Hello Dirk, thanks for the reply.
It's not a solution to limit Tomcat for acces only from localhost because he serves multiple applications.
I thought there would be a setting as HTTPLOCAL to limit access to restxq functions. If not, I will try something session-based, as is used in dba.
Best regards, Ioan