This was my experience as well, trying to convinced enterprise security folks to let new protocols through firewalls was nearly impossible.

The difficulty was exponentiated for api/service calls inbound to the organization.

SOAP services, even though they went over http, had to go through special inspection devices because XML parsing libraries were so complex and prone to parsing issues and security vulns.