If setting up a BASIC_AUTH header on client side is the main issues I think it should be possible to solve this in an additional `ContainerRequestFilter` for the IVY Rest stack.
Currently auth and session handling is done in : `ch.ivyteam.ivy.webserver.internal.rest.security.ApplicationSessionRequestFilter`
![alt text][1]
The request filter comes with a priority (in this case: 1'000). Therefore, it should be possible to provide an additional request filter that can change the request just before the default filter is executed. You Your custom filter could compensate the inabilities of the real client > transform form params into http_basic auth headers.
To setup your custom filter as general extension for the ivyEngine REST stack you have to add the `@Provider` annotation on the class body. See https://answers.axonivy.com/questions/3412/how-can-i-use-jax-rs-containerrequestfilter-responsefilter-for-my-jax-rs-resources
...just an idea: I did not check it with an example.
PS: be aware that big improvements from 7.4 REST stack have been ported back to the 7.0 LTS train recently. So ensure that you work with the latest hotfix version to benefit of the extension capabilities mentioned here.
[1]: https://answers.axonivy.com/upfiles/appSessionFilter.png
