RSA_ECB,
@@ -559,13 +559,13 @@ function testSendReceiveWithAsymmetricBindingAndOutboundConfig() returns error?
 function testOutboundConfigWithMime2() returns error? {
     Client soapClient = check new ("http://localhost:9090",
         {
-            inboundSecurity: {
+            outboundSecurity: {
                 signatureAlgorithm: soap:RSA_SHA256,
                 encryptionAlgorithm: soap:RSA_ECB,
                 signatureKey: clientPrivateKey,
                 encryptionKey: serverPublicKey
             },
-            outboundSecurity: {
+            inboundSecurity: {
                 verificationKey: serverPublicKey,
                 signatureAlgorithm: soap:RSA_SHA256,
                 decryptionAlgorithm: soap:RSA_ECB,
@@ -613,13 +613,13 @@ function testOutboundConfigWithMime2() returns error? {
 function testInvalidOutboundConfigWithMime() returns error? {
     Client soapClient = check new ("http://localhost:9090",
         {
-            inboundSecurity: {
+            outboundSecurity: {
                 signatureAlgorithm: soap:RSA_SHA256,
                 encryptionAlgorithm: soap:RSA_ECB,
                 signatureKey: clientPrivateKey,
                 encryptionKey: serverPublicKey
             },
-            outboundSecurity: {
+            inboundSecurity: {
                 verificationKey: clientPublicKey,
                 signatureAlgorithm: soap:RSA_SHA256,
                 decryptionAlgorithm: soap:RSA_ECB,
diff --git a/ballerina/modules/soap12/Module.md b/ballerina/modules/soap12/Module.md
index 80b55f1..ed5d505 100644
--- a/ballerina/modules/soap12/Module.md
+++ b/ballerina/modules/soap12/Module.md
@@ -69,9 +69,9 @@ The SOAP client module introduces a robust framework for configuring security me
 
 There are two primary security configurations available for SOAP clients:
 
-- `inboundSecurity`: This configuration is applied to the SOAP envelope when a request is made. It includes various ws security policies such as Username Token, Timestamp Token, X509 Token, Symmetric Binding, Asymmetric Binding, and Transport Binding, either individually or in combination with each other.
+- `outboundSecurity`: This configuration is applied to the SOAP envelope when a request is made. It includes various ws security policies such as Username Token, Timestamp Token, X509 Token, Symmetric Binding, Asymmetric Binding, and Transport Binding, either individually or in combination with each other.
 
-- `outboundSecurity`: This configuration is applied to the SOAP envelope when a response is received. Its purpose is to decrypt the data within the envelope and verify the digital signature for security validation.
+- `inboundSecurity`: This configuration is applied to the SOAP envelope when a response is received. Its purpose is to decrypt the data within the envelope and verify the digital signature for security validation.
 
 ### Policies
 
@@ -117,7 +117,7 @@ These policies empower SOAP clients to enhance the security of their web service
 
 #### Outbound Security Configurations
 
-- `OutboundSecurityConfig`: Represents the record for outbound security configurations to verify and decrypt SOAP envelopes.
+- `InboundSecurityConfig`: Represents the record for outbound security configurations to verify and decrypt SOAP envelopes.
   - Fields:
     - `crypto:PublicKey` verificationKey : The public key to verify the signature of the SOAP envelope
     - `crypto:PrivateKey`|`crypto:PublicKey` decryptionKey : The private key to decrypt the SOAP envelope
@@ -141,13 +141,13 @@ public function main() returns error? {
 
     soap12:Client soapClient = check new ("http://www.secured-soap-endpoint.com",
     {
-        inboundSecurity: {
+        outboundSecurity: {
                 signatureAlgorithm: soap:RSA_SHA256,
                 encryptionAlgorithm: soap:RSA_ECB,
                 signatureKey: clientPrivateKey,
                 encryptionKey: serverPublicKey,
         },
-        outboundSecurity: {
+        inboundSecurity: {
                 verificationKey: serverPublicKey,
                 signatureAlgorithm: soap:RSA_SHA256,
                 decryptionKey: clientPrivateKey,
diff --git a/ballerina/modules/soap12/soap12.bal b/ballerina/modules/soap12/soap12.bal
index 44d4402..c136669 100644
--- a/ballerina/modules/soap12/soap12.bal
+++ b/ballerina/modules/soap12/soap12.bal
@@ -23,8 +23,8 @@ import ballerina/jballerina.java;
 # Object for the basic SOAP 1.2 client endpoint.
 public isolated client class Client {
     private final http:Client soapClient;
-    private final readonly & soap:InboundSecurityConfig|soap:InboundSecurityConfig[] inboundSecurity;
-    private final readonly & soap:OutboundSecurityConfig outboundSecurity;
+    private final readonly & soap:OutboundSecurityConfig|soap:OutboundSecurityConfig[] outboundSecurity;
+    private final readonly & soap:InboundSecurityConfig inboundSecurity;
 
     # Gets invoked during object initialization.
     #
@@ -36,8 +36,8 @@ public isolated client class Client {
             check soap:validateTransportBindingPolicy(config);
             self.soapClient = check new (url, config.httpConfig);
             readonly & soap:ClientConfig readonlyConfig = soap:getReadOnlyClientConfig(config);
-            self.inboundSecurity = readonlyConfig.inboundSecurity;
             self.outboundSecurity = readonlyConfig.outboundSecurity;
+            self.inboundSecurity = readonlyConfig.inboundSecurity;
         } on fail var err {
             return error Error(SOAP_CLIENT_ERROR, err);
         }
@@ -71,7 +71,7 @@ public isolated client class Client {
             xml mimeEntity = body is xml ? body : check body[0].getXml();
             lock {
                 xml envelope = body is xml ? body.clone() : mimeEntity.clone();
-                securedBody = check soap:applySecurityPolicies(self.inboundSecurity.clone(), envelope.clone());
+                securedBody = check soap:applySecurityPolicies(self.outboundSecurity.clone(), envelope.clone());
             }
             xml|mime:Entity[] response;
             if body is mime:Entity[] {
@@ -81,13 +81,13 @@ public isolated client class Client {
                 response = check soap:sendReceive(securedBody, self.soapClient, action, headers, path);
             }
             lock {
-                soap:OutboundSecurityConfig? outboundSecurity = self.outboundSecurity.clone();
+                soap:InboundSecurityConfig? inboundSecurity = self.inboundSecurity.clone();
                 do {
-                    if outboundSecurity is soap:OutboundSecurityConfig && outboundSecurity != {} {
+                    if inboundSecurity is soap:InboundSecurityConfig && inboundSecurity != {} {
                         if response is xml {
-                            return check soap:applyOutboundConfig(outboundSecurity.clone(), response.clone());
+                            return check soap:applyOutboundConfig(inboundSecurity.clone(), response.clone());
                         } else {
-                            return check soap:applyOutboundConfig(outboundSecurity.clone(),
+                            return check soap:applyOutboundConfig(inboundSecurity.clone(),
                                                                   check response[0].getXml().clone());
                         }
                     }
@@ -119,7 +119,7 @@ public isolated client class Client {
             xml mimeEntity = body is xml ? body : check body[0].getXml();
             lock {
                 xml envelope = body is xml ? body.clone() : mimeEntity.clone();
-                securedBody = check soap:applySecurityPolicies(self.inboundSecurity.clone(), envelope.clone());
+                securedBody = check soap:applySecurityPolicies(self.outboundSecurity.clone(), envelope.clone());
             }
             return check soap:sendOnly(securedBody, self.soapClient, action, headers, path);
         } on fail error soapError {
diff --git a/ballerina/modules/soap12/tests/soap12_client_test.bal b/ballerina/modules/soap12/tests/soap12_client_test.bal
index 21f50f8..84c0fa0 100644
--- a/ballerina/modules/soap12/tests/soap12_client_test.bal
+++ b/ballerina/modules/soap12/tests/soap12_client_test.bal
@@ -321,7 +321,7 @@ function testSendOnly12WithoutSoapAction() returns error? {
     groups: ["soap12"]
 }
 function testTransportBindingError() returns error? {
-    Client|Error soapClient = new ("http://localhost:9091", inboundSecurity = TRANSPORT_BINDING);
+    Client|Error soapClient = new ("http://localhost:9091", outboundSecurity = TRANSPORT_BINDING);
     test:assertTrue(soapClient is Error);
     test:assertEquals((<Error>soapClient).message(), SOAP_CLIENT_ERROR);
 }
@@ -331,7 +331,7 @@ function testTransportBindingError() returns error? {
 }
 function testTransportBindingError2() returns error? {
     Client|Error soapClient = new ("http://localhost:9091",
-        inboundSecurity = [
+        outboundSecurity = [
             TRANSPORT_BINDING
         ]
     );
@@ -365,7 +365,7 @@ function testSendReceiveError() returns error? {
 function testSendReceiveWithTimestampTokenSecurity() returns error? {
     Client soapClient = check new ("http://localhost:9091",
         {
-            inboundSecurity: [
+            outboundSecurity: [
                 {
                     timeToLive: 600
                 }
@@ -399,12 +399,12 @@ function testSendReceiveWithTimestampTokenSecurity() returns error? {
 function testSendReceiveWithUsernameTokenSecurity() returns error? {
     Client soapClient = check new ("http://localhost:9091",
         {
-            inboundSecurity: {
+            outboundSecurity: {
                 username: "user",
                 password: "password",
                 passwordType: soap:TEXT
             },
-            outboundSecurity: {}
+            inboundSecurity: {}
         }
     );
     xml body = xml `<soap:Envelope
@@ -447,7 +447,7 @@ function testSendReceiveWithAsymmetricBindingSecurity() returns error? {
 
     Client soapClient = check new ("http://localhost:9091",
         {
-            inboundSecurity: {
+            outboundSecurity: {
                 signatureAlgorithm: soap:RSA_SHA256,
                 encryptionAlgorithm: soap:RSA_ECB,
                 signatureKey: clientPrivateKey,
@@ -494,7 +494,7 @@ function testSendReceiveWithSymmetricBindingSecurity() returns error? {
 
     Client soapClient = check new ("http://localhost:9091",
         {
-            inboundSecurity: {
+            outboundSecurity: {
                 signatureAlgorithm: soap:RSA_SHA256,
                 encryptionAlgorithm: soap:RSA_ECB,
                 symmetricKey: symmetricKey,
@@ -530,7 +530,7 @@ function testSoapEndpoint() returns error? {
     string password = "password";
     Client soapClient = check new ("http://localhost:9090",
         {
-            inboundSecurity: {
+            outboundSecurity: {
                 username: username,
                 password: password,
                 passwordType: wssec:TEXT
@@ -548,13 +548,13 @@ function testSoapEndpoint() returns error? {
 function testSoapReceiveWithSymmetricBindingAndOutboundConfig() returns error? {
     Client soapClient = check new ("http://localhost:9090",
         {
-            inboundSecurity: {
+            outboundSecurity: {
                 signatureAlgorithm: wssec:RSA_SHA256,
                 encryptionAlgorithm: wssec:RSA_ECB,
                 symmetricKey: symmetricKey,
                 servicePublicKey: serverPublicKey
             },
-            outboundSecurity: {
+            inboundSecurity: {
                 verificationKey: publicKey,
                 signatureAlgorithm: wssec:RSA_SHA256,
                 decryptionAlgorithm: wssec:RSA_ECB,
@@ -573,13 +573,13 @@ function testSoapReceiveWithSymmetricBindingAndOutboundConfig() returns error? {
 function testSendReceiveWithAsymmetricBindingAndOutboundConfig() returns error? {
     Client soapClient = check new ("http://localhost:9090",
         {
-            inboundSecurity: {
+            outboundSecurity: {
                 signatureAlgorithm: soap:RSA_SHA256,
                 encryptionAlgorithm: soap:RSA_ECB,
                 signatureKey: clientPrivateKey,
                 encryptionKey: serverPublicKey
             },
-            outboundSecurity: {
+            inboundSecurity: {
                 verificationKey: serverPublicKey,
                 signatureAlgorithm: soap:RSA_SHA256,
                 decryptionAlgorithm: soap:RSA_ECB,
@@ -599,13 +599,13 @@ function testSendReceiveWithAsymmetricBindingAndOutboundConfig() returns error?
 function testInvalidOutboundConfigWithMime12() returns error? {
     Client soapClient = check new ("http://localhost:9090",
         {
-            inboundSecurity: {
+            outboundSecurity: {
                 signatureAlgorithm: soap:RSA_SHA256,
                 encryptionAlgorithm: soap:RSA_ECB,
                 signatureKey: clientPrivateKey,
                 encryptionKey: serverPublicKey
             },
-            outboundSecurity: {
+            inboundSecurity: {
                 verificationKey: clientPublicKey,
                 signatureAlgorithm: soap:RSA_SHA256,
                 decryptionAlgorithm: soap:RSA_ECB,
diff --git a/ballerina/modules/wssec/records.bal b/ballerina/modules/wssec/records.bal
index 188138c..03d6977 100644
--- a/ballerina/modules/wssec/records.bal
+++ b/ballerina/modules/wssec/records.bal
@@ -17,7 +17,7 @@
 import ballerina/crypto;
 
 # Union type of all the inbound web service security configurations.
-public type InboundSecurityConfig NoPolicy|UsernameTokenConfig|TimestampTokenConfig|SymmetricBindingConfig
+public type OutboundSecurityConfig NoPolicy|UsernameTokenConfig|TimestampTokenConfig|SymmetricBindingConfig
     |AsymmetricBindingConfig|TransportBindingConfig;
 
 # Represents the record for outbound security configurations to verify and decrypt SOAP envelopes.
@@ -26,7 +26,7 @@ public type InboundSecurityConfig NoPolicy|UsernameTokenConfig|TimestampTokenCon
 # + decryptionKey - The private key to decrypt the SOAP envelope
 # + signatureAlgorithm - The algorithm to verify the SOAP envelope
 # + decryptionAlgorithm - The algorithm to decrypt the SOAP body
-public type OutboundSecurityConfig record {|
+public type InboundSecurityConfig record {|
     crypto:PublicKey verificationKey?;
     crypto:PrivateKey|crypto:PublicKey decryptionKey?;
     SignatureAlgorithm signatureAlgorithm?;
diff --git a/ballerina/modules/wssec/tests/ws_security_tests.bal b/ballerina/modules/wssec/tests/ws_security_tests.bal
index 33949af..dcdc4eb 100644
--- a/ballerina/modules/wssec/tests/ws_security_tests.bal
+++ b/ballerina/modules/wssec/tests/ws_security_tests.bal
@@ -456,7 +456,7 @@ function testSymmetricBindingWithOutboundConfig() returns error? {
     xml securedEnvelope = check applySymmetricBinding(envelope, false, symmetricBinding);
     string envelopeString = securedEnvelope.toString();
 
-    OutboundSecurityConfig outboundConfig = {
+    InboundSecurityConfig outboundConfig = {
         verificationKey: publicKey,
         signatureAlgorithm: RSA_SHA256,
         decryptionAlgorithm: RSA_ECB,
diff --git a/ballerina/soap_utils.bal b/ballerina/soap_utils.bal
index 5891c77..cad6653 100644
--- a/ballerina/soap_utils.bal
+++ b/ballerina/soap_utils.bal
@@ -25,11 +25,11 @@ import ballerina/test;
 
 public isolated function validateTransportBindingPolicy(ClientConfig config) returns Error? {
     if config.httpConfig.secureSocket is () {
-        wssec:InboundSecurityConfig|wssec:InboundSecurityConfig[] securityPolicy = config.inboundSecurity;
+        wssec:OutboundSecurityConfig|wssec:OutboundSecurityConfig[] securityPolicy = config.outboundSecurity;
         if securityPolicy is wssec:TransportBindingConfig {
             return error Error(INVALID_PROTOCOL_ERROR);
-        } else if securityPolicy is wssec:InboundSecurityConfig[] {
-            foreach wssec:InboundSecurityConfig policy in securityPolicy {
+        } else if securityPolicy is wssec:OutboundSecurityConfig[] {
+            foreach wssec:OutboundSecurityConfig policy in securityPolicy {
                 if policy is wssec:TransportBindingConfig {
                     return error Error(INVALID_PROTOCOL_ERROR);
                 }
@@ -42,7 +42,7 @@ public isolated function getReadOnlyClientConfig(ClientConfig original) returns
     'class: "org.wssec.WsSecurity"
 } external;
 
-public isolated function applySecurityPolicies(wssec:InboundSecurityConfig|wssec:InboundSecurityConfig[] security,
+public isolated function applySecurityPolicies(wssec:OutboundSecurityConfig|wssec:OutboundSecurityConfig[] security,
         xml envelope, boolean soap12 = true)
     returns xml|crypto:Error|wssec:Error {
     if security is wssec:TimestampTokenConfig {
@@ -53,26 +53,26 @@ public isolated function applySecurityPolicies(wssec:InboundSecurityConfig|wssec
         return wssec:applySymmetricBinding(envelope, soap12, security);
     } else if security is wssec:AsymmetricBindingConfig {
         return wssec:applyAsymmetricBinding(envelope, soap12, security);
-    } else if security is wssec:InboundSecurityConfig {
+    } else if security is wssec:OutboundSecurityConfig {
         return envelope;
     } else {
         xml securedEnvelope;
-        foreach wssec:InboundSecurityConfig policy in security {
+        foreach wssec:OutboundSecurityConfig policy in security {
             securedEnvelope = check applySecurityPolicies(policy, envelope);
         }
         return securedEnvelope;
     }
 }
 
-public isolated function applyOutboundConfig(OutboundSecurityConfig outboundSecurity, xml envelope,
+public isolated function applyOutboundConfig(InboundSecurityConfig inboundSecurity, xml envelope,
                                              boolean soap12 = true) returns xml|Error {
     xmlns "http://schemas.xmlsoap.org/soap/envelope/" as soap11;
     xmlns "http://www.w3.org/2003/05/soap-envelope" as soap12;
     xml soapEnvelope = envelope;
     do {
-        wssec:EncryptionAlgorithm? encryptionAlgorithm = outboundSecurity.decryptionAlgorithm;
+        wssec:EncryptionAlgorithm? encryptionAlgorithm = inboundSecurity.decryptionAlgorithm;
         if encryptionAlgorithm is wssec:EncryptionAlgorithm {
-            crypto:PrivateKey|crypto:PublicKey? clientPrivateKey = outboundSecurity.decryptionKey;
+            crypto:PrivateKey|crypto:PublicKey? clientPrivateKey = inboundSecurity.decryptionKey;
             if clientPrivateKey is crypto:PrivateKey|crypto:PublicKey {
                 byte[] encData = check wssec:getEncryptedData(soapEnvelope);
                 byte[] decryptDataResult = check crypto:decryptRsaEcb(encData, clientPrivateKey);
@@ -82,9 +82,9 @@ public isolated function applyOutboundConfig(OutboundSecurityConfig outboundSecu
                 soapEnvelope = check xml:fromString(decryptedEnv);
             }
         }
-        wssec:SignatureAlgorithm? signatureAlgorithm = outboundSecurity.signatureAlgorithm;
+        wssec:SignatureAlgorithm? signatureAlgorithm = inboundSecurity.signatureAlgorithm;
         if signatureAlgorithm is wssec:SignatureAlgorithm {
-            crypto:PublicKey? serverPublicKey = outboundSecurity.verificationKey;
+            crypto:PublicKey? serverPublicKey = inboundSecurity.verificationKey;
             if serverPublicKey is crypto:PublicKey {
                 byte[] signatureData = check wssec:getSignatureData(soapEnvelope);
                 if soap12 {
diff --git a/ballerina/types.bal b/ballerina/types.bal
index aca2f2a..73c4eee 100644
--- a/ballerina/types.bal
+++ b/ballerina/types.bal
@@ -46,9 +46,9 @@ public enum EncryptionAlgorithm {
 # + decryptionKey - The private key to decrypt the SOAP envelope
 # + signatureAlgorithm - The algorithm to verify the SOAP envelope
 # + decryptionAlgorithm - The algorithm to decrypt the SOAP body
-public type OutboundSecurityConfig record {
-    *wssec:OutboundSecurityConfig;
+public type InboundSecurityConfig record {
+    *wssec:InboundSecurityConfig;
 };
 
 # Union type of all the inbound web service security configurations.
-public type InboundSecurityConfig wssec:InboundSecurityConfig;
+public type OutboundSecurityConfig wssec:OutboundSecurityConfig;
diff --git a/docs/spec/spec.md b/docs/spec/spec.md
index 90c4d4b..4e268aa 100644
--- a/docs/spec/spec.md
+++ b/docs/spec/spec.md
@@ -279,9 +279,9 @@ The SOAP client module introduces a robust framework for configuring security me
 
 There are two primary security configurations available for SOAP clients:
 
-* `inboundSecurity`: This configuration is applied to the SOAP envelope when a request is made. It includes various ws security policies such as Username Token, Timestamp Token, X509 Token, Symmetric Binding, Asymmetric Binding, and Transport Binding, either individually or in combination with each other.
+* `outboundSecurity`: This configuration is applied to the SOAP envelope when a request is made. It includes various ws security policies such as Username Token, Timestamp Token, X509 Token, Symmetric Binding, Asymmetric Binding, and Transport Binding, either individually or in combination with each other.
 
-* `outboundSecurity`: This configuration is applied to the SOAP envelope when a response is received. Its purpose is to decrypt the data within the envelope and verify the digital signature for security validation.
+* `inboundSecurity`: This configuration is applied to the SOAP envelope when a response is received. Its purpose is to decrypt the data within the envelope and verify the digital signature for security validation.
 
 ### 3.1 Policies
 
@@ -329,7 +329,7 @@ This subsection introduces the configuration types for inbound and outbound secu
 
 #### 3.2.2 Outbound Security Configurations
 
-* `OutboundSecurityConfig`: Represents the record for outbound security configurations to verify and decrypt SOAP envelopes.
+* `InboundSecurityConfig`: Represents the record for outbound security configurations to verify and decrypt SOAP envelopes.
   * Fields:
     * `crypto:PublicKey` verificationKey : The public key to verify the signature of the SOAP envelope
     * `crypto:PrivateKey`|`crypto:PublicKey` decryptionKey : The private key to decrypt the SOAP envelope
@@ -350,7 +350,7 @@ import ballerina/soap.soap11;
 public function main() returns error? {
     soap11:Client soapClient = check new ("https://www.secured-soap-endpoint.com", 
         {
-            inboundSecurity: [
+            outboundSecurity: [
             {
                 username: "username",
                 password: "password",
@@ -387,13 +387,13 @@ public function main() returns error? {
 
     soap12:Client soapClient = check new ("https://www.secured-soap-endpoint.com",
     {
-        inboundSecurity: {
+        outboundSecurity: {
                 signatureAlgorithm: soap:RSA_SHA256,
                 encryptionAlgorithm: soap:RSA_ECB,
                 signatureKey: clientPrivateKey,
                 encryptionKey: serverPublicKey,
         },
-        outboundSecurity: {
+        inboundSecurity: {
                 verificationKey: serverPublicKey,
                 signatureAlgorithm: soap:RSA_SHA256,
                 decryptionKey: clientPrivateKey,