This month, I wish to talk all about RESTful APIs and why they are sooooo cool. At the end I will give you a github link to a German GUIDE DBA Colleague who wrote some fantastic stuff using REST services and SQL to trigger REORGs from Excel… I kid you not!!!
Give it a REST
These beasts arrived in Db2 11 and are basically “one shot wonders” as a REST (Representational State Transfer) service has no “brain” and cannot remember anything. In SQL terms, is one single static SQL statement. This is really called a RESTful API using HTTP GET, PUT, POST and DELETE. Fun factoid to start with: Db2 only supports the POST method and so is really REST and not RESTful! An example REST looks like:
POST https://<host>:<port>/account/update This is a URI (Uniform Resource Identifier). Please remember that just because Db2 only accepts POST it does not mean you cannot run any SQL you like!
What is JSON?
JavaScript Object Notation (JSON) is what is used in all of the payloads. Here’s an example:
{
"account": "1121345",
"lastName": "Boxwell",
"action": "Deposit",
"amount": "€10000.00"
} Data is represented as a series of name/value pairs. This is serialized and passed in with the URI or returned with a response.
I don’t GET it…
Well, actually, GET can be used for “some system related functions”:
https://<host>:<port>/servicesBut what can make RESTful real, is when you use z/OS Connect, as that is 100% RESTful but is out of scope for my newsletter!
Pretty dull, then?
Not actually! The beauty of REST services (giving them their proper name) is that they can execute any static SQL statement *including* stored procedure calls! Try doing that in DSNTEP2 or SPUFI!!! For this reason alone, they are worth looking at!
Special Rules?
Of course, nothing is “normal” in the Db2 for z/OS world, is it?
In Db2 11 we got BIND SERVICE and FREE SERVICE as they are not normal “packages” as we know and love them but special. REBIND PACKAGE worked but EXPLAIN(ONLY) was not possible, the only way to see an access path was to BIND/REBIND completely!
In Db2 12 we got START, STOP and DISPLAY for the RESTSVC to review all of our REST services.
The SQL gets squirreled away in a Db2 pseudo-catalog table called SYSIBM.DSNSERVICE. This data is also the “link” to a real package which, after being bound, can *only* be executed as a service (This is also a security feature.)
With APAR PH34544 we got the RESTSERVICEDEFAULT option added to REBIND PACKAGE which was nice to be able to change the default version from V1.
In Db2 13:
- With APAR PH63990 the EXPLAIN(ONLY) syntax was allowed for REST services allowing access path extraction with no outages.
- With APAR PH54129 the FREE PACKAGE was extended to free inactive REST services. Before this, you had to issue a FREE SERVICE, which freed everything – not just the phased out inactive services.
Any authorized user can then discover and invoke these services using a REST HTTP client. They support a buffer size of up to 2GB for the complete request and reply content as well.
Enable them first!
Make sure you are up to date on IBM Service (use keyword RESTful on your search) and make sure that APARs PI70652, PI98649 are applied. Even better for Db2 13 is PH68057 (UO06137) and all its prereqs to give you a good level. Use the DSNTIJRS job in your SDSNSAMP library to create the aforementioned pseudo-catalog table and its index. Then run the DSNTIJR2 sample job to enable Db2 REST service versioning support, only if you want versioning, of course!
REST while you work!
Versioning enables you to “swap out” a REST service while the old one is still running. Before this, you had an outage as you must first FREE the service and then BIND the new one. Not good for 24×7 shops! It also enables full versioning, of course, so that you can decide which version for which application etc. but I would never walk down that road personally… Too much like micro-management for me. If you need a different SQL or parameter etc. then just create a new REST service!
Authorized to REST?
Naturally, it all must be authorized! You can do this with your local RACF, TOPSECRET or ACF2 system. The defaults supplied for RACF are adding a REST profile to the DSNR resource class. This is purely to allow a user to access Db2 REST services and not the APIs themselves. That is done with either:
- HTTP basic authentication using User ID password, RACF PassTicket etc. all in the HTTP Header in clear text or Base64. Db2 for z/OS then uses the System Authorization Facility (SAF) to authenticate these.
or - Db2 REST Client certificate authentication. This is used if:
1. It is a secure connection to Db2 using HTTPS and AT-TLS.
2. The client certificate is registered with RACF, TOPSECRET or ACF2.
The second approach is the recommended one due to the obvious security concerns of HTTP Header usage! This then requires SECPORT to be set up of course!
Do you trust me?
Here you can, and probably should, start using Trusted Contexts as REST can exploit these and REST services do lend themselves to ROLEs.
Here’s one I prepared earlier…
To save me typing, here’s a direct link to the IBM Docu all about “Creating a Db2 REST service”:
https://www.ibm.com/docs/en/db2-for-zos/13.0.0?topic=services-creating-db2-rest-service
Your answer is in the POST
Then you issue a POST to kick off the REST service. Here, again, is a link to the IBM Docu:
https://www.ibm.com/docs/en/db2-for-zos/13.0.0?topic=services-invoking-db2-rest-service
Of CORS you can…
Bad pun I know… CORS support was rolled out in Db2 13 as well! Up until then this failed, due to the fact that Cross-Origin Resource Sharing (CORS) was not implemented. To get it up and running, you will need APAR PH59837: NEW FUNCTION (Great title huh?) PTF UI96535 applied. You will then need another RACF change, as it introduces a new Resource Class: DSNRAUTH with ACTIVE and RACLISTED. (If you intend to use generic then you must also enable GENERIC). It uses the user id of all your xxxxDDF address spaces for this as it is subsystem-wide and not user-specific. Then you must create one or more RACF resource profiles for the Db2 REST service CORS and Permit the DDF User Id READ access to these just created resource profiles. A quick refresh:
SETROPTS RACLIST(DSNRAUTH) REFRESHand you are done!
If you wish to trace all of this CORS stuff then switch on IFCID 416 Audit Class 12.
Am I in Trouble?
Using these beasts, you will end up with a new list of error codes and messages…
The HTTP world has a few that you need to know:
1xx "Informational" Communicates transfer protocol-level info
2xx "Success" Hooray!
3xx "Redirection" Oh Oh - The client must do something else in order
to complete the request
400 "Bad request" is normally badly formatted input
401 "Unauthorized" The user authentication failed
403 "Forbidden" The user might not have the required permission…
4xx "Client Error" any other 400'er numbers
5xx "Internal Server Error" comes normally with an SQLCODE so you
can work out what has gone wrong!Does my PROFILE look good?
These work brilliantly with system profile tables! Product identifier for example is HTP01010 for non-secure HTTP which you should never use! Better is HTS01010 for HTTPS secure connections.
Look-a-here
DISPLAY RESTSVC by default shows you all the REST services that exist in your Db2 subsystem:
DSNL601I -SD10 DISPLAY RESTSVC REPORT FOLLOWS-
DSNL610I -SD10
---- COLLECTION=MDB2VNEX_TEST
SERVICE VERSION STATUS
SAX_DRILLDOWN_S_O2RTSEXTSH_P_EXCEPTIONS_ANY V1 STARTED*
SAX_DRILLDOWN_S_O2RTSEXTSH_P_EXCEPTIONS_NONE V1 STARTED*
SAX_DRILLDOWN_S_O2RTSEXTSH_P_EXCEPTIONS_ONLY V1 STARTED*
SAX_DRILLDOWN_S_O2RTSEXTSH_P_EXCEPTIONS_VARI V1 STARTED*
ABLE
SAX_OVERVIEW_S_O2RTSEXTSH_P_EXCEPTIONS_ANY V1 STARTED*
SAX_OVERVIEW_S_O2RTSEXTSH_P_EXCEPTIONS_NONE V1 STARTED*
SAX_OVERVIEW_S_O2RTSEXTSH_P_EXCEPTIONS_ONLY V1 STARTED*
SAX_OVERVIEW_S_O2RTSEXTSH_P_EXCEPTIONS_VARIA V1 STARTED*
BLE
SAX_PTF_LEVEL V1 STARTED*
SAX_USECASES_BY_LOCALE_PRODUCT V1 STARTED*
DSNL610I -SD10
---- COLLECTION=MDU_COLL
SERVICE VERSION STATUS
MDUMMY V1 STARTED*
UPD_SAL_3 V1 STARTED*
DSN9022I -SD10 DSNLJDSS 'DISPLAY RESTSVC' NORMAL COMPLETION We have a few on my test system! A little heads up about this command, is that if you are running with data sharing then it is executed on all the remote sites under the SYSOPR authorization id! This is also shown in IFCID 90 “Command Trace” as being correlation ID “016.TLPKN5F” – This requires that a SYSOPR Id is defined at the remote sites.
What can You do with it all?
As I mentioned right at the very start of this blog, at the last German Db2 Guide, a DBA did a great presentation all about bundling all this knowledge, including a bunch of stored procedures to allow, for example, an Excel table entry to trigger a REORG on the host. All great stuff and available from github with a ton of excellent documentation. Something for the weekend I would say!
Here’s the github link to Veit Blaeser’s code:
https://github.com/VauBe/Db2_UPS
Great stuff indeed!
TTFN,
Roy Boxwell











