Some things to consider while we are designing, creating, and consuming APIs 

Use application meaningful names or an extendable convention for connection reference names.

Authentication - Identifying who or what is requesting access

 Mutual Authentication using Transport Layer Security (TLS), 

 Third-Party Tokens 

Data Integrity - Ensuring that the message has not been altered in transit 

Encryption -  Ensuring the confidentiality of the message in transit  by TLS (encrypting messages and using a digital signature) 

Authorization - Controlling access by verifying that the authenticated identity is authorized to access z/OS Connect
also Is the authenticated identity authorized to access a specific API, Services, etc. 

Examples of HTTP and HTTPS authentication protocols 

Basic authentication with HTTP protocol 

<zosconnect_endpointConnection id="cicsAPI" host="http://sunshine.com" port="9080" authenticationConfigRef="myAuthData" /> 

<zosconnect_authData id="myAuthData" user=“appUSER” password=“password”/> 

TLS with HTTPS protocol

<zosconnect_endpointConnection id=“cicsAPI” host="https://sunshine.com" port="9443" 

authenticationConfigRef="myAuthData" sslCertsRef="OutboundSSLSettings" /> 

<zosconnect_authData id="myAuthData" user=“appUSER” password=“password”/>