zosConnect-2.0 Configuration elements

zosconnect_apiRequesters > apiRequester

Description:

Defines other configuration options for the API requester archive.

Attribute name	Description
adminGroup	Data type string Default value Not applicable Description Optional. Identifies the users that are able to use administrative functions on this API requester. The value of this attribute can be set to a group name or a comma-separated list of group names that are defined in the user registry. If globalAdminGroup is also under element zosconnect_zosConnectManager, the value that is defined under adminGroup is used. This group takes precedence over the global group except when controlling authorization to the RESTful administration actions to deploy an API, deploy a service, list all APIs, or list all services. See Note 1 and Note 2.
connectionRef	Data type string Default value Not applicable Description Optional. Reference to a zosconnect_endpointConnection element. If set, the connection is made by using the attributes of the zosconnect_endpointConnection element; if not set, or the associated zosconnect_endpointConnection element does not exist, the value of the connectionRef attribute in the build toolkit properties file is used, and if the value of the connectionRef attribute in the build toolkit properties file does not exist either, an error occurs.
idAssertion	Data type string Default value Not applicable Description Optional. Available from 3.0.45.0. Controls whether identity assertion is enabled in z/OS Connect for this API requester, and, if identity assertion is enabled, whether a surrogate check is supported. If the idAssertion attribute is not set, the setting for all API requesters from the idAssertion attribute on the zosconnect_apiRequesters element is used instead. Supported values are: OFF Identity assertion is not available in z/OS Connect for API requesters. z/OS applications cannot invoke an API requester with an asserted identity that is provided in the application context. ASSERT_SURROGATE Identity assertion is enabled in z/OS Connect for API requesters. z/OS applications can invoke an API requester with an asserted identity that is provided in the application context. With the ASSERT_SURROGATE value specified, z/OS Connect checks whether the identity used for authenticating the z/OS subsystem access to the z/OS Connect Server is a surrogate of the asserted identity and whether the asserted identity has the authority to invoke the API requester. ASSERT_ONLY Identity assertion is enabled in z/OS Connect for API requesters. z/OS applications can invoke an API requester with an asserted identity that is provided in the application context. With the ASSERT_ONLY value specified, z/OS Connect directly checks whether the asserted identity has the authority to invoke the API requester. Depending on the values set in the idAssertion and requireAuth attributes, z/OS Connect performs different actions on the asserted identity and the identity that is used for authenticating the z/OS subsystem access to the z/OS Connect Server. For more information, see Identity assertion for API requesters.
interceptorsRef	Data type string Default value Not applicable Description Optional. Reference to a zosconnect_zosConnectInterceptors element that identifies the set of configured interceptors that are associated with this API requester.
invokeGroup	Data type string Default value Not applicable Description Optional. Identifies the users that are able to invoke this API requester. The value of this attribute can be set to a group name or a comma-separated list of group names that are defined in the user registry. If globalInvokeGroup is also defined under the zosconnect_zosConnectManager element, the value that is defined under invokeGroup is used. See Note 1 and Note 2.
name	Data type string Default value Not applicable Description Required. The name of the API requester. The API requester is named automatically when the API requester archive file is generated. The name of the API requester indicates the name and version of the API to be called, and is associated with the API requester archive file to be used. For more information, see Configuring IBM z/OS Connect to support API requesters.
oAuthResource	Data type string Default value Not applicable Description Optional. Available from 3.0.51.0. An OAuth 2.0 resource parameter to be included in the access token request to an OAuth 2.0 authorization server. This parameter is applicable only when API request uses a zosconnect_endpointConnection definition that has an authenticationConfigRef of type zosconnect_oAuthConfig. This value overrides any value that is specified by BAQ-OAUTH-RESOURCE-PTR in the z/OS application.
operationsGroup	Data type string Default value Not applicable Description Optional. Identifies the users that are able to perm operations such as starting or stopping this API requester. The value of this attribute can be set to a group name or a comma-separated list of group names that are defined in the user registry. If globalOperationsGroup is also defined in the zosconnect_zosConnectManager element, the value that is defined under operationsGroup is used. This group takes precedence over the global group except when controlling authorization to the RESTful administration actions to deploy an API, deploy a service, list all APIs, or list all services. See Note 1 and Note 2.
readerGroup	Data type string Default value Not applicable Description Optional. Identifies the users that are able to get information about this API requester, including the Swagger documentation. The value of this attribute can be set to a group name or a comma-separated list of group names that are defined in the user registry. If globalReaderGroup is also defined under the zosconnect_zosConnectManager element, the value that is defined under readerGroup is used. See Note 1 and Note 2.
requireAuth	Data type boolean Default value Not applicable Description Optional. Requires that users specify security credentials to be authenticated and that the authenticated user is authorized under the zosConnectAccess role to access the specific API requester. If the requireAuth attribute is not set, the setting for all API requesters from the requireAuth attribute on the zosconnect_apiRequesters element is used instead. If the requireAuth attribute on the zosconnect_apiRequesters element is not set either, the global setting from the requireAuth attribute on the zosconnect_zosConnectManager element is used instead.
requireSecure	Data type boolean Default value Not applicable Description Optional. Requires that requests are sent over HTTPS. If the requireSecure attribute is not set, the setting for all API requesters from the requireSecure attribute on the zosconnect_apiRequesters element is used instead. If the requireSecure attribute on the zosconnect_apiRequesters element is also not set, the global setting from the requireSecure attribute on the zosconnect_zosConnectManager element is used instead.
runGlobalInterceptors	Data type boolean Default value true Description Optional. Indicates whether to run global interceptors for requests that are associated with this API requester. Global interceptors are listed in globalInterceptorsRef in the zosconnect_zosConnectManager element. By default, z/OS Connect processes all global and API requester-specific interceptors. If the runGlobalInterceptors attribute is set to false, z/OS Connect processes only the set of interceptors that are listed in the interceptorsRef attribute.

Note:

1. If you use an LDAP registry, you must specify each LDAP group's distinguished name (DN) with the commas that are escaped with a backslash. For example, "cn=employees\,ou=groups\,o=intern\,c=fr, cn=managers\,ou=groups\,o=intern\,c=fr". If you specify multiple groups, the commas that separate the groups are not escaped. Specifying LDAP short names is not supported.
2. For information about the authorization levels that are required to perform particular requests, see API requester authorization.

zosconnect_authToken > tokenRequest

Description:

Required. Defines how the user credential is passed from the z/OS Connect Server to the authentication server.

Attribute name	Description
credentialLocation	Data type string Default value Not applicable Description Required. Specifies where the user credentials are included in the request to obtain a token from the authentication server. Supported values are: header Include the user credentials in the HTTP header. If this value is set, the header attribute of the tokenRequest element must be specified. body Include the user credentials in the request body. If this value is set, the requestBody attribute must be specified. For both values, the requestMethod attribute must be specified.
header	Data type string Default value Authorization Description Optional. Specifies the name of a single header to contain the user credentials. From 3.0.70.0, a comma-separated list of two-header names can be specified to contain the user credentials. The format specification for two-header names is: <user ID header name>,<password header name>
requestBody	Data type string Default value Not applicable Description Optional. Specifies the body of the token request that is sent to the authentication server, as a JSON string. Required when credentialLocation is set to body. From 3.0.70.0, is optional when credentialLocation is set to header. Either explicitly specify values in the request body, as in Example A or allow substitution of username and password values set by the client application, or in the server.xml file, as in Example B. From 3.0.70.0, custom parameter values set by the client application can also be substituted. Example A "{&quot;credentials&quot;:{ &quot;username&quot;:&quot;jwtuser&quot;, &quot;password&quot;:&quot;jwtpassword&quot; } }" In this example, the user credentials "jwtuser" and "jwtpassword" are directly included in the specified JSON string. Example B "{&quot;apiuser&quot;:&quot;${userid}&quot;, &quot;apipassword&quot;:&quot;${password}&quot;}" In this example, the variables ${userid} and ${password} are replaced with the user credentials that you include in the z/OS application or set on the zosconnect_authData element that is referenced by the zosconnect_authorizationServer element basicAuthRef attribute. Important: Typically, you use the Example B syntax. When the Example B syntax is used with the user credentials set on the zosconnect_authData element, the password in the server.xml file can be encoded to ensure confidentiality. The Example A syntax is provided to allow more flexibility in the request payload that is required by the authentication server. As shown in the examples before this, &quot; must be used to escape the double quotation mark " inside the attribute value because the attribute value is already surrounded by double quotation marks to indicate it is a string value. And the following characters must also be escaped if they are contained in the attribute value because these special characters cannot be directly used in XML: < escaped with &lt; > escaped with &gt; & escaped with &amp;
requestMethod	Data type string Default value Not applicable Description Required. Specify the method of the HTTP request to the authentication server. Supported values are GET, PUT, or POST.

zosconnect_authToken > tokenResponse

Description:

Required. Defines how an access token is passed from the authentication server to the z/OS Connect Server.

Attribute name	Description
header	Data type string Default value Authorization Description Optional. Specify the name of the header that contains the token.
responseFormat	Data type string Default value Not applicable Description Optional. Specify the format of the HTTP response from the authentication server when the token is returned in the response body. Supported values are Text, JSON, or JWT. JWT is supported from 3.0.69.0. Before 3.0.69.0, no Accept header is set on the token request. From 3.0.69.0, an Accept header is set to "application/json" for JSON, "text/plain" for text and "application/jwt" for JWT.
tokenLifetimePath	Data type string Default value Not applicable Description Optional. Available from 3.0.86.0. Applies only to tokens that are opaque or of type JWE. Specify the path to where the token lifetime is located in the JSON response body string when the responseFormat attribute is set to JSON. The value of this attribute must be a valid JSONPath expression. For example, if the token response is: { "access_token":"2YotnFZFEjr1zCsicMWpAA", "expires_in":3600 } you must set the tokenLifetimePath attribute to "$.expires_in".
tokenLocation	Data type string Default value Not applicable Description Required. Specify where the generated JWT is returned in the response from the authentication server to the z/OS Connect Server. Supported values are: header The token is returned in a header to z/OS Connect. If this value is set, the header attribute of the tokenResponse element must be specified. body The token is returned in the response body to z/OS Connect. If this value is set, the responseFormat and tokenPath attributes must be specified.
tokenPath	Data type string Default value Not applicable Description Optional. Specify the path to where the token is located in the JSON response body string when the responseFormat attribute is set to JSON. The value of this attribute must be a valid JSONPath expression. For example, if the generated token is included in the following JSON string, you must set the tokenPath attribute to "$.JWTinfo.tokenname". {"JWTinfo":{ "tokenname": "eyJ0eXAiOiJKV1" } }

zosconnect_authTokenLocal > claims

Data type:

A string or CDATA section.

Description:

Optional. Specify the public and private claims to be included in the JWT. If specified, write the claims as a JSON string. For example,

<zosconnect_authTokenLocal id="myLocalJWTConfig" 
    ...>
    <claims>{"branch":"Eastern",
             "dept":"insurance"}</claims>
</zosconnect_authTokenLocal>

Note:

1. The claims subelement is intended to specify only public and private claims. If registered claims, such as the aud (Audience) claim, are specified on the claims subelement, then these values overwrite the corresponding values that are configured on the jwtBuilder element that is referenced by the tokenGeneratorRef attribute of the zosconnect_authTokenLocal element. If the "sub" claim is specified on the claims subelement, its value is overwritten by the z/OS Connect Server to be the z/OS application asserted user ID. Registered claims are defined in the IANA JSON Web Token Claims Registry.
2. If the JSON string value of the claims subelement contains XML markup characters, such as <, >, or &, then include the JSON string inside a CDATA section so that those characters are treated as literals. For example, if one of the preceding private claims was "branch":"East&West" then the claims subelement value must be specified as:

   
   <claims><![CDATA[{"branch":"East&West", 
                     "dept":"insurance"}]]></claims> 

   For more information about the CDATA section, see CDATA.

zosconnect_oAuthTokenConfig > claims

Data type:

A string or CDATA section

Description:

Optional. Specify the public and private claims to be included in the JWT. If specified, write the claims as a JSON string. For example,

<zosconnect_oAuthTokenConfig id="myOAuthJWTConfig" 
    ...>
    <claims>{"branch":"Eastern",
             "dept":"insurance"}</claims>
</zosconnect_oAuthTokenConfig>

Note:

1. The claims subelement is intended to specify only public and private claims. If registered claims, such as the aud (Audience) claim, are specified on the claims subelement, then these values overwrite the corresponding values that are configured on the jwtBuilder element by the tokenGeneratorRef attribute of the zosconnect_oAuthTokenConfig element. If the "sub" claim is specified on the claims subelement, its value is overwritten by the value of the value of the tokenSubject attribute. Registered claims are defined in the IANA JSON Web Token Claims Registry.
2. If the JSON string value of the claims subelement contains XML markup characters, such as <, > and &, then include the JSON string inside a CDATA section so that those characters are treated as literals. For example, if one of the private claims above was "branch":"East&West" then the claims subelement value must be specified as:

   
   <claims><![CDATA[{"branch":"East&West", 
                     "dept":"insurance"}]]></claims> 

   For more information about the CDATA section, see CDATA .

zosconnect_policy > ruleset

Attribute name	Description
file	Data type string Default value Not applicable Description Required. The file name of the rule set. Note: Do not include the path.

zosconnect_services > service

Description:

Required. Defines additional configuration for the service.

Attribute name	Description
adminGroup	Data type string Default value Not applicable Description Optional. Identifies the users that are able to use administrative functions on this service. The value of this attribute can be set to a group name or a comma-separated list of group names, that are defined in the user registry. If globalAdminGroup is also defined under element zosconnect_zosConnectManager, the value that is defined under adminGroup is used. This group takes precedence over the global group except when controlling authorization to the RESTful administration actions to deploy an API, deploy a service, list all APIs, or list all services. See Note 1 and Note 2.
interceptorsRef	Data type string Default value Not applicable Description Optional. Reference to a zosconnect_zosConnectInterceptors element that identifies the set of configured interceptors that are associated with this service. Note: If the service is called by an API, only the interceptors that are configured for that API are processed. Interceptors that are defined for the service are ignored.
invokeGroup	Data type string Default value Not applicable Description Optional. Identifies the users that are able to invoke this service. The value of this attribute can be set to a group name or a comma-separated list of group names, that are defined in the user registry. If globalInvokeGroup is also defined under element zosconnect_zosConnectManager, the value that is defined under invokeGroup is used. See Note 1 and Note 2.
name	Data type string Default value Not applicable Description Required. The name of the service.
property	Data type A list of property elements. Default value Not applicable Description Optional. The property elements define the override properties for the service archive file.
operationsGroup	Data type string Default value Not applicable Description Optional. Identifies the users that are able to perform operations such as starting or stopping this service. The value of this attribute can be set to a group name or a comma-separated list of group names, that are defined in the user registry. If globalOperationsGroup is also defined under element zosconnect_zosConnectManager, the value that is defined under operationsGroup is used. This group takes precedence over the global group except when controlling authorization to the RESTful administration actions to deploy an API, deploy a service, list all APIs, or list all services. See Note 1 and Note 2.
readerGroup	Data type string Default value Not applicable Description Optional. Identifies the users that are able to get information about this service, including the Swagger documentation. The value of this attribute can be set to a group name or a comma-separated list of group names, that are defined in the user registry. If globalReaderGroup is also defined under element zosconnect_zosConnectManager, the value that is defined under readerGroup is used. See Note 1 and Note 2.
requireSecure	Data type boolean Default value Not applicable Description Optional. Require that requests are sent over HTTPS. If the requireSecure attribute is not set, the global setting from the requireSecure attribute on the zosconnect_zosConnectManager element that is referenced is used instead.
requireAuth	Data type boolean Default value Not applicable Description Optional. Require that users specify security credentials to be authenticated and that the authenticated user is authorized under the zosConnectAccess role, in order to access the service. If the requireAuth attribute is not set, the global setting from the requireAuth attribute on the zosconnect_zosConnectManager element is used instead.
runGlobalInterceptors	Data type boolean Default value true Description Optional. Indicates whether global interceptors should run for requests that are associated with this service. Global interceptors are listed in globalInterceptorsRef in the zosconnect_zosConnectManager element. By default, z/OS Connect processes all global and service endpoint-specific interceptors. If the runGlobalInterceptors is set to false, z/OS Connect processes only the set of interceptors that are listed in the interceptorsRef attribute.

Note:

1. If using an LDAP registry, you must specify each LDAP group's distinguished name (DN) with the commas that are escaped with a backslash. for example "cn=employees\,ou=groups\,o=intern\,c=fr, cn=managers\,ou=groups\,o=intern\,c=fr". If specifying multiple groups, the commas separating the groups are not escaped. Specifying LDAP short names is not supported.
2. For information about the authorization levels that are required to perform particular requests, see API provider authorization

zosconnect_services > service > property

Description:

Optional. Properties for the service provider. These values take precedence over equivalent values specified in the service archive file.

Attribute name	Description
name	Data type string Default value Not applicable Description Required. The name of the property. See the following tables for the properties supported for the different service providers. CICS service provider Db2 service project REST client service provider WOLA service provider IMS service provider IBM MQ service provider
value	Data type string Default value Not applicable Description Required. The value of the property

The values that can be specified for the name attribute are specific to the service provider being used by the service. The following attribute name values are supported:

• CICS service provider

  Attribute name	Description
  connectionRef	Reference to a zosconnect_cicsIpicConnection element. Available from version 3.0.81.0. Overrides the CICS IPIC connection reference specified in the service archive file.
  transid	Overrides the transaction ID specified in the service archive file.
  transidUsage	Overrides the transaction ID usage value specified in the service archive file.

• Db2 service project

  Attribute name	Description
  collectionId	Overrides the value of Collection ID that was entered in the project editor.
  connectionRef	Reference to a zosconnect_zosConnectServiceRestClientConnection element. Overrides the value of Connection Reference that was entered in the project editor.

• REST client service provider

  Does not support optional properties.

• WOLA service provider

  tranId

• IMS service provider

  Attribute name	Description
  enforceMinArrayOccurrence	Default value true Description Enforces the minimum number of array occurrences in the input data structure as defined in the copybook. By default, minimum number of array occurrences is enforced.
  escapeOutputControlCharacters	Default value false Description Escapes non-printable control characters, such as tokens or control blocks, in JSON property values as \uNNNN for necessary internal processing, instead of removing them. By default, control characters are omitted, not escaped.
  imsConnectionRef	Default value Not applicable Description Name of the connection profile to use at service invocation. For more information about IMS connection profiles, see IMS connection profiles. This value overrides the connection profile that is specified in the API toolkit during service archive file generation.
  imsDatastoreOverride	Default value Not applicable Description Overrides the IMS datastore name that specifies the IMS subsystem against which to invoke the service.
  imsInteractionRef	Default value Not applicable Description Name of the interaction profile to use at service invocation. For more information about IMS interaction profiles, see IMS interaction profiles. This value overrides the interaction profile that is specified in the API toolkit during service creation.
  imsTranCodeOverride	Default value Not applicable Description Overrides the transaction code that the service invokes at run time.
  initializeInputFields	Default value false Description Initializes fields in the input data structure according to their type if a default is not specified for the field and either the field is omitted from the input interface or the field is included but the respective JSON tag is not received at run time. By default, fields are not initialized.
  omitOutputFieldsByValue	Default value false Description Omits the JSON name-value pair for a non-numeric field from the JSON output message when the data for the field is composed of the same byte value that is repeated throughout, such as all 0x00 or all 0xFF.
  omitOutputFieldsByValueByte	Default value 0x00 Description Specifies the hexadecimal value that all bytes in a non-numeric field must contain to be omitted.
  omitOutputEmptyTags	Default value false Description Omits JSON tags that contain an empty string ("tag":"") from JSON output messages after white space and control characters are processed. By default, empty tags are not omitted.
  trimOutputLeadingWhitespace	Default value false Description Trims the leading white space from JSON property values in the output messages. By default, leading white space is not trimmed.
  trimOutputTrailingWhitespace	Default value true Description Trims trailing white space from JSON property values in output messages. By default, trailing white space is trimmed.

• IBM MQ service provider

  Property name	Description
  connectionFactory	Default value Not applicable Description Defines a JNDI name that is used to locate a connection factory that connects to a z/OS queue manager on the same LPAR as the z/OS Connect Server or on a different LPAR. For more information, see JMS connection factory in the WebSphere Application Server for z/OS Liberty documentation.
  destination	Default value Not applicable Description Defines a JNDI name that is used to locate an IBM MQ queue or topic. For one-way services for sending messages, the queue or topic that messages are put to. For one-way services for receiving messages, this value is the name of the queue where messages are destructively got. For two-way services, this value is the name of the queue where request messages are put. For more information, see the following topics in the WebSphere Application Server for z/OS Liberty documentation: JMS Queue (jmsQueue) if the destination is a queue or JMS Topic (jmsTopic) if the destination is a topic.
  expiry	Default value -1 Description Specifies the expiry time in milliseconds of messages that are sent by the IBM MQ service provider. If set, the value is an integer that describes how long the message is available before it expires. By default, messages do not expire. expiry is equivalent to setting the MQMD Expiry field. Negative values mean that messages never expire. REST clients can override expiry by specifying an ibm-mq-md-expiry HTTP header with a valid 64-bit integer.
  mqmdFormat	Default value Not applicable Description Completes the format field of the MQMD header in messages that are sent by the IBM MQ service provider. Only supported when the language property is specified. If not specified, then messages are sent with a blank format.
  password	Default value Not applicable Description The password that the IBM MQ service provider presents to IBM MQ for authentication and authorization purposes. The value can be stored in clear text or encoded. Typically, the password is encoded. To do so, use the securityUtility shipped with WebSphere Liberty profile. For more information, see securityUtility command in the WebSphere Application Server Liberty documentation. If this property is specified, the userName property must also be specified. If this property is not specified, the password property in the connection factory that is referred to by the connectionFactory property is used. If a password property is specified in both the referenced connection factory and this service property subelement, the service property value is used.
  persistence	Default value false Description Describes the persistence of messages that are sent to the queue referenced by the destination property. If set to true, messages are sent as persistent.
  replyDestination	Default value Not applicable Description Defines a JNDI name that is used to locate a queue that contains response messages for two-way services. If specified, the service is a two-way service. This property is configured in the same way as the destination property. Can be set only if replyDestination is already set in the service archive file.
  replySelection	Default value msgIDToCorrelID Description Defines how a two-way service locates reply messages on the queue that is referenced by the replyDestination property. If replySelection is used with a one-way service, it is ignored. Supported values are: msgIDToCorrelID Reply messages are assumed to be generated with the correlation ID set to the value of the message ID from the request message. The service generates a suitable message selector based on this information. none No mechanism is used to correlate reply messages with request messages. The service gets the first available message on the reply queue. correlIDToCorrelID Reply messages are assumed to be generated with the correlation ID set to the value of the correlation ID from the request message. The service generates a suitable message selector based on this information. If the request message has no correlation ID specified, the service generates a random correlation ID for the request message. For more information, see ibm-mq-md-correlID.
  selector	Default value Not applicable Description Defines a valid JMS message selector that is used to locate messages from the queue that is referenced by the destination attribute. Only valid with one-way services for receiving messages. For more information, see Message selectors in JMS in the IBM MQ documentation. Some characters in the attribute value must be escaped in order to be embedded in server.xml because these special characters cannot be directly used in XML. For example, " escaped with &quot; ' escaped with &apos; < escaped with &lt; > escaped with &gt;
  useCallerPrincipal	Default value Not applicable Description When a request is made to z/OS Connect, the caller authenticates with the z/OS Connect Server. The name of the authenticated principal can be passed onto IBM MQ for authentication and authorization purposes by setting the value of useCallerPrincipal to true. The name of the principal, but no password, is used to connect to IBM MQ. Any values that are specified in the password and userName attributes are ignored.
  userName	Default value Not applicable Description The user name that the IBM MQ service provider presents to IBM MQ for authentication and authorization purposes. If this property is not specified, the userName property in the connection factory that is referred to by the connectionFactory property is used. If a userName property is specified both in the referenced connection factory and this service property subelement, the service property value is used. If this property is specified, the password property must also be specified.
  waitInterval	Default value Not applicable Description Specifies a time, in milliseconds that the IBM MQ service provider waits for messages to arrive on a queue. This property is only valid for two-way services, or one-way services for receiving messages. If replyDestination is set, then waitInterval must be a positive number. If messagingAction=mqget, then waitInterval can be negative, which means that the IBM MQ service provider waits forever until a message is available. If waitInterval is 0, the IBM MQ service provider does not wait.

Sub elements

zosconnect_zosConnectAPIs > zosConnectAPI

Description:

Optional. Defines additional configuration for the API.

Attribute name	Description
adminGroup	Data type string Default value Not applicable Description Optional. Identifies the users that are able to use administrative functions on this API. The value of this attribute can be set to a group name or a comma-separated list of group names, that are defined in the user registry. If globalAdminGroup is also defined under element zosconnect_zosConnectManager, the value that is defined under adminGroup is used. This group takes precedence over the global group except when controlling authorization to the RESTful administration actions to deploy an API, deploy a service, list all APIs, or list all services. See Note 1 and Note 2.
interceptorsRef	Data type string Default value Not applicable Description Optional. Reference to a zosconnect_zosConnectInterceptors element that identifies the set of configured interceptors that are associated with this API. Note: If an API operation is invoked, only the interceptors that are configured for the API are processed. The service-specific interceptor that is configured on the related service is never called.
invokeGroup	Data type string Default value Not applicable Description Optional. Identifies the users that are able to invoke this API. The value of this attribute can be set to a group name or a comma-separated list of group names, that are defined in the user registry. If globalInvokeGroup is also defined under element zosconnect_zosConnectManager, the value that is defined under invokeGroup is used. See Note 1 and Note 2.
name	Data type string Default value Not applicable Description Required. A name of the API.
operationsGroup	Data type string Default value Not applicable Description Optional. Identifies the users that are able to perform operations such as starting or stopping this API. The value of this attribute can be set to a group name or a comma-separated list of group names, that are defined in the user registry. If globalOperationsGroup is also defined under element zosconnect_zosConnectManager, the value that is defined under operationsGroup is used. This group takes precedence over the global group except when controlling authorization to the RESTful administration actions to deploy an API, deploy a service, list all APIs, or list all services. See Note 1 and Note 2.
policyRef	Data type string Default value Not applicable Description Optional. A reference name that identifies the zosconnect_policy element that is active for this API.
readerGroup	Data type string Default value Not applicable Description Optional. Identifies the users that are able to get information about this API, including the Swagger documentation. The value of this attribute can be set to a group name or a comma-separated list of group names, that are defined in the user registry. If globalReaderGroup is also defined under element zosconnect_zosConnectManager, the value that is defined under readerGroup is used. See Note 1 and Note 2.
requireAuth	Data type boolean Default value Not applicable Description Optional. Require that users specify security credentials to be authenticated and that the authenticated user is authorized under the zosConnectAccess role, in order to access the API. If the requireAuth attribute is not set, the global setting from the requireAuth attribute on the zosconnect_zosConnectManager element is used instead.
requireSecure	Data type boolean Default value Not applicable Description Optional. Require that requests are sent over HTTPS. If the requireSecure attribute is not set, the global setting from the requireSecure attribute on the zosconnect_zosConnectManager element is used instead.
runGlobalInterceptors	Data type boolean Default value true Description Optional. Indicates whether global interceptors should run for requests that are associated with this API. Global interceptors are listed in globalInterceptorsRef in the zosconnect_zosConnectManager element. By default, z/OS Connect processes all global and endpoint-specific interceptors. If the runGlobalInterceptors is set to false, z/OS Connect processes only the set of interceptors that are listed in the interceptorsRef attribute.

Note:

1. If you use an LDAP registry, you must specify each LDAP groups distinguished name (DN) with the commas that are escaped that are with a backslash. for example "cn=employees\,ou=groups\,o=intern\,c=fr, cn=managers\,ou=groups\,o=intern\,c=fr". If specifying multiple groups, the commas separating the groups are not escaped. Specifying LDAP short names is not supported.
2. For information about the authorization levels that are required to perform particular requests, see API provider authorization.

 Note 1:  If using an LDAP registry, you must specify each LDAP group's distinguished name (DN) with the commas that are escaped with a backslash. for example "cn=employees\,ou=groups\,o=intern\,c=fr, cn=managers\,ou=groups\,o=intern\,c=fr". If specifying multiple groups, the commas separating the groups are not escaped. Specifying LDAP short names is not supported.

Sub elements

zosconnect_zosConnectServiceRestClient > basicAuth

Description:

Optional. A reference name that identifies the basic authentication data to be used for connecting to a remote REST endpoint.

Attribute name	Description
password	Data type string Reversably encoded password. Default value Not applicable Description Optional. The password of the user under which the request will be routed. The value can be stored in clear text or encoded. Typically, the password is encoded. To do so, use the securityUtility shipped with WebSphere Liberty profile. For more information, see securityUtility command in the WebSphere Application Server Liberty documentation.
userName	Data type string Default value Not applicable Description Optional. The name of the user under which the request will be routed.

Sub elements

zosconnect_zosConnectServiceRestClientConnection > basicAuth

Description:

Optional. A reference name that identifies the basic authentication data to be used for connecting to a remote REST endpoint.

Attribute name	Description
applName	Data type string Default value Not applicable Description The name of the application that requests and uses the PassTickets.
password	Data type string Reversably encoded password Default value Not applicable Description The password of the user under which the request will be routed. The value can be stored in clear text or encoded. Typically, the password is encoded. To do so, use the securityUtility shipped with WebSphere Liberty profile. For more information, see securityUtility command in the WebSphere Application Server Liberty documentation.
userName	Data type string Default value Not applicable Description The name of the user under which the request will be routed.