the JSON format is dictated by DB2, not by API design best practices. - **Basic authentication only** (no OAuth2 without an external gateway). - **No rate limiting** built in. - **No versioning** beyond the service version number.