I have a test REST service in BPM on cloud which I managed to call it using postman without any authentication 

https://xyz.bpm.ibmcloud.com/dba/dev/automationservices/rest/DS/REST%20Service/test

How to protect custom REST Service using basic authentication?

Hi Ali,

you likely did not invoke it without any authentication. postman is a browser plugin and will send all your cookies to the service.

If your user has a password, basic auth may just work. There is also a concept of system accounts. Please search documentation for "fid" or "functional id".

I also recommend using curl instead of postman to be sure what exactly your client is sending.

HTH 
Jens