Thanks for your help. I did some more research and it is clear that WSS is needed but I still am having trouble with it.
When I use WSS and mustUnderstand =1; I get error "MustUnderstand headers:[{
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd}Security] are not understood". However when I use WSS and mustUnderstand = 0 , I don't get an error, but the request is sent back as the response.
See below
Request WITH WSSE mustUnderstand =1 USING PasswordDigest<soapenv:Envelope xmlns:amex="
http://www.comarch.pl/amex/" xmlns:soapenv="
http://schemas.xmlsoap.org/soap/envelope/"> <soapenv:Header>
<wsse:Security soapenv:mustUnderstand="1" xmlns:wsse="
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd"> <wsse:UsernameToken wsu:Id="UsernameToken-4">
<wsse:Username>if08ivrtest</wsse:Username>
<wsse:Password Type="
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-username-token-profile-1.0#PasswordDigest">QLRsQWu9tt5vD0NBkqtTMx+SL+I=</wsse:Password> <wsse:Nonce EncodingType="
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Base64Binary">D9yE2f//e/SUnedw/36j5Q==</wsse:Nonce> <wsu:Created>2013-09-12T21:04:56.135Z</wsu:Created>
</wsse:UsernameToken>
</wsse:Security>
</soapenv:Header>
<soapenv:Body>
<amex:getCustomerPointsBalance>
<requestId>45678910</requestId>
<channelId>LEIVRFTB</channelId>
<requestTimestamp>2013-09-12T16:55:32.215Z</requestTimestamp>
<mediumLast4>3234</mediumLast4>
<ssnLast4>4353</ssnLast4>
<zipCode>78978</zipCode>
</amex:getCustomerPointsBalance>
</soapenv:Body>
</soapenv:Envelope>
RESULT WITH WSSE mustUnderstand =1 USING PasswordDigest<S:Envelope xmlns:S="
http://schemas.xmlsoap.org/soap/envelope/"> <S:Body>
<S:Fault xmlns:ns3="
http://www.w3.org/2003/05/soap-envelope"> <faultcode>S:MustUnderstand</faultcode>
<faultstring>MustUnderstand headers:[{
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd}Security] are not understood</faultstring>
</S:Fault>
</S:Body>
</S:Envelope>
Request WITH WSSE mustUnderstand =0 USING PasswordDigest<soapenv:Envelope xmlns:amex="
http://www.comarch.pl/amex/" xmlns:soapenv="
http://schemas.xmlsoap.org/soap/envelope/"> <soapenv:Header>
<wsse:Security soapenv:mustUnderstand="0" xmlns:wsse="
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd"> <wsse:UsernameToken wsu:Id="UsernameToken-4">
<wsse:Username>if08ivrtest</wsse:Username>
<wsse:Password Type="
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-username-token-profile-1.0#PasswordDigest">QLRsQWu9tt5vD0NBkqtTMx+SL+I=</wsse:Password> <wsse:Nonce EncodingType="
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Base64Binary">D9yE2f//e/SUnedw/36j5Q==</wsse:Nonce> <wsu:Created>2013-09-12T21:04:56.135Z</wsu:Created>
</wsse:UsernameToken>
</wsse:Security>
</soapenv:Header>
<soapenv:Body>
<amex:getCustomerPointsBalance>
<requestId>45678910</requestId>
<channelId>LEIVRFTB</channelId>
<requestTimestamp>2013-09-12T16:55:32.215Z</requestTimestamp>
<mediumLast4>3234</mediumLast4>
<ssnLast4>4353</ssnLast4>
<zipCode>78978</zipCode>
</amex:getCustomerPointsBalance>
</soapenv:Body>
</soapenv:Envelope>
RESULT WITH WSSE mustUnderstand =0 USING PasswordDigest<soapenv:Envelope xmlns:amex="
http://www.comarch.pl/amex/" xmlns:soapenv="
http://schemas.xmlsoap.org/soap/envelope/"> <soapenv:Header>
<wsse:Security soapenv:mustUnderstand="0" xmlns:wsse="
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd"> <wsse:UsernameToken wsu:Id="UsernameToken-4">
<wsse:Username>if08ivrtest</wsse:Username>
<wsse:Password Type="
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-username-token-profile-1.0#PasswordDigest">QLRsQWu9tt5vD0NBkqtTMx+SL+I=</wsse:Password> <wsse:Nonce EncodingType="
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Base64Binary">D9yE2f//e/SUnedw/36j5Q==</wsse:Nonce> <wsu:Created>2013-09-12T21:04:56.135Z</wsu:Created>
</wsse:UsernameToken>
</wsse:Security>
</soapenv:Header>
<soapenv:Body>
<amex:getCustomerPointsBalance>
<requestId>45678910</requestId>
<channelId>LEIVRFTB</channelId>
<requestTimestamp>2013-09-12T16:55:32.215Z</requestTimestamp>
<mediumLast4>3234</mediumLast4>
<ssnLast4>4353</ssnLast4>
<zipCode>78978</zipCode>
</amex:getCustomerPointsBalance>
</soapenv:Body>
</soapenv:Envelope>