Apply service level authorization to API path requests

Whilst this requirement is valid, based on our current plans and priorities for IBM z/OS Connect Enterprise Edition, it is not likely that this could be implemented in the next 12 months. Correspondingly this requirement is being declined at this point. The requirement will be kept in the RFE system and might be reassessed in the future. You also have an opportunity to resubmit in twelve months time if you wish it to be reconsidered then.

z/OS Connect should provide method level security like a regular JavaEE application i.e. you can setup the in web.xml to control the method level access (e.g. a regular user can GET but only administrator can PUT).

The question of whether API authorization is to be decoupled from service authorization is dependent on how APIs and services will be coupled more generally in the future. Because this coupling exists at the deployment level I assumed that it would apply at the authorization level. If security for APIs and services is to be decoupled, then I think that API authorization needs to be provided at the operation level i.e HTTP method/URI combination. This would be consistent with API Connect.

If there was method-level granularity for security of APIs, would that be sufficient to achieve the desired result? e.g. the ability to allow user X to invoke API Y method GET but not method POST ? These would operate independently of the service definitions and their security profiles.