Request policies are applied to the request flow and are enforced between the request being received from a client and the request being forwarded to the backend service endpoint. Any number of policies can be defined but policies execute in order, with the uppermost policy first, followed by the next policy, and so on, until the request is either rejected or forwarded to the backend service if all policy conditions are met. The service request URL is where requests meeting the policy criteria are sent, that is, the service endpoint:

Response policies behave in a similar manner but apply from the point where the service endpoint responds up to the point where the response is sent back to the consumer from the API. The response from the backend service is always the first entry in an outbound flow....