z/OS Connect (OpenAPI 2) change history

Server code update

• PH62304 - When an API requester JSON key contains blanks, the requester uses only the first word of the key.
• PH62864 - An OAuth 2.0 access token with a lifetime of less than 1 second can be sent to an API endpoint.
• PH62858 - IBM z/OS Connect does not preserve the order of query parameters that are sent as part of an API requester request.

• The Resolving problems chapter has been restructured and updated.

• There are no enhancements or fixes to IBM z/OS Connect (OpenAPI2) V3.0.84.

Server code update

• The version of Liberty that is embedded in IBM z/OS Connect is upgraded to V24.0.0.6. For more information, see What is new in this release of Liberty in the WebSphere Application Server for z/OS Liberty documentation.

• PH59225 - Intermittently the tracking token sent by z/OS Connect does not match the tracking token for the corresponding IMS transaction. This means that the tracking token cannot be used to associate the two parts of the request.

• For IBM Semeru Runtime Certified Edition for z/OS version 11 or later, the OpenJDK implementation of charsets is used. As a result, some character set mappings are different for double-byte character string (DBCS) encoding when using CCSID 935. For more information, see Updating the z/OS Connect Java runtime version.

• The documentation that describes how to obtain a JWT from an authentication server for API requester has been updated to show that access tokens that are not JWTs can also be obtained by using the zosconnect_authToken configuration. For more information, see Calling an authentication server.

Server code update

• IBM z/OS Connect now provides the capability to compress the JSON request body from the z/OS Connect server to the API endpoint using the gzip compression method and to accept a compressed JSON response body from the API endpoint. For more information, see Enabling payload compression

• PH61643 - When z/OS Connect invokes an IMS transaction which fails due to a security issue, messages GMOSR0013E and GMOBA0109E are returned. If a z/OS Connect policy rule is defined to override the imsTranCode property at runtime, the original IMS transaction code is used in message GMOSR0013E instead of the overriding transaction code.

Server code update

• A new CICS® service provider property, connectionRef is available that enables the connection reference specified in a SAR file to be overridden in server.xml. For more information, see CICS service provider property attributes.
• The version of Liberty that is embedded in IBM z/OS Connect is upgraded to V24.0.0.3. For more information, see What is new in this release of Liberty in the WebSphere Application Server for z/OS Liberty documentation.
• The version of the Angel shipped with Liberty 24.0.0.3 is version 22.
• IBM z/OS Connect now supports running with IBM Semeru Runtime Certified Edition for z/OS Java 11 and IBM Semeru Runtime Certified Edition for z/OS Java 17, when using single-byte character set (SBCS) code pages. You should continue to use Java 8 for double-byte character set (DBCS) codepages. For more information, see Updating the z/OS Connect Java runtime version.

• PH60883 - Message CWWKE0701E and a NullPointerException is written for a service during server shutdown.
• PH59224 - When implementing an outbound call from a z/OS Connect server to an external REST API accessed via a proxy server, HTTP status code 407 is returned.
• PH58775 - z/OS Connect data conversion for COBOL packed decimal fields does not report conversion errors.

Server code update

• PH51864 - The z/OS Connect IMS DB service provider establishes more connections than expected.

Server code update

• IBM z/OS Connect V3.0.79 is compatible with API toolkit V3.2.9.14 and V3.3.0.4.

• PH57795 - The value of BAQ_RESPONSE_LEN might not be correctly recorded in the API requester trace with BAQVERBOSE set.
• PH59106 - A z/OS Connect API requester receives HTTP status code 401 when using a cached token.
• PH60040 - Describes a problem that was found in z/OS Connect 3.0.78 and fixed by Liberty APAR PH59374. The Liberty fix is included in z/OS Connect 3.0.79. For more information, see PH59374 on the IBM Support page for WebSphere® Application Server for z/OS Liberty.

Server code update

• The IMS mobile related templates have been updated to contain the configuration examples that were previously in the ims-services.xml, ims-interactions.xml and ims-connections.xml files.
• The version of Liberty that is embedded in IBM z/OS Connect is upgraded to V23.0.0.12. For more information, see What is new in this release of Liberty in the WebSphere Application Server for z/OS Liberty documentation.

• PH56143 - Data transformation fails and message BAQR1138E is reported when a colon is included in an element name.
• PH55092 - z/OS Connect API requester reports a data transformation error while processing the response data when no response schema is defined for the successful completion scenario.
• PH52321 - The imsServiceRegistryHome attribute is no longer used when the imsmobile:imsmobile-2.0 feature is specified. The IBM z/OS Connect IMS service provider configurations are now added to the server.xml. Existing IMS service provider configurations will not be affected by this change.

Server code update

• The IBM z/OS Connect build toolkit (zconbt) is updated to V1.17.

• PH54775 - The build toolkit fails to process decimal numbers if they contain more than 16 digits, including whole numbers and fraction digits, when used in maximum or minimum fields of the JSON schema. The decimal numbers are processed in exponential format.
• PH54311 - IBM z/OS Connect has been changed so that when MQNONE is specified in the MQMD.Format field, the MQFMT_NONE format is used by the generated service in the API Toolkit.

• IBM z/OS Connect V3.0.76 is compatible with API toolkit V3.2.9.14 and V3.3.0.3.

• PH56577 - IBM z/OS Connect stops reading an IMS buffer based on length prefix (LL) when more data exists in the buffer.

Server code update

• The version of Liberty that is embedded in IBM z/OS Connect is upgraded to V23.0.0.9. For more information, see What is new in this release of Liberty in the WebSphere Application Server for z/OS Liberty documentation.

• PH52582 - Message CWWKZ0005E is displayed when the z/OS Connect runtime attempts to start the IMS DB JDBC resource adapter, whether the IMS DB Service Provider is configured or not.

• The Messages chapter has been restructured so that the messages are grouped by message prefix instead of the function that generated them. This grouping makes finding a particular message much easier.

Server code update

• In the SMF 123 subtype 1 V2 and SMF 123 subtype 2 V2 records, the server section version SMF123_SERVER_SECT_VERSION is updated to 2 and the z/OS Connect major and minor feature versions are output in a previously reserved field. The feature version data will not be available in existing products that process these records, unless the product has been updated to support it. For more information, see API provider data from SMF type 123 subtype 1 version 2 records and API requester data from SMF type 123 subtype 2 version 2 records.

• PH51061 - The z/OS Connect file system logger interceptor output does not record the API path or query parameters.

• PH55316 - When defining response code rules in the z/OS Connect API toolkit, the paths of eligible fields may be truncated (missing one or more segments) when the fields appear after nested arrays in the response JSON schema of the mapped z/OS Connect service.

Server code update

• PH55671 - An API requester that cannot be found in the configured location does not cause message BAQR1107W to be written to the server log during startup.

Server code update

• z/OS native support for OpenAPI 3 is now extended to the Simultaneous-Instance license 5655-CE3. This provides users with the ability to run native OpenAPI 3 server instances on z/OS, in addition to existing OpenAPI 2 server instances. For more information, see IBM z/OS Connect capabilities and the IBM z/OS Connect OpenAPI 3 documentation.
• The version of Liberty that is embedded in IBM z/OS Connect is upgraded to V23.0.0.6. For more information, see What is new in this release of Liberty in the WebSphere Application Server for z/OS Liberty documentation.
• The z/OS Connect documentation is updated to include more troubleshooting topics to expedite problem resolution. For more information, see Resolving problems.

• PH53162 - Policy override for Db2 connection is not updating the sslCertsRef attribute.
• PH55468 - The build toolkit does not log errors when a Swagger document contains a Content-Type header parameter.

Server code update

• The z/OS Connect documentation is updated to diagnose performance and OutOfMemory issues. For more information, see Resolving problems.

• PH51032 - Message BAQR7033E "Internal server error" and an NPE in the SMF123SubType1V2Data.finalise method are reported.
• PH47748 - An array definition in Swagger that sets the minItems and maxItems to a value of 1 will cause the build toolkit to generate language structures for an array containing a single item.

• Support for Aqua 3.1 was withdrawn on 24th April 2023. For more information, see End of Support Announcement for Aqua 3.1. Users are encouraged to move to the latest Aqua 3.3 platform which is built on Eclipse V4.23 and Java 11.

• PH55316 - When defining response code rules in the z/OS Connect API toolkit, the paths of eligible fields may be truncated (missing one or more segments) when the fields appear after nested arrays in the response JSON schema of the mapped z/OS Connect service.
• PH54472 - When mapping responses under the z/OS Connect API toolkit there is a response nnn.map file in the project, but no reference to it, so the mapping is not expected to be present.

Server code update

• Access token support for the IBM z/OS Connect API requester is enhanced with the following capabilities:
  • The IBM z/OS Connect server can authenticate with the authentication server by sending the client ID and client secret in separate named HTTP headers. For example, X-IBM-Client-ID and X-IBM-Client-Secret. For more information, see Format of authentication server request for an access token in Calling an authentication server.
  • The z/OS application can set additional custom HTTP headers to send on the request to the authentication server. For more information, see BAQ-TOKEN-CUSTOM-HEADERS-PTR and BAQ-TOKEN-CUSTOM-HEADERS-LEN in zosconnect_authToken access token related parameters.
  • The z/OS application can set additional custom parameters that are substituted into the request body to send on the request to the authentication server. For more information, see BAQ-TOKEN-CUSTOM-PARMS-PTR and BAQ-TOKEN-CUSTOM-PARMS-LEN in zosconnect_authToken access token related parameters.
  • A new optional attribute, tokenRefreshRate on the zosconnect_authToken configuration element, specifies a period of time after which an attempt is made to obtain a new access token even if a non-expired cached access token still exists. For more information, see zosconnect_authToken.

Server code update

• A new value of JWT is added to the responseFormat attribute on the zosconnect_authToken > tokenResponse element. For more information see zosconnect_authToken > tokenResponse in the Reference section.
• The version of Liberty that is embedded in IBM z/OS Connect is upgraded to V23.0.0.3. For more information, see What is new in this release of Liberty in the WebSphere Application Server for z/OS Liberty documentation.
• The IBM z/OS Connect build toolkit (zconbt) is updated to V1.15.

• PH50849 - A ClassCastException is reported if a service property is overridden in the server.xml configuration file.
• PH53008 - When obtaining a third-party JWT from an authentication server, the Content-type header is incorrectly set to "application/json;charset=UTF-8" on the HTTP request to the authentication server. It was also not possible to set the accept header to "application/jwt".

• Support for Aqua 3.1 was withdrawn on 24th April 2023. For more information, see End of Support Announcement for Aqua 3.1. Users are encouraged to move to the latest Aqua 3.3 platform which is built on Eclipse V4.23 and Java 11.

• The z/OS Connect build toolkit (zconbt) is updated to V1.14.

• PH49990 - NullPointerException is reported during the initialization of an interceptor.
• PH52024 - DFHPI9704W messages are written to the z/OS Connect build toolkit log when creating ARAs.
• PH52820 - Message DFHIS1023 Conversation error (code X'062A') is reported on an IPIC connection with IBM z/OS Connect.

• Support for Aqua 3.1 will cease on 24th April 2023. For more information, see End of Support Announcement for Aqua 3.1. Users are encouraged to move to the latest Aqua 3.3 platform which is built on Eclipse V4.23 and Java 11.

• New documentation is available to describe the download and installation of this documentation for offline use. For more information, see Introducing IBM Documentation Offline and IBM z/OS Connect Offline documentation

• IBM z/OS Connect V3.0.67 is compatible with API toolkit V3.0.9.11, V3.2.9.11 and V3.3.0.
• The API toolkit V3.3.0 comes with support for Aqua V3.3.

Server code update

• The version of Liberty that is embedded in IBM z/OS Connect is upgraded to V22.0.0.12. For more information, see What is new in this release of Liberty in the WebSphere Application Server for z/OS Liberty documentation.
• The IBM IBM z/OS Connect documentation is now available offline with the IBM Documentation Offline tool. For more information, see IBM z/OS Connect Offline documentation.

• PH48233 - BAQR1153W HTTP status code 400 is reported when a message greater than 4 KB is sent to an API endpoint.
• PH50403 - APIs expanded in a subdirectory of the server's API directory start returning HTTP status code 404 after updating to V3.0.53.0.
• PH50992 - The IBM z/OS Connect SMF field SMF123_DATETIME_OFFSET reports the wrong time after a DST update.
• PH51002 - An API cannot be opened with the Swagger UI within the IBM z/OS Connect API toolkit.
• PH51224 - Sending an OAuth 2.0 access token to an endpoint failed because it could not be sent in a custom header.

Server code update

• The IBM z/OS Connect build toolkit (zconbt) is updated to V1.13.

• PH51579 - Restoring to IBM z/OS Connect V3.0.63.0 fails with CC 0012.
• PH41342 - An element missing a schema type results in a string insert of "null" in the IBM z/OS Connect build toolkit output.
• PH42794 - Request body not sent when useMIMEType property is set.

Server code update

• The IBM z/OS Connect build toolkit (zconbt) is updated to V1.12.

• PH46455 - The IBM z/OS Connect build toolkit reports an error when the allOf keyword is used in request schema definitions.
• PH51217 - After updating to IBM z/OS Connect V3.0.59.0 truncation of the API response data was seen, when the response ended with an array that did not have data for all occurrences.

Server code update

• The version of Liberty that is embedded in IBM z/OS Connect is upgraded to V22.0.0.9. For more information, see What is new in this release of Liberty in the WebSphere Application Server for z/OS Liberty documentation.

• PH50643 - The values set for attributes connectionTimeout and receiveTimeout on the zosconnect_authorizationServer element are not used with a JWT configuration. This resulted in attempts to retrieve a token from an unresponsive authorization server waiting indefinitely.
• PH45532 - An attempt to stop an IBM z/OS Connect IMS service provider service results in a NullPointerException and the service is not stopped.
• PH39444 - Solidus characters (/) are escaped in the JSON payload response.
  Note: This APAR is canceled. The JSON specification allows a solidus character in a string field to be escaped. If the solidus character is included in a string field of the response, it should be processed on the client side of the JSON response .

Server code update

• PH49704 - IBM z/OS Connect IMS communication stub's call to INQY is too late for monitoring purposes..

Server code update

• The IBM z/OS Connect build toolkit (zconbt) is updated to version 1.11.

• PH48270 - IBM z/OS Connect sends an incorrect absolute time to an API requester application when a date-time string field is converted to an absolute time.
• PH40653 - HTTP status code changes from 400 to 500 when response codes are mapped. APAR PH49245 is a duplicate of this APAR.
• PH43195 - Message BAQR7074E is returned when status code 500 is received from the IMS service provider.
• PH44409 - A NullPointerException is reported when a db2ServiceName is not configured in service.properties.

Server code update

• The IBM z/OS Connect build toolkit (zconbt) is updated to version 1.10.
• The version of Liberty that is embedded in this release of IBM z/OS Connect includes the ifix for Liberty APAR PH44666. For more information, see PH44666 in the IBM Support documentation.

• PH39672 - HTTP status code 500 is returned when an API requester sends an empty request body.

Server code update

• z/OS Connect is enhanced to support workload distribution of requests across a group of CICS regions, by using a single connection reference. Workload distribution is configured with a new zosconnect_cicsConnectionGroup element. Groups can include other groups and the distribution of requests can be weighted. For more information, see CICS IPIC workload distribution.
• z/OS Connect is enhanced with the capability to truncate the last field of the last data structure in an IMS large data structure or IMS message segment input. For more information, see Service-level data conversion customization.

• PH44647 - BAQR1084E: The authorization server token endpoint has an invalid prefix is reported when tokenEndpoint specifies "http".
• PH44223 - A NullPointerException is reported in getMappedResponseHeaderNames() when using the z/OS Connect SPI.

Server code update

• The Audit Interceptor is enhanced to write SMF 123 V2 records at a configured time interval, rather than waiting for the required maximum number of requests to be processed. This is useful in a development or test environment where requests are processed infrequently. For more information, see Configuring the audit interceptor.

  The Audit Interceptor is enhanced to write SMF records when a request fails early in processing, for example, with a 401 authentication error. When enabled, data for the failed request will be written to SMF. For more information, see Configuring the audit interceptor.

• The username associated with the API provider request is now available via the USER_NAME constant of the com.ibm.zosconnect.spi.Data class. For more information, see com.ibm.zosconnect.spi.Data in the Reference section.
• The user identity associated with authentication failures in z/OS Connect is now available in the USER_NAME data of the com.ibm.zosconnect.spi.Data class, the USER_NAME data of the com.ibm.zosconnect.spi.DataRequester class, the SMF123S1_USER_NAME field and the SMF123S2_USER_NAME field. For more information, see com.ibm.zosconnect.spi.Data in the Reference section and API requester data from SMF type 123 subtype 2 version 2 records.
• The IBM z/OS Connect build toolkit (zconbt) is updated to version 1.9.

• PH37930 - The values specified for API requester attributes ignoreMIMETypeCheck or useMIMEType are ignored.
• PH42924 - An API requester returns "errorMessage":"Value not found for single key: <key_name>" after updating z/OS Connect.

Server code update

• BAQSMFX now calculates the difference between timestamps in the SMF 123 records and provides the delta values, as microseconds, in the formatted CSV file. For more information about how to run this sample, see Sample JCL to format SMF records.
• The z/OS Connect messages output by the CICS IPIC HA reconnection mechanism are enhanced. In addition, a new keyword of “local” can be set for the preferredSpecificHost attribute to specify a CICS region that is on the same LPAR as the z/OS Connect server. For more information, see CICS IPIC high availability.
• The IBM z/OS Connect build toolkit (zconbt) is updated to version 1.8.
• The version of Liberty that is embedded in IBM z/OS Connect is upgraded to V22.0.0.3. For more information, see What is new in this release of Liberty in the WebSphere Application Server for z/OS Liberty documentation.

• PH39122 - IGYDS0026-E error reported while compiling the API Requester COBOL application.

Server code update

• z/OS Connect provides a CICS IPIC HA reconnection mechanism to enable automatic re-balancing of HA connections. This capability is enabled by specifying a reconnect interval using the reconnectInterval attribute on the zosconnect_cicsIpicConnection element. Optionally, a preferred CICS region can be specified using the preferredSpecificHost and preferredSpecificPort attributes. For more information, see CICS IPIC high availability.

• PH42084 - Message GMOSR0013E: An unexpected error occurred processing service is reported after updating to V3.0.45.0 or later.

Server code update

• z/OS Connect is enhanced to support the OpenAPI 3.0 specification. This capability is described in new documentation that you can find at https://www.ibm.com/docs/zosconn/zos-connect/3.0 and is called z/OS Connect (OpenAPI 3). To use z/OS Connect to create APIs that conform to the OpenAPI 3.0 specification, you need an Unlimited license.

  This current documentation will continue to describe z/OS Connect support for the OpenAPI 2.0 specification only.

  Note: You can continue to work with OpenAPI 2.0 specification APIs by using this current documentation, but the documentation name is changed from z/OS Connect Enterprise Edition to z/OS Connect (OpenAPI 2).

Server code update

• The IBM z/OS Connect build toolkit (zconbt) is updated to version 1.7.

• PH43757 - Increased CPU, heap growth and 403/500 HTTP status codes at IBM z/OS Connect V3.0.49.0 and later.
• PH37216 - Message BAQM0028E is reported when the MQ provided service provider is replaced with the IBM z/OS Connect MQ service provider.
• PH36337 - The build toolkit failed to create a .ara file and reported an Invalid UTF-8 sequence error on Windows operating systems.

Server code update

• The file system logger is updated to use log4j version 2.17.1.
  Note:

  1. The names of the active and rolled log files have changed. For more information, see Configuring the file system logger interceptor.
  2. The omegamonRequestMonitor-2.0 interceptor is not compatible with this level of IBM z/OS Connect. You must use the omegamonInterceptor-3.0 interceptor with IBM® OMEGAMON®® for JVM, V5.5.0, with PTF UJ06029 applied.
• The version of Liberty that is embedded in IBM z/OS Connect is upgraded to V21.0.0.12. For more information, see What is new in this release of Liberty in the WebSphere Application Server for z/OS Liberty documentation.
  Note:

  Liberty 21.0.0.12 includes a change to the behavior of the openidConnnectClient configuration element for JWT inbound propagation.

  • If the openidConnnectClient element is configured with a trustStoreRef attribute, it is no longer possible to perform a JWT access token inbound propagation if the truststore is not referenced by an ssl repertoire element. For more information, see Configuring JSON Web Token authentication for OpenID Connect in the WebSphere Application Server for z/OS Liberty documentation.

  • If using AT-TLS to connect to a JWK endpoint, SSL configuration is now enforced, so if the openidConnectClient element does not have associated SSL configuration, then the following minimal default SSL configuration is required: <keyStore id="defaultKeyStore" password=“<mypassword>” />

• PH34636 - Error message BAQR7001E is reported when the API archive files resource directory contains subdirectories.
  Note: IBM z/OS Connect processes API archive files from the designated API directory only. After applying the PTFs for this APAR, APIs deployed in a subdirectory of the server's /resources/zosconnect/apis directory are ignored and no warning messages are produced.
• PH35089 - IBM z/OS Connect API provider truncates decimal defined fields.

Server code update

• PH40416 - The affected IBM z/OS Connect API or service is not identified when a data transformation error is encountered.
• PH42080 - IBM z/OS Connect reports the request URL as null when an authorization failure causes HTTP status code 401.

• IBM z/OS Connect API toolkit data transformation messages for CICS, IMS, and MQ service providers have been enhanced to provide additional information according to whether the issue was encountered during API or service invocation.

Server code update

• A new Performance Guidance topic has been added. The information is provided to help you review and tune your systems. The topics also describe some z/OS tools you might consider when diagnosing performance issues. See Performance Guidance.
• The IBM z/OS Connect API requester OAuth 2.0 support is enhanced to support JWT authentication with an authorization server, as an alternative to basic authentication with client credentials. For more information, see Calling an OAuth 2.0 authorization server.
• The OAuth 2.0 resource parameter can now be configured in server.xml for individual API requesters using the oAuthResource attribute. For more information, see apiRequester in the Reference section.

• PH40964 - When policies are configured for REST client connections, a timing window allows authentication details to be overwritten.
• PH41453 - API requester requests cannot reuse JWTs with jti claims because the JWTs are not cached.

Server code update

• The IBM z/OS Connect build toolkit (zconbt) is updated to version 1.6.

• PH32311 - An empty response payload for an API requester application results in BAQ-STATUS-CODE 500.
• PH32855 - The IBM z/OS Connect build toolkit silently ignores a header named "Authorization" from the generated COBOL copybook.
• PH36601 - When running the IBM z/OS Connect build toolkit (zconbt) against a Swagger document to create an artifact file, the following error occurs in the Java™ Virtual Machine (JVM): Exception in thread "main" java.lang.OutOfMemoryError: Requested array size exceeds VMlimitat java.util.ArrayList.<init>(ArrayList.java:153)

Server code update

• The IBM z/OS Connect API requester OAuth 2.0 support is enhanced to enable additional parameters to be sent on the access token request to the authorization server. A resource, an audience, and other additional custom parameters can be specified in the CICS, IMS, or z/OS application for both client credentials and resource owner password credentials grant types. For more information, see Calling an OAuth 2.0 authorization server.
• A new attribute, clientSecretInBody, is added to the zosconnect_oAuthConfig element to allow client credentials to be sent to the authorization server in the request body, instead of the Authorization header, when requesting an OAuth 2.0 access token for API requester. For more information, see zosconnect_oAuthConfig.
• The version of Liberty that is embedded in IBM z/OS Connect is upgraded to V21.0.0.9. For more information, see What is new in this release of Liberty in the WebSphere Application Server for z/OS Liberty documentation.

• PH37316 - The onError=FAIL parameter is not honored when the IBM z/OS Connect configuration files contain errors.

Server code update

• The IBM z/OS Connect server runtime has been enhanced with the capability to register the Open API information of deployed APIs with the Liberty API Discovery feature.
• The IBM z/OS Connect build toolkit (zconbt) is updated to version 1.5.

• PH37006 - The z/OS build toolkit ignores maxLength definitions for JSON string type elements, resulting in PIC X(255) fields.
  Note: After installing the PTF for this APAR, rebuilding API requester archive (.ara) files that were previously built with IBM z/OS Connect build toolkit V1.4, or earlier, will fail if a field defined as "in":"path" does not also specify "required":"true".

Server code update

• IBM z/OS Connect supports both default and binary logging. A new topic explains the performance implications of each type. See Logging and performance.
• The version of Liberty that is embedded in IBM z/OS Connect is upgraded to V21.0.0.6. For more information, see What is new in this release of Liberty in the WebSphere Application Server for z/OS Liberty documentation.
  Note:

  • Liberty V21.0.0.6 introduces the bootstrap property com.ibm.ws.zos.core.angelRequiredServices that you can use to configure the Liberty server with specific angel process services. This is particularly useful when SAFLOG=Y is specified on the angel JCL parameter, as it will only report SAF error messages if the server is not allowed to use the required services. Currently, SAF error messages are issued if a server is not allowed to use authorized services even if they are not required. For more information, see Configuring the Liberty Angel process and z/OS authorized services in the Security section, or Specifying Liberty bootstrap properties and Process types on z/OS in the WebSphere Application Server for z/OS Liberty documentation.
  • The BBGZANGL and BAQZANGL angel started task JCL for IBM z/OS Connect are updated to contain optional lines to enable ARM services for angel processes. For more information, see Activating the automatic restart management (ARM) feature on the angel in the WebSphere Application Server for z/OS Liberty documentation.
  • The default value for the Liberty property maxKeepAliveRequests is changed to -1, which means that the HTTP connection and the underlying socket are never closed due to any number of requests. For more information, see Persistent connections.

• PH24929 - IBM z/OS Connect API requester incorrectly escapes ampersands when property collectionformat is set to multi.
• PH36095 - Message BAQR1133E is issued when a POST is invoked and there is a DELETE operation defined with a similar path.
• PH37100 - Message BAQR1094E: An error response is returned from the authentication server when a JWT is created with status code 201.
• PH37214 - A IBM z/OS Connect Db2® API can be invoked when the associated service is stopped.
• PH37301 - Message BAQR7018E is written to the IBM z/OS Connect server's trace.log file but not the messages.log file.
• PH37755 - IBM z/OS Connect does not include the Bearer scheme in the authorization header when sending a JWT to an API endpoint.
  Note: Applying the PTFs for this APAR causes a change in current behavior for users of the API requester function who call an API secured with a third-party JWT:

  • The HTTP header that contains the JWT on the API request will include the "Bearer" scheme.
  • To use the previous behavior, where the "Bearer" scheme is not present in the HTTP header value, configure attribute useBearerScheme="false" on the zosconnect_authToken element in the server.xml configuration file.
• PH38025 - A field with SYNC specified in a copybook does not result in the expected alignment when processed by a z/OS Connect EE server.

Server code update

• The IBM z/OS Connect runtime and API toolkit have been enhanced with the capability to support CICS services which have their data formatted as bidirectional text (BiDi). Configurations for processing and rendering BiDi text are specified with attributes in a zosconnect_bidiConfig element in server.xml. For more information, see Configuring bidirectional text support.
• For API requester, the caching of OAuth 2.0 access tokens and JWTs has been enhanced to ensure that already expired tokens are not sent to an API endpoint.

• PH36763 - An internal server error is returned and message BAQR1155E is written to trace when a required header is not returned.

Server code update

• You can now configure IBM z/OS Connect to record SMF 123 subtype 2 version 2 records, which provide more detailed information about API requester requests. Do not enable recording of subtype 2 version 2 records until all the products you use to process your SMF records support this new subtype. For more information, see API requester data from SMF type 123 subtype 2 version 2 records.
• You can now format all SMF 123 records as a comma-separated file (CSV) for importing into a desktop spreadsheet application. This new utility is delivered as a load module called BAQSMFX and supersedes BAQS123A. For more information, see Sample JCL to format SMF records.
• The pre-existing SMF sample BAQSMFP, used to format all SMF 123 records to STDOUT, is now delivered as a load module called BAQSMFP. For more information, see Sample JCL to format SMF records.
• The SMF123S1_TRACKING_TOKEN is now padded with spaces (0x40) in the SMF 123 subtype 1 version 2 record instead of nulls (0x00). This change allows much simpler comparison with the OADATA1 fields of the DFHCICS group in the PERFORMANCE class of SMF 110 subtype 1 records. For more information, see API provider data from SMF type 123 subtype 1 version 2 records.
• The IBM z/OS Connect API requester is enhanced to allow you to specify the following attributes:
  • The requireSecure attribute on the zosconnect_apiRequesters element for all API requesters. For more information about the attribute, see zosconnect_apiRequesters
  • The idAssertion attribute on the zosconnect_apiRequesters > apiRequester subelement for individual API requesters. For more information, see apiRequester
• The build toolkit (zconbt) is updated to V1.4.

• PH29630 - Message BAQR7074E The mandatory JSON response property <property_name> is missing. does not identify the invoked API.
• PH29808 - Message DFHPI9740E, reported by the IBM z/OS Connect build toolkit, does not provide enough debug information. When the PTF for this APAR is applied, the build toolkit is updated to Version 1.4.
• PH32736 - Client secret is incorrectly required for OAuth 2.0 token with resource owner password credentials grant type.
• PH33401 - IBM z/OS Connect reports messages BAQR0430W and BAQR0436W from V3.0.39.0 and later for mapped user names.
• PH33807 - The IBM z/OS Connect build toolkit incorrectly detects a reference loop in a Swagger document.
• PH36138 - An IMS API receives an array index out of range error with a COBOL copybook on IBM z/OS Connect V3.0.40.0.
• PH36635 - A data misalignment occurs in memory when a COBOL copybook with multiple REDEFINES with DEPENDING ON verbs is processed.
• PH36717 - Invoking an IMS service with PassTicket failed with PASSWORD/PASSWORD PHRASE NOT AUTHORIZED.

Server code update

• The version of Liberty that is embedded in IBM z/OS Connect is upgraded to V21.0.0.3. For more information, see What is new in this release of Liberty in the WebSphere Application Server for z/OS Liberty documentation.

  Liberty V21.0.0.3 includes a fix that prevents HTTP return code 404 during server start up. Therefore you no longer need to pause your endpoint ports during the start up of your server to prevent HTTP return code 404.

• A new topic shows how you can use z/OS Workload Management (WLM) to classify API requests and the Resource Management Facility (RMF) to measure IBM z/OS Connect API workloads. For more information, see Measuring API workloads with WLM

• PH35756 - IBM z/OS Connect does not start when TCP/IP resolver trace is enabled.

Server code update

• The IBM z/OS Connect API requester is enhanced so you can generate a JWT, which contains the z/OS application asserted user ID as the "sub" (Subject) claim. For more information, see Generating a JWT within IBM z/OS Connect.

• PH25575 - The IBM z/OS Connect runtime and build toolkit cannot support alternative MIME types defined in a Swagger document.
• PH26053 - A NullPointerException is reported when non-JSON strings are configured in the tokenRequest requestBody attribute.
• PH30400 - IBM z/OS Connect incorrectly transforms some numbers with a lot of digits after the decimal point.
• PH32251 - IBM z/OS Connect reports BAQR1150E: An internal error occurred during the HTTP mapping. when running a new API.
• PH31224 - A java.lang.UnsatisfiedLinkError is reported when using PassTickets with both IMS and Db2 in a IBM z/OS Connect server.
  Attention: Users of the IMS database service provider who specify the location of their UTC jars with a resourceAdapter element in server.xml. The resourceAdapter element must be replaced by the imsDbUtcPaths attribute of the zosconnect_dbServices element. For more information, see Configuring user type converter support for IMS database services.

Server code update

• The IBM MQ service provider is enhanced to write the following fields to the Data SPI: TIME_SOR_SENT, TIME_SOR_RECV, SOR_IDENTIFIER, SOR_REFERENCE, and SOR_RESOURCE. This data can be written to SMF 123.1 records and consumed by monitoring interceptors.
• The version of Liberty that is embedded in IBM z/OS Connect is upgraded to V21.0.0.1. For more information, see What is new in this release of Liberty in the WebSphere Application Server for z/OS Liberty documentation.
  Attention: WebSphere Liberty Profile 21.0.0.1 includes the fix for APAR PH34376. This fix corrects the processing of the realm derived from JWT which is used in subsequent RACMAP processing. For more information, see How to configure JWT authentication and APAR PH34376.

• PH31935 - Message BAQR7095E is reported when installing an API which was built using the IBM z/OS Connect build toolkit on z/OS.
• PH33129 - Running ws-schemagen.jar with IBM z/OS Connect configuration files produces messages CWWKG0073W and CWWKG0030E.
• PH33240 - Message BAQR7085E reports that capabilities are not supported for the IBM z/OS Connect MQ service provider.

Server code update

• The RESTful service administration interface is updated to version 1.2.0 and adds version information to services for all service providers. This new version also adds connectionRef, transid, transidUsage, and ccsid information for services that use the CICS service provider. For more information, see Administering services with the administration interface.

• PH30899 - Using JWTs with IBM z/OS Connect API requesters reports an UnsupportedEncodingException with runtimeCodePage=1208.

• PH32226 - An incomplete or empty response is received for a service after re-importing a data structure in the IBM z/OS Connect API toolkit.

Server code update

• The IMS service provider has been enhanced to enable Policy override of the interaction properties imsInteractionTimeout, imsLtermOverrideName, and imsTranExpiration. To learn more about these new policy overrides, see Valid properties for use in policy rules.
• IBM z/OS Connect is enhanced so a policy rule can be configured to perform an action when a specific header is present on an API request, regardless of the value of that header. For more information, see example 5 in Format of a rule set.

• PH30073 - Swagger UI does not prompt for IBM z/OS Connect credentials with CORS request when testing POST method.
  Note:

  The Try It Out function causes a cross-origin (CORS) request to be made from the workstation to the IBM z/OS Connect server. Swagger UI is changed to use browser credentials in CORS requests if an Authorization header value is not manually specified. This change allows the browser to prompt for credentials for CORS requests if the browser supports it and allowCredentials="true" is configured in the cors element of the server.xml configuration file.

  Due to limitations of the Eclipse internal web browser, configure Eclipse to use an external web browser. Click Preferences > General > Web Browser > Use external browser. The following browsers correctly prompt for both Basic Authentication and Client Authentication credentials with the Try It Out function: Internet Explorer 12+, Edge (Windows), Chrome, (Windows, macOS, Linux®), Firefox (Windows, macOS, Linux).

Server code update

• IBM z/OS Connect policies can now alter the following IBM MQ service properties: mqConnectionFactory, mqDestination, and mqReplyDestination. For more information, see Valid properties for use in policy rules.
• New interceptor interfaces are added that enable monitoring support for API requester. Request data is available on the request origin and the target endpoint. Timestamps enable the calculation of the IBM z/OS Connect processing time, the time spent connecting to the endpoint, and the time taken to retrieve access tokens. Monitoring of inflight requests and requests failing early is also enabled. Interceptor writers can take advantage of these new capabilities by implementing the InterceptorRequester interface and optionally the EndpointInterceptor and EarlyFailureInterceptorRequester interfaces. For more information, see Intercepting API requester calls.

• PH29643 - Message BAQR0407W is written after IBM z/OS Connect is updated to version 3.0.30.0 or later.

• PH31252 - The IBM z/OS Connect API toolkit does not remove multi-dimensional array/occurs fields from the response.

Server code update

• The IBM z/OS Connect API toolkit and server runtime have been enhanced to support COBOL and PL/I data structures for IMS messages longer than 32 K that have LL, ZZ, and TRANCODE fields in the request and LL and ZZ fields in the response data structures. To learn more about these options, see Service-level data conversion customization.
• The IBM z/OS Connect API requester CICS communication stub is updated to generate CICS application user trace, which can be enabled by using the trace facilities of the CICS region in which the stub runs. This trace capability is useful for problem determination. For more information, see API requester communications stub trace in Enabling trace in IBM z/OS Connect.

• PH15844 - When HTTP request header Transfer-Encoding: chunked is specified, request data is not passed to the SOR.
• PH25870 - A CICS service remains in stopped state after it is updated by the IBM z/OS Connect RESTful administration PUT method.
• PH26128 - IBM z/OS Connect incorrectly logs message BAQR7004E when installing an API.
• PH26260 - IBM z/OS Connect reports messages BAQR7033E and SRVE8025E when redeploying an IMS service.

• The IBM z/OS Connect API toolkit and server runtime are enhanced to support COBOL and PL/I data structures for IMS messages longer than 32 K that have LL, ZZ, and TRANCODE fields in the request and LL and ZZ fields in the response data structures. To learn more about these options, see Service-level data conversion customization.

Server code update

• When a CICS application is developed to call a RESTful service, the IBM z/OS Connect server that is used to process the request can be chosen at run time within the CICS application. This option allows for splitting of workloads between servers, for example, based on business area. This dynamic routing capability is available for CICS applications only. For more information, see Overriding the URIMAP in a CICS application
• The REST client service provider that is supplied with IBM z/OS Connect to connect to an HTTP endpoint such as a Db2 native REST service, has been enhanced to provide improved performance.

• PH27287 - IBM z/OS Connect reports a COBOL parsing error caused by a J2C COBOL importer defect.

Server code update

• IBM z/OS Connect policies can now alter the following Db2 service properties db2ConnectionRef, and db2CollectionID. For more information, see Valid properties for use in policy rules.

• PH15594 IBM z/OS Connect and IMS Connect encounter issues when a session connected via a persistent socket drops or is canceled.
• PH26697 The IBM z/OS Connect IMS database service provider causes a NullPointerException in method sqlResourceAdapter.
• PH26836 The IBM z/OS Connect build toolkit reports a NullPointerException while processing the security field of a swagger document.
• PH25101 An ephemeral port listening on 127.0.0.1 is opened when a IBM z/OS Connect server is started.
  Attention: Installing the PTF for this APAR will change the default behavior of IBM z/OS Connect to not open the Liberty command listener port. If required, the Liberty command listener port can be specified in the server's bootstrap.properties. See APAR PH25101 for details.

• PH26129 - The IBM z/OS Connect API toolkit does not copy business descriptions specified for fields to the generated Swagger file.

Server code update

• The text of messages BAQR0417W and BAQR0418W has been updated. For more information, see IBM z/OS Connect Runtime Messages.

• PH21761 A CICS region reports SOS DFHSM0133 WBSETBUF when IBM z/OS Connect requester is in use.
• PH25345 Passing user credentials in the request body to the authentication server to obtain a JWT causes a NPE in IBM z/OS Connect.
• PH21819 IBM z/OS Connect sets some CORS headers automatically.
  Attention: When this fix is applied, additional CORS configuration is required in server.xml to enable connections from the IBM z/OS Connect API toolkit and JavaScript clients. For more information, see Configuring Cross-Origin Resource Sharing on a z/OS Connect (OpenAPI 2) Server

• PH25185 The Authorization header is not present in the swagger.json when there is a slash before the query parameters.
• PH25451 Inconsistent swagger is generated by the IBM z/OS Connect API toolkit when creating a multi-path API.

Server code update

• IBM z/OS Connect has been enhanced with the capability to expose service fields as OpenAPI 2.0 Specification compliant dates. Specifying host date patterns defines how date values are represented in system of record (SOR) fields, and enables conversion between SOR date values and OpenAPI 2.0 compliant date values. For more information, see Defining Date fields.
• The version of Liberty that is embedded in IBM z/OS Connect is upgraded to V20.0.0.6. For more information, see What is new in this release of Liberty in the WebSphere Application Server for z/OS Liberty documentation.

• PH10474 Generating API requesters for PL/I and COBOL using the same swagger results in duplicate API name.
• PH17588 IBM z/OS Connect reports an FFDC event when processing an API requester status code that has no mapping defined.

• The API toolkit has been enhanced to support the specification of API contact information in the generated OpenAPI 2.0 documentation. For more information, see Defining your APIs with the z/OS Connect EE API toolkit.

Server code update

• IBM z/OS Connect has been enhanced to support the use of PassTicket authentication for IMS services. Using PassTickets allows for IBM z/OS Connect to enable SAF authentication for IMS without access to the SAF password. For more information, see Configuring PassTicket support for IMS services.

• PH15192 The IMS service provider causes message CWYBS0497E The resource bundle locale en_us cannot be loaded when processing DFS error.
• PH21070 Message BAQR0558E is reported when a message greater than 4KB in length is sent to Db2.
• PH21577 There is inconsistent behavior between deploying IBM z/OS Connect .aar or .ara files and .sar files in an HA environment.
• PH21965 Timeouts are reported when multiple requests are sent via the IBM z/OS Connect IMS service provider Keyring.
• PH23181 NullPointerExceptions are reported with IBM z/OS Connect IMS service provider when pinging IMS Connect.
• PH23267 Message BAQR1143E Internal server error reported when changing the status of API requesters.
• PH24239 A NullPointerException is reported when an incorrect PSB name is supplied with the IMS DB service provider.
• PH24563 A NullPointerException is reported in the IMS database service provider setResourceFactoryRef method.
• PH24608 The build timestamp of the IMS service provider is not reported correctly.
• PH24677 The IBM z/OS Connect build toolkit zconbt reports different version numbers depending on how it is run.

Server code update

• The IBM MQ service provider with IBM z/OS Connect is enhanced to provide advanced data transformation options for IBM MQ services, and the capability to send and receive IBM MQ messages up to 100MB in length for services that were created with the API toolkit. Services created with the build toolkit are limited to a message size of 32KB. For more information, see Create a two-way IBM MQ service.
• IBM z/OS Connect is enhanced to allow users to specify a custom CCSID when creating a CICS service. To use the custom CCSID, you implement your own CharsetProvider and Charset classes to extend the Java Runtime Environment (JRE). For more information, see How to specify a custom CCSID for a CICS service.
• The version of Liberty that is embedded in IBM z/OS Connect is upgraded to V20.0.0.3. For more information, see What is new in this release of Liberty in the WebSphere Application Server for z/OS Liberty documentation.

• PH22476 The order of fields in the JSON response is not preserved by the IMS service provider.

• The IBM z/OS Connect API toolkit is enhanced to support the creation of IBM MQ services in IBM z/OS Connect service projects using the service project editor. For more information, see Create a two-way IBM MQ service.

Server code update

• IBM z/OS Connect has been enhanced to support the creation of IMS database services. IMS database services are created in the API toolkit by specifying IMS database connection information, an IMS database name, and SQL query. For more information, see Using the IMS database service provider.

• PH22959 The API_SERVICE_NAME field in SMF 123 subtype 1 V1 records always contains the service name.
• PH18222 When an API is deleted from the file system, the API cannot be redeployed to another IBM z/OS Connect server sharing the same zFS.
• PH16762 Message BAQR7004E is written when an API is updated using the RESTful administration interface.

• The API toolkit is enhanced to support the creation of IMS database services by specifying IMS database connection information, an IMS database name, and SQL query. For more information, see Using the IMS DB Service provider.

• PH21858 PICTURE '999V99' fields in PL/I structures are imported as CHAR fields by the IBM z/OS Connect API toolkit.

Server code update

• You can now configure IBM z/OS Connect to record SMF 123 subtype 1 version 2 records, which provide more detailed information about API provider requests. The version 2 records are not an extension of the version 1 records. Therefore, do not enable recording of version 2 records until all the products you use to process your records support this new version. For more information, see API provider data from SMF type 123 subtype 1 version 2 records.
• Since IBM z/OS Connect V3.0.16.0, a tracking token has been included on every request sent to CICS over IPIC. The tracking token is now moved from the USERCORRDATA field of the CICS task association data to the ODADPTRDATA1 field of the task association data. You must modify any CICS programs that use this field. For more information, see Tracking selected requests. If you are using IBM Z®® APM Connect to monitor IBM z/OS Connect, you must apply the IBM Z APM Connect PTF UJ01628 before upgrading to IBM z/OS Connect V3.0.30.0.
• Both of the communication stubs for the IBM z/OS Connect API requester are updated to set a return code, which is available to COBOL applications in the special variable RETURN-CODE. For more information, see Error handling for API requester calls.
• To ensure that all error messages from the IBM z/OS Connect API requester CICS communication stub can be accommodated in the TD queue, you must ensure that your BAQQ TD queue definition is set with the attributes RECORDSIZE=508 and BLOCKSIZE=512. The CICS BAQAPIR.CSD sample is updated accordingly.
• The build toolkit is enhanced to check the presence of mandatory description fields and to detect errors in the Responses section of the Swagger document when building API requester artifacts. The enhanced build toolkit is V1.2. If you rebuild existing API requester artifacts with the new build toolkit, parsing of the Swagger document might now fail where it previously succeeded. For more information, see The z/OS Connect EE build toolkit
• If you use the build toolkit in your DevOps automation, note that the text of the following messages has changed: BAQB0003, BAQB0022, BAQB0025 and message BAQB0012 has changed from type E to W. For more information, see z/OS Connect EE Build Toolkit Messages.

• PH04288 IBM z/OS Connect API requester returns an incorrect BAQ-STATUS-MESSAGE-LEN value when using the CICS communication stub.
• PH10042 BAQZCBT fails with message JVMCFRE003 bad major version.
• PH10398 Message BAQB0017E Failed to process operation is issued when the + character is used in a property name.
• PH10611 The IBM z/OS Connect build toolkit does not report that the apikey is not supported in the path.
• PH16570 The IBM z/OS Connect build toolkit zconbt completes with code 0 even when some errors or warnings are reported.
• PH16590 The IBM z/OS Connect build toolkit reports "unsupported schema type:" for integer or boolean values.
• PH19390 The z/OS application and IMS API requester communication stub truncates OAuth headers.
• PH19824 Unexpected data is returned to an interceptor when querying HTTP headers.

• URL and DOC links can now be copied from the properties view of APIs and services within the API toolkit so that they can be easily pasted as text.

• URL and DOC links can now be copied from the properties view of APIs and services within the API toolkit so that they can be easily pasted as text.

Server code update

• The version of Liberty that is embedded in IBM z/OS Connect is upgraded to V19.0.0.12. For more information, see What is new in this release of Liberty in the WebSphere Application Server for z/OS Liberty documentation.
• The IBM z/OS Connect API requester is enhanced to allow you to specify the requireAuth attribute on the zosconnect_apiRequesters element for all API requesters. For more information about the attribute, see zosconnect_apiRequesters.

• PH15842 Message BAQR0553E does not give enough information when a connectionRef is defined in a SAR but the relevant connection is not.
• PH20674 Message CWWKE0701E and a Java.lang.NullPointerException are reported in ApiManagerImpl after applying V3.0.28.0.

• The IBM z/OS Connect API toolkit is enhanced to support the creation of Db2 service projects. The service can be defined by importing a Db2 service from the Db2 service manager. For more information, see Creating a Db2 service.

• PH17905 - The API toolkit allows an API with a base path containing only space characters to be deployed.

• The IBM z/OS Connect API toolkit is enhanced to support the creation of Db2 service projects. The service can be defined by importing a Db2 service from the Db2 service manager. For more information, see Creating a Db2 service.

• PH17905 - The API toolkit allows an API with a base path containing only space characters to be deployed.

Server code update

• IBM z/OS Connect API requester is enhanced to support JWT caching. For more information, see API requester calling an API secured with an access token.
• New interceptor interfaces are added that enable monitoring of API requests between IBM z/OS Connect and the system of record, and requests that fail early before interceptors are currently invoked. Interceptor writers can take advantage of these new capabilities by implementing either or both of the new interfaces ServiceProviderInterceptor and EarlyFailureInterceptor. For more information, see Creating a monitoring interceptor
• The credentials stored in a SAF cache can now be cleared by using a new parameter on the modify command. SAF credentials can also be made to expire automatically by setting a new attribute on the zosconnect_authorizationInterceptor configuration element.
• z/OS Connect (OpenAPI 2) Unlimited, V3 delivers a new pricing metric option to clients who might want to enable the deployment of unlimited server instances for a set price. It includes the same features as z/OS Connect (OpenAPI 2) V3. For more information, see Announcement letter 219-467

• PH02075 The IBM z/OS Connect API toolkit fails to deploy AAR files containing clashing variable and fixed elements.
• PH18448 BAQR1145E API endpoint connection error , followed by CEE3500S Not enough storage was available to load module.
• PH18497 Performance issue with API requester ID assertion for user IDs which are in a large number of SAF groups.
• PH16753 IBM z/OS Connect service requests fail with message BAQR0452E after WOLA service archive file update of a COMMAREA service.

Server code update

Server code update

• The version of Liberty that is embedded in IBM z/OS Connect is upgraded to V19.0.0.9. For more information, see What is new in this release of Liberty in the WebSphere Application Server for z/OS Liberty documentation.

• PH15486 - Policy definitions do not modify the IMS transaction code when invoking IMS large data services.

• Support for Java 7 and the IBM SDK and JRE for Java 7 is removed. For more information, see Requirements.

• The IBM z/OS Connect API toolkit has been enhanced with the capability to expose service fields in JSON payloads as a Boolean data type. By defining specific request and response conditions to process true or false values for a given service field, the definition of the underlying COBOL or PL/I application field remains unchanged. For more information, see Defining service fields.
  Note: IBM z/OS Connect Version 3.0.26 or later is required.

• PH15899 - A negative time error is reported when importing a SAR file and then setting the Windows locale to Thai.

• The IBM z/OS Connect API toolkit has been enhanced with the capability to expose service fields in JSON payloads as a Boolean data type. By defining specific request and response conditions to process true or false values for a given service field, the definition of the underlying COBOL or PL/I application field remains unchanged. For more information, see Defining service fields.
  Note: IBM z/OS Connect Version 3.0.26 or later is required.

• PH15899 - A negative time error is reported when importing a SAR file and then setting the Windows locale to Thai.

Server code update

• In API requester, IBM z/OS Connect is enhanced to call an API that is secured with a JSON Web Token (JWT), that is not an OAuth 2.0 token. For more information, see API requester calling an API secured with an access token.
• In API requester, the maximum size of the JSON string field is increased from 32,767 to 16,777,214 bytes. For more information, see the description of the characterVaryingLimit property in The build toolkit properties file.

• PH00006 - Message DFHPI9730E is misleading when a field greater than 32KB is created using the IBM z/OS Connect build toolkit.

  PH15332 - IBM z/OS Connect transformation array counter functionality thread safety issue can cause incorrect values.

  PH16284 - IBM z/OS Connect API requester receives 403-Authorization error when invoking an API configuration to support identity assertion.

• PH15332 - When processing multiple concurrent requests using the array counter functionality that was introduced in IBM z/OS Connect V3.0.23, they could interact causing incorrect values to be used. IBM z/OS Connect transformation array counter functionality thread safety issue can cause incorrect values.

• PH15332 - When processing multiple concurrent requests using the array counter functionality that was introduced in IBM z/OS Connect V3.0.23, they could interact causing incorrect values to be used. IBM z/OS Connect transformation array counter functionality thread safety issue can cause incorrect values.

Server code update

• IBM z/OS Connect supports identity assertion for API requesters. With the identity assertion support, you can invoke an API requester from a z/OS application with an identity that is provided in the application context. For more information, see Identity assertion for API requesters.
• If you use an interceptor to monitor requests, the Data Interface in the IBM z/OS Connect SPI is updated to provide system of record information for the REST and WOLA service providers. In addition, the SAF mapped user identity associated with a request can now be obtained, if one exists. For more information, see com.ibm.zosconnect.spi (z/OS Connect SPI) in the Reference section.
• The REST client service provider now sends the User-Agent HTTP header on requests to identify the client as IBM z/OS Connect with the version number.

• PH14220 - Using IBM z/OS Connect policies to alter the IMS transaction code causes IBM OMEGAMON for JVM on z/OS to report incorrect data.
• PH13803 - An API requester program receives message BAQI0005E after applying the PTF for APAR OA56234.
• PH11435 - Message BAQR0409W does not identify the resource that could not be accessed.

Server code update

• Customers using API requester can now call the BAQCTERM function from their IMS applications to close and clear the cached connection used by IBM z/OS Connect.
  Attention: If you use API requester and cached connections with IMS, you must add a call in your IMS application to close and clear the cached connection. Failing to do this will lead to memory not being reusable until the IMS process terminates.
• The version of Liberty that is embedded in IBM z/OS Connect is upgraded to V19.0.0.6. For more information, see What is new in this release of Liberty in the WebSphere Application Server for z/OS Liberty documentation.

• PH09124 - Class loading issue for com.ibm.jsse2 when enabling an AT-TLS connection for the IMS service provider.
• PH09275 - IBM z/OS Connect does not correctly apply updates to zosConnectAPI sub elements.
• PH11409 - An API or service request with a Accept-Encoding:gzip,deflate header fails with HTTP response code 500 and message BAQR0429W.
• PH12685 - A monitoring interceptor throws a NullPointerException for an unauthorized IBM z/OS Connect user ID.

• The API toolkit is enhanced to allow numeric service fields to be defined as counters for fixed and variable-length arrays. These array counters are used to optimize both the necessary service data required for an API request, as well as the JSON payload issued from an API response. To learn more about array counters, see Defining service fields.
  Note: Check compatibility for this feature in Capabilities compatibility.

• The API toolkit is enhanced to allow numeric service fields to be defined as counters for fixed and variable-length arrays. These array counters are used to optimize both the necessary service data required for an API request, as well as the JSON payload issued from an API response. To learn more about array counters, see Defining service fields.

Server code update

• PH11690 - Calling a non-existent service causes an FFDC record to be written for each service called.
• PH09188 - The IBM z/OS Connect built toolkit creates an invalid service archive file on z/OS.
• PH08996 - Message DFS064 does not provide enough information to identify the cause of the problem.

• PH11166 - Existing CICS and IMS data structures cannot be re-imported using the IBM z/OS Connect API toolkit.
• PH12148 - Using Microsoft Windows Group Policies to customize the Internet Explorer UserAgent string results in an unsupported configuration for Swagger UI.

• PH11166 - Existing CICS and IMS data structures cannot be re-imported using the IBM z/OS Connect API toolkit.
• PH12148 - Using Microsoft Windows Group Policies to customize the Internet Explorer UserAgent string results in an unsupported configuration for Swagger UI.

Server code update

• The IBM MQ service provider is now built into the IBM z/OS Connect server, so you do not need to copy it from an IBM MQ installation data set. The new IBM MQ service provider adds support for generating service archive files with the Build Toolkit. The resulting .sar files can then be deployed directly to the IBM z/OS Connect server. For more information, see Using the IBM MQ service provider.
• The Security section of the IBM Knowledge Centre has been enhanced for API requesters to provide more information about the security methods supported by IBM z/OS Connect. The new content provides more conceptual information that will help you to choose the most suitable configuration for your installation. For more information, see Securing IBM z/OS Connect resources.

• PH08317 - IBM z/OS Connect does not provide sufficient diagnostic information for Db2 RESTful service failures.
• PH08248 - When an .ara file was updated on the file system, IBM z/OS Connect did not check whether the updated .ara file was a duplicate of an API requester already loaded into the IBM z/OS Connect server's memory. This resulted in the API requester in the IBM z/OS Connect server's memory being corrupted.
• PH08140 - IBM z/OS Connect build toolkit reports a "main" java.lang.StackOverflowError.
• PH07028 - IBM z/OS Connect API requester calls are repeated after a timeout failure.
• PH05927 - The ws-schemagen.jar tool generates an incorrect schema for a IBM z/OS Connect installation.

• PH09920 - The IMS service provider does not support space delimited IMS transaction codes which are less than 8 bytes in length. A new API toolkit option, Space delimited, is added to the Service Editor to allow space delimited IMS transaction codes to be defined.
• PH10952 - The Swagger UI "Try it out!" function in the API toolkit returns cached data from the browser if parameters are not changed between function calls.

Server code update

• A new capability is available that enables monitoring products to implement selective tracking of IBM z/OS Connect requests in the System of Record that processes the request. This capability is currently limited to API provider requests that are sent to CICS and IMS systems. To take advantage of this capability, interceptor writers must implement the new TrackingInterceptor interface. For more information, see Tracking selected requests.
• Multiple group names can now be specified for the invoke, operations and reader authorization groups. This enhancement applies to both the global authorization attributes on the zosconnect_zosConnectManager element, as well as for specific authorization attributes on the zosconnect_zosConnectAPIs > zosConnectAPI, zosconnect_services > service, zosconnect_zosConnectService and zosconnect_apiRequesters > apiRequester elements. Multiple group names were already supported for the administration authorization groups. See Configuration elements.
  Important: If you upgrade to 3.0.20.0 and you are currently using the Authorization interceptor with an LDAP registry, even if you do not use multiple groups, you must change the values of admin, invoke, operations, and reader group attributes to escape the commas in LDAP group names.

• PI97411 - Specifying JSON-SCHEMA-CODEPAGE=UTF-8 corrupts the JSON schemas in generated SAR files.
• PH06013 - globalAdminGroup and adminGroup attributes do not work when an LDAP registry is specified.

• PH10225 - SAR files containing double byte characters cannot be imported into the API toolkit.
• PH09240 - Using the IBM z/OS Connect API toolkit with invalid credentials causes the user ID to be revoked unexpectedly.
• PH07557 - The JSON RESPONSESCHEMA reported by DB2® service DISCOVER is incorrect.

Server code update

• PH08209 - Adds support for CICS 5.5 to WebSphere Optimized Local Adapters.

• PH08772 - When the API toolkit is installed into IBM Developer for z Systems® (IDz), "project xx not open" errors are logged by the IBM z/OS Connect project builders.

Server code update

• Diagnostics in the IMS or z/OS applications stub is improved with the addition of new messages and trace information. For more information, see Error handling for API requester calls.
• The Security section of this IBM Knowledge Center is extensively rewritten to provide more information about the supported security methods when IBM z/OS Connect is used as an API provider. The new content provides more conceptual information and improved samples that helps you to choose the most suitable configuration for your installation. See Securing IBM z/OS Connect resources.
• When interceptors that are defined globally or specifically for APIs or services, are activated and deactivated, messages are now written to the messages.log file to provide verification of interceptor configuration.

• PH00662 - Message BAQI0004E is received in response to an API requester call from an IMS or z/OS application.
• PH00704 - Unhelpful messages are issued by the IBM z/OS Connect API requester communication stub for IMS and z/OS applications.
• PH03346 - Failed updates to an API can cause the .aar file to be deleted from the IBM z/OS Connect server.
• PH03436 - A message "Retrieving network security from interaction spec" is written to the messages.log for each IMS SP request.
• PH04711 - A GMOMW0005E data conversion error message is reported for a field that is defined as PIC V9(8) by IBM z/OS Connect.
• PH05135 - The IBM z/OS Connect build toolkit, zconbt, reports BAQB0038E: Unexpected error has occurred during an .aar build: No space left on device.
• PH08237 - A IBM z/OS Connect API requester application received return code BAQ-SUCCESS when the request was not successful.
• Resolution of memory problems in the IBM z/OS Connect API requester communication stub for IMS and z/OS applications.

• PH03342 - An API created with invalid duplicate paths using API toolkit earlier than V3.0.5.1 is deployed despite reported errors.
• PH04314 - The IBM z/OS Connect API toolkit allows the user to set a default value for the response service interface.

Server code update

• The version of Liberty that is embedded in IBM z/OS Connect is upgraded to V18.0.0.4. For more information, see What is new in this release of Liberty in the WebSphere Application Server for z/OS Liberty documentation.

• PH00368 - The IBM z/OS Connect build toolkit generates copybooks with illegal nesting levels.
• PH03485 - The IBM z/OS Connect build toolkit generates API archives with COBOL data structure field names that end with hyphens.
• PH05307 - Message BAQR1140E is written when a IBM z/OS Connect RESTful API with OAuth configured is invoked.
• PH06095 - An API passes index value array fields but the program receives spaces.

Server code update

• The format of DateTime output of the file system logger has been corrected to give the time in 24-hour rather than 12-hour format, and the precision is extended to include milliseconds. For more information, see Configuring the file system logger interceptor.
• The Data SPI that provides request-specific data to both interceptors and services, is enhanced to provide additional data.

  API, service, and administration requests are now clearly distinguished. Timestamps enable the calculation of the IBM z/OS Connect processing time and the time spent connecting to the system of record. Other information now available includes data about the system of record when using the CICS or IMS service provider and the HTTP response code. In addition, a unique correlator is sent on each request to CICS and IMS systems to enable monitoring products to track IBM z/OS Connect requests.

  For more information, see IBM z/OS Connect SPI Javadoc in the Reference section.

• The Security Overview topic in the IBM Documentation has been rewritten to provide more information useful to solution architects and security administrators. See Overview of IBM z/OS Connect security.
• The IBM Documentation has a new section to provide information about improving the performance of IBM z/OS Connect servers, APIs and services. See Performance considerations.

• PH04997 - Adding the zosLocalAdapters-1.0 feature to the IBM z/OS Connect server configuration causes message CWWKE0701E.
• PH05806 - IBM z/OS Connect service specific interceptors are not used for some administration options.
• PH06538 - Messages BAQR7057E and BAQR7033E are written when deploying an API with the updated API toolkit V3.0.6.0.

• PH07327 - Authorization interceptors do not correctly handle RACF® reader group which results in message BAQR0428W being written.

• The API toolkit is enhanced to allow the definition of multiple response codes for an API operation. Rules that are specified for each response code are used to determine the HTTP status code, and unique response mapping, that are returned in the HTTP response. For more information, see How to define multiple response codes

  Support for the multiple response codes capability provided in this release requires V3.0.16 of the z/OS Connect EE server runtime. If you plan on upgrading the API toolkit to V3.0.6, ensure that you also upgrade the z/OS Connect EE server runtime to V3.0.16.

• PH03360 - A blank path prevents Swagger from working in the API toolkit Swagger UI.

Server code update

• IBM z/OS Connect now supports identity propagation over REST to Db2 when you use a RACF PassTicket to propagate the SAF ID and have it reauthenticated in the System of Record (SoR). For more information, see Configuring PassTicket support for Db2 RESTful services.

• PI98283 - IBM z/OS Connect setting preserveJsonObjectPayloadOrder="true" is not honored for APIs.
• PH04287 - IBM z/OS Connect API requester archives (ARAs) are not loaded and applications receive message BAQR1131E.
• PH04600 - IBM z/OS Connect message BAQR1106E <filename> is incomplete. Missing file: api//POST/mapping.xml is issued.

Server code update

• The RESTful administration interface for API requesters is enhanced to add the POST, PUT, and DELETE methods to support API requester deployment, API requester update, and API requester removal. For more information, see How to use the RESTful administration interface to manage API requesters.
• The version of Liberty that is embedded in IBM z/OS Connect is upgraded to V18.0.0.3. For more information, see What is new in this release of Liberty in the WebSphere Application Server for z/OS Liberty documentation.
• When services and APIs are deployed, a compatibility check is made to ensure that the capabilities of the service or API are compatible with the current release of the IBM z/OS Connect runtime. Messages BAQR7085E and BAQR7086E are issued if a compatibility issue is found.

• PI95793 - Services cannot be displayed via HTTP when requireSecure="true" is set on one of the zosconnect_zosConnectService definitions.
• PH02634 - Message BAQR0666E is reported on startup when IPIC connections to CICS over SSL are in use.
• PH02652 - Base64 encoded basic auth data is present in IBM z/OS Connect trace.
• PH04052 - Intermittently, no response is received when using IBM z/OS Connect API requester from a CICS transaction.

Server code update

• PI90297 - When a SAR file causes a problem in the IBM z/OS Connect SAR loader, the loader stops, preventing further attempts to load SAR files. As a result, services cannot be displayed by the IBM z/OS Connect API toolkit nor can they be started.

Server code update

• PI99540 - A CICS service provider service does not return a response if the CICS container is deleted and added again.
• PI92644 - IBM z/OS Connect reports a NullPointerException on SAR update when multiple zosconnect_services elements are defined.

• PI93123 - The payload on a request is corrupted because IBM z/OS Connect generates an incorrect length field used in the schema.

Server code update

• IBM z/OS Connect policies can now be applied to specific APIs. You define the policy to use in the zosconnectAPI element of the configuration file. For more information, see Configuring IBM z/OS Connect policies
• Server templates now use setUTF8ResponseEncoding="true" on the server configuration file element zosconnect_zosConnectManager to set the response character encoding to UTF-8 for newly created server instances. The default setting has not changed, so existing servers are not affected.
• The version of Liberty that is embedded in IBM z/OS Connect is upgraded to V18.0.0.2. For more information, see What is new in this release of Liberty in the WebSphere Application Server for z/OS Liberty documentation.
  Note: Liberty V18.0.0.2 is only compatible with the Angel process included with Liberty V18.0.0.2. For more information, see Compatibility issue with Liberty V18.0.0.2 and the Angel process.

• PH00403 After many requests are made to BAQCSTUB, message BAQI0902E is issued to indicate insufficient storage.

• Hover help in service interface editor does not highlight the behavior and precedence of field value.
• Service and API project wizards do not check that an API or service name is POSIX portable. Service names, API names, AAR file names, and SAR files names are now all checked to be POSIX portable to prevent z/OS UNIX file system errors.
• Minimum array occurrences for a response are not enforced. A new advanced option Enforce minimum array occurrence is added in the Service Editor to enable validation of minimum array occurrences for response interfaces.
• Meaningful error messages are not provided on copybook import for service project. When importing source that contains COBOL or PL/I data structures, the UI now displays detailed information on structures that were omitted due to having unsupported data types.
• z/OS Connect actions still show for both API and Service options in right-click menu after right-clicking to close a service or API project in Project Explorer. No z/OS Connect actions appears on closed projects now.
• Exporting an API with no services in methods still creates a .aar file on disk.

Server code update

• The communication stub for IMS and other non-CICS z/OS applications is enhanced to support persistent connections to the IBM z/OS Connect server. For more information, see Configuring IMS to access IBM z/OS Connect for API calls and Configuring other z/OS applications to access IBM z/OS Connect for API calls.
• IBM z/OS Connect policies can now alter the following CICS service properties cicsCcsid, cicsConnectionRef, and cicsTransId. For more information, see Valid properties for use in policy rules
• The API Requester is enhanced to support code pages other than 037, to provide code page conversion between the runtime code page and UTF-8. For more information, see Configuring for API requesters.

• PI97371 - URISyntaxException: Illegal character in path is returned if a IBM z/OS Connect service with a space in the name is deployed.

• APAR PI76190: An API exported to an AAR file has a different name when deployed using the REST interface.
• Service information is incorrectly generated when the service project name contains a space.
• API toolkit incorrectly allows APIs with duplicate paths.
• API operations in generated Swagger should be tagged with the API title.
• The API toolkit does not remember the last export location for service archive and API archive.
• The API editor does not remember the last service import location.
• Editors in the API toolkit are not clearly labeled to ease communication. Titles are now added or modified in the service project editor, service interface editor, and API editor. The Overview tab in the service project editor is renamed to Definition to more appropriately reflect the purpose of the page.

Server code update

• Support for array type query parameters, path parameters, and HTTP headers for APIs is added. This feature requires API toolkit V3.0.5 or later. For more information, see Defining and mapping headers, query parameters, or path parameters.
• When a request times out due to the setting of the asyncRequestTimeout attribute on the zosconnect_zosConnectManager element in server.xml, the client now receives a 503 HTTP response code, instead of a 500 HTTP response code, see Configuration elements.
• The CICS service provider is updated so that if a request is timed out during asynchronous processing, the request is terminated and the associated IPIC session is freed. Previously the request would be left to attempt to run to completion in the server. For more information, see Handling request timeouts.
• The requestStateMap parameter that is passed on the invoke method of the com.ibm.zosconnect.spi.Service interface has been updated to contain a new key, IBM_ZOS_CONNECT_TIMEOUT, which contains the time remaining for an asynchronous request. This enables service providers to terminate processing and free resources when a request is timed out.
• The Welcome page of this product documentation has been enhanced with links to the most important topics so you can easily find what you need. We welcome your comments or suggestions for improvement of the documentation. Use the comments box at the base of each page to provide feedback.

• APAR PI90630: Message GMOBA0113E is not written to the IBM z/OS Connect messages.log file.
• APAR PI94737: IBM z/OS Connect does not honor preserveJsonObjectPayloadOrder="true".
• APAR PI97210: A IBM z/OS Connect service receives an incomplete response and message BAQR0404W is reported.

• For request and response message mapping in the mapping editor, the data type for HTTP headers, query parameters, and path parameters can now be set to array. When the data type is set to array, you must specify the array data type (string, integer, boolean or number) and array format, which defines how the values in the parameter or header are delimited. This new feature requires server code V3.0.9 or later. For more information, see Defining and mapping headers, query parameters, or path parameters.

• APAR PI97244: The API toolkit throws an exception when a service project is exported to a service archive (.sar) file from a directory that is different from the current workspace. The API toolkit has been updated to support service project export from a location that is different from the current workspace.
• APAR PI97413: When the base path of an API is specified with an ending slash ("/"), calling the deployed API from the embedded Swagger UI resulted in a BAQR7040E error message stating that the resource is not found. The API toolkit has been updated to not allow an ending slash in the API base path.

Server code update

• The build toolkit is updated to V1.1 to support the generation of the service archive (.sar) file and API archive (.aar) file from project directories created in the API toolkit. After a service project or API project is created or modified in the API toolkit, you can run the build toolkit to generate the service archive or API archive with the project directory as the input. This functionality enables continuous integration and delivery of services and APIs in a DevOps environment. For more information, see DevOps with IBM z/OS Connect.
• The version of Liberty that is embedded in IBM z/OS Connect is upgraded to V18.0.0.1. For more information, see What is new in this release of Liberty in the WebSphere Application Server for z/OS Liberty documentation.
• For users generating artifacts for an API requester, the IBM z/OS Connect build toolkit can now process the allOf keyword in a Swagger file.

This release addresses the following issue:

• PI92773 SAR file changes are not retained on z/OS Connect EE server restart.

This release addresses the following issues:

• Unable to open an API in the Swagger UI when the API name contains special characters.
• The help button in the Import Input or Output Message Data Structures dialog does not link to the correct topic.
• No service deployment icon in the Configuration tab in the service project editor for ease of service deployment.
• The buttons for adding and removing context containers HTTP headers in the Configuration tab for CICS channel services need appropriate tool tips.

Server code update

• CICS service provider services can now be configured to send context containers to CICS programs, providing the program with information about the context in which the service was invoked. The use of context containers can be configured in both the API toolkit and the build toolkit. For more information, see Context containers.

• The IMSPingService service that tests if the IMS service provider is configured correctly for communication with IMS Connect was throwing a NullPointerException. This issue is addressed. For more information about the IMS Ping service, see Verifying server communication with IMS.
• The IBM z/OS Connect server tried to process integer fields even though they were not requested and not sent. This caused a NullPointerException and message BAQR7020E was written to the messages.log.
• Data conversion problems returned an HTTP 500 error with no error details. This fix now returns an HTTP 400® bad request error, with the data conversion error details included in the JSON response. Some GMOMW messages for the data conversion function have been updated to use the correct term service interface instead of transaction message. See GMOMW messages for the updated message texts.

• CICS channel services can now be configured to send context containers to the target CICS program. This includes the ability to name specific HTTP headers to be sent when they are present on the request. Properties in the configuration tab have also been enhanced to use tool tips and provide context sensitive help.

• Tool tips are added to clarify the usage of the Container name and Interface rename fields for CICS channel services.

Server code update

• The version of Liberty that is embedded in IBM z/OS Connect is upgraded to V17.0.0.4. For more information, see What is new in this release of Liberty in the WebSphere Application Server for z/OS Liberty documentation.
• The Scenario section of this IBM Knowledge Center is enhanced to make it easier for you to start using the features of IBM z/OS Connect. See Quick Start Scenarios and Calling an API from a System of Record (SoR).
• You can now use polling or MBeans to dynamically update and activate changes made to rule sets used by policies without needing to restart your server. Alternatively you can use the Refresh Modify command to apply changes to your policies and rules sets. For more information, see Administering IBM z/OS Connect policies.
• IBM z/OS Connect now supports API key authentication. When calling APIs that are protected by API keys, your z/OS application can send the API key credentials through IBM z/OS Connect either in a query string or as a request header. For more information, see API requester calling an API secured with an API key.

• Previously the generated ims-connections.xml file upon initial creation of a server instance based on the imsmobile template contained the connectionTimeout and connectionType attributes that have no effect in IBM z/OS Connect V3. However, if the connectionTimeout attribute was removed from the ims-connections.xml file, a CWWKG0058E error was incorrectly thrown upon server startup, complaining that the required connectionTimeout attribute was missing. These issues are now corrected. The generated ims-connections.xml file no longer contains these two extraneous attributes, and the connectionTimeout attribute is not expected to be present upon server startup.

For service creation, FIXED BINARY and UNSIGNED FIXED BINARY (UBYTE) data types in PL/I were incorrectly converted to a data type of string in the generated JSON schema. They are now correctly converted to the data type of integer. This fix requires server code V3.0.6.

Server code update

• IBM z/OS Connect build toolkit is enhanced to support JSON additional properties that are not explicitly defined in the properties section of a Swagger file. A new attribute additionalPropertiesSize is added in the build toolkit properties file. You can use this attribute to specify the maximum size for each JSON additional property when you use the build toolkit to generate artifacts for an API requester.
• A sample COBOL application that calls out to a REST API through the API requester is provided in the hlq.SBAQSAMP data set. Two versions of the sample application are available: BAQPHBKI (IMS transaction) and BAQPHBKB (z/OS application). These samples are used in the Call an API from an IMS or z/OS application scenario, which provides step-by-step instructions on the required configuration, artifact generation, and client application development.
• IBM z/OS Connect build toolkit has been enhanced for the API Requester to support multidimensional arrays defined in Swagger files.
• The version of Liberty that is embedded in IBM z/OS Connect is upgraded to V17.0.0.3. For more information, see What is new in this release of Liberty in the WebSphere Application Server for z/OS Liberty documentation.

Server code update

• The RESTful service administration interface is updated to version 1.1.0. This new version adds the support for POST, PUT, and DELETE methods to support service deployment, service updates, service status updates, and service removal. You can also retrieve the service request schema and response schema with the GET method by using a URI without the action=getRequestSchema query string. For more information, see Administering services with the administration interface.
• IBM z/OS Connect is enhanced to support OAuth 2.0 to allow a z/OS application to call an API that is protected by OAuth 2.0 on a request endpoint. For more information, see Calling an OAuth 2.0 authorization server.
• By using variable substitution in policy rules, you can override the IMS transaction code (imsTranCode) that the service invokes at run time. For more information, see Valid properties for use in policy rules.

• API toolkit V3.0.3 adds the support for deploying services directly from your service project without having to export the project to a service archive. You can view all deployed services, examine service properties, update a service, and start and stop a service directly from within the API toolkit. Server code V3.0.4 is required.

• You can use CICS IPIC high availability to provide a single point of access from a IBM z/OS Connect server to a cluster of CICS regions via a TCP/IP network. For more information, see CICS IPIC high availability.
• The global admin group and admin group of a specific resource (services/ APIs/ API requesters) are enhanced to support multiple groups. You can set the value of the globalAdminGroup or adminGroup attribute in the server.xml file to a group name list with separating comma. The administration requests that are submitted by a user who belongs to any group listed in globalAdminGroup or adminGroup can be processed.
• You can now use IBM z/OS Connect policies to adjust how an API request is processed in IBM z/OS Connect, based on the HTTP header values sent in by the client. For more information, see Administering IBM z/OS Connect policies.

Empty array elements from service-level data conversion based on the settings in the Advanced Service Data Conversion Options dialog (by clicking Advanced Options in the service project editor in the API toolkit) are now correctly removed from the JSON output. If no valid array elements were converted, the array is completely removed from the JSON. For more information about advanced data conversion options, see Service-level data conversion customization.

This release includes minor fixes, including better user input validation of the value type for CCSID (CICS services) and the maximum length for transaction code (IMS services).

• When customizing service interfaces, you can now use the Code page conversion option in the Edit Field dialog to indicate whether data of the CHAR type should be converted between UTF-8 and the host code page (such as IBM-1140) for the request and response interfaces.
  • By default, for the request interface, the JSON property value is converted from UTF-8 to the host code page prior to being placed in the respective field.
  • By default, for the response interface, the field value is converted from the host code page to UTF-8 prior to being placed in the respective JSON property value.

  This default behavior can be turned off by clearing the Code page conversion option.

• The mapping editor no longer interprets JSON properties of type number as integers when the number type has no fraction digits. The previous behavior was causing incorrect validation where incoming numeric quantities were limited to 10 digits.
• When you right-click a server in the z/OS Connect EE Servers view and select Refresh, the result now returns noticeably faster when you have more than a few deployed APIs.
• The mapping editor now correctly populates Swagger with type information for query parameters, path parameters, and headers that are mapped to float or double type service fields.

• The CICS service provider is enhanced to support distributed identity propagation to CICS during CICS authorization and for subsequent accountability and trace purposes. Distributed identities must be defined in an LDAP user registry and mapped to one or more SAF user IDs. Alternatively, an authenticated SAF user ID associated with the current request, can be passed to CICS for use during CICS authorization. The SAF user ID can originate from basic SAF credentials, an SSL client certificate, or other credential such as a JWT token, associated with A SAF user ID. Distributed identity support requires an IPIC connection that is configured with Userauth=Identify. For more information, see Configuring security for an IPIC connection.
• The IMS service provider is enhanced to support distributed identity propagation to IMS Connect V15 for subsequent accountability and trace purposes. A distributed identity consists of a user ID and a network session ID (or realm). The user ID must be defined in an LDAP user registry, basic registry, or SAF registry. When the IMS service provider detects that the IMS Connect it is connecting to is V15, it sends the distributed identity by default. This distributed identity is not used by IMS for authentication or authorization purposes. For more information, see Configuring distributed identity propagation to IMS.
• A PL/I sample is added to demonstrate how to handle large IMS data structures. The entire set of samples is also enhanced to allow setting and experimenting with different data structure sizes.
  • A sample PL/I transaction program, its copybook, and related utilities and JCLs are added to the SBAQSAMP sample data set.
  • This set of samples is enhanced to allow you to set the size of the data structure that is sent to and received from IMS by changing the number of IO_RECORD array objects in the provided sample JSON documents. The existing COBOL sample is updated to work with this enhancement.
  For more information, see Handling large IMS data structures.
  Note: Three member names for the existing COBOL sample have changed. The letter P in the following member names are removed: BAQLDSP (sample transaction) is now BAQLDS, BAQLDSPC (sample copybook) is now BAQLDSC, and BAQLDSPJ (sample JCL) is now BAQLDSJ. The letter P is used only in members that are for the PL/I sample.
• The API requester is enhanced to support connection pooling in IBM z/OS Connect to improve the efficiency of resource access to the request endpoints. For more information, see Connection pooling.
• The API requester is enhanced to support specifying an additional domain path in a URL for an API that your z/OS applications plan to call. For more information, see Setting the domain base path.
• New features are provided in the IBM z/OS Connect product documentation:
  • With the addition of two new languages, Spanish and Traditional Chinese, the IBM Documentation for IBM z/OS Connect is now translated into 14 languages.
  • Where a code example is provided, you can now click to copy the code into your clipboard.
  • APARs included in this release are listed in the documentation. They include links to the full description of the APAR.

• Fixes for the following APARs are included in this release.
  • PI83974 Message BAQR7019E is returned when a value longer than 10 digits is specified in an API GET request.
  • PI84080 ERROR 400 BAQR7018E: The HTTP request is missing parameter <parm_name>
  • PI84077 IBM z/OS Connect always uses channel JSONCHANNEL with the CICS service provider
  • PI85476 The IBM z/OS Connect IMS SP issues a NullPointerException when requireAuth="false" is set and a service is invoked
  • PI85913 Updates to IMS service provider SARs are not processed
  • PI83974 IBM z/OS Connect writes unnecessary information to SMF

• For the IMS service provider, additional issues are addressed:
  • Setting a transaction code in the imsTranCodeOverride attribute in the server.xml file for an IMS service resulted in a NullPointerException error.

    This issue is addressed. You can now specify the transaction code to invoke at run time by using the imsTranCodeOverride attribute for IMS services in the server.xml file. This transaction code takes precedence over the transaction code that is contained in the service archive, as defined in the z/OS Connect API toolkit during development time. For more information, see Transaction code override precedence.

  • The default value for the imsConnectTimeout property in the IMS interaction profile is changed from 0 (wait indefinitely) to 30,000 milliseconds (30 seconds). This change helps prevent an API call from waiting indefinitely for a transaction call that never returns if the default value for imsConnectTimeout is left as-is, or the property is simply not specified.

• A new service type IMS Large Data Structure Service is added to support importing a program with large data structures into the service interface editor for effective service interface definition.

• API toolkit V3.0.1 addresses the following issues:
  • When COBOL copybooks or full programs or PL/I includes or full programs contain POINTER types, the import wizard does not tolerate POINTER types even though they are not part of the data structure the user selects. For COBOL, the message "POINTER not yet supported" is displayed and the data structure name remains disabled. For PL/I, the message "POINTER not yet supported" is displayed, and the user is allowed to select a structure. However, when the structure is expanded in the service interface editor, a null pointer exception occurs. This issue is addressed, and data structures containing POINTER types are now omitted from the data structure selection, allowing the user to proceed to select the structure to import.
  • PL/I leaf arrays are not converted correctly for REFER statements, with minItems incorrectly set to 1 and maxItems set to 2 in the JSON schema. This issue is addressed. minItems is now set to 0 unless an LBOUND exists for the REFER array, whereas maxItems is always unbounded.
  • PL/I string type leaf arrays are not converted correctly in the maxLength facet in the JSON schema. For example, an array of 5 items of a total of 255 characters, as shown in the following sample, is generate with a maxLength of 1275, when the maxLength should be 255.
    04 String_Array(5) CHARACTER(255)
    This issue is addressed.

• A new feature, API requester, is now available in IBM z/OS Connect. The new API requester feature allows z/OS applications to call REST APIs through IBM z/OS Connect. You can use the build toolkit to generate the required artifacts based on the API description file of the REST API you plan to call. For more information, see z/OS applications to call REST APIs.

• The Remote Systems view is now available in the z/OS Connect EE perspective to ease service deployment. For more information about creating a connection to a remote system, see Creating a connection to a z/OS system (IBM Explorer for z/OS V3.1 product documentation).