public class SecurityController : ApiController
{
    static readonly NLog.Logger Logger = NLog.LogManager.GetCurrentClassLogger();

    [HttpPost]
    public IHttpActionResult StartSession([FromBody] ConnectRequestModel requestModel)
    {
        var client = new SecurityFacade(); // from proxy class
        var requestMessage = new ConnectRequest
        {
            Username = requestModel.Username,
            Password = requestModel.Password
        };

        try
        {
            return Ok(new
            {
                client.StartSession(requestMessage).SessionId
            });
        }
        catch (SoapException ex)
        {
            return BadRequest(new SoapExceptionResponse(ex.Code.Name, ex.Message));
        }
        catch (Exception ex)
        {
            Logger.Error(ex);
            return InternalServerError(ex);
        }
    }
}

public class SoapExceptionResponse
{
    public SoapExceptionResponse(string code, string message)
    {
        Code = code;
        Message = message;
    }

    public string Code { get; }
    public string Message { get; }

    public static implicit operator string(SoapExceptionResponse s)
    {
        return JsonConvert.SerializeObject(s);
    }
}

{
    "Message": "{"Code":"InvalidUsernameAndPasswordPair","Message":"User/Password invalid."}"
}

var request = new RestRequest("security/startsession");
request.AddParameter("Username", Username);
request.AddParameter("Password", Password);

restClient.PostAsync<ConnectResponse>(request, (response, handle) =>
{
    if (response.StatusCode == HttpStatusCode.OK)
    {
        var sessionId = response.Data.SessionId;
    }
    else if (response.StatusCode == HttpStatusCode.BadRequest)
    {
        var responseMessage = JsonConvert.DeserializeAnonymousType(response.Content, new { Message = "" });
        var error = JsonConvert.DeserializeAnonymousType(responseMessage.Message, new { Code = "", Message = "" });
        var code = error.Code;
        var message = error.Message;

        if (code == "InvalidUsernameAndPasswordPair")
        {
            // todo
        }
    }
});