You can set global, default web services credentials at build time via the following properties set in your Bootstrap.properties file:
The above credentials must exist on the Curam 'Users' table, must be enabled, and should be assigned the appropriate security role.
Default credentials can streamline your development and testing processes, but should not be used in a production environment when working with sensitive data and/or processes.
Once a BPO has been assigned to a webservice server it is callable by anybody as a web service without any authentication. All web service calls are automatically logged in and invoked using default credentials. The default user, WEBSVCS, automatically gets permission to invoke all methods of a class which is assigned to a webservice server.
Therefore caution is advised when making a class visible as a web service.