Azure API Gateway Policy - azure-api-management

Question

I would like to add query parameter for the request by using response from my auth service. These are the example:
<policies>
<inbound>
<!-- Extract Token from Authorization header parameter -->
<set-variable name="token" value="#(context.Request.Headers.GetValueOrDefault("Authorization","JWT").Split(' ').Last())" />
<!-- Send request to Token Server to validate token (see RFC 7662) -->
<send-request mode="new" response-variable-name="tokenstate" timeout="20" ignore-error="false">
<set-url>AUTH Service</set-url>
<set-method>POST</set-method>
<set-header name="Content-Type" exists-action="override">
<value>application/x-www-form-urlencoded</value>
</set-header>
<set-body>#($"token={(string)context.Variables["token"]}")</set-body>
</send-request>
<choose>
<when condition="#((bool)((IResponse)context.Variables["tokenstate"]).Body.As<JObject>()["active"] == false)">
<return-response response-variable-name="existing response variable">
<set-status code="401" reason="Unauthorized" />
</return-response>
</when>
<otherwise>
<set-query-parameter name="domain_id" exists-action="append">
<value>
#((string)((IResponse)context.Variables["tokenstate"]).Body.As<JObject>()["content"]["domain_id"])
</value>
</set-query-parameter>
</otherwise>
</choose>
<base />
</inbound>
</policies>
But I am getting this error:
{
"messages": [
{
"message": "Expression evaluation failed.",
"expression": "(string)((IResponse)context.Variables[\"tokenstate\"]).Body.As<JObject>()[\"content\"]",
"details": "Object reference not set to an instance of an object."
},
"Expression evaluation failed. Object reference not set to an instance of an object.",
"Object reference not set to an instance of an object."
]
}
Any idea how should I do it ?
By getting decoded JWT from my AUTH service and added it to the request to backend
Thank You

Answer 1

For performance reasons APIM service always avoids caching full request/response bodies in memory, thus when you call ((IResponse)context.Variables["tokenstate"]).Body.As() response is streamed directly from auth server and at the same time converted to JObject, so it is consumed after that and second call to .Body.As() will produce null value.
To avoid that you have two options:
call ((IResponse)context.Variables["tokenstate"]).Body.As<JObject>(true) - this additional parameter instructs service to cache response in memory so it will be preserved for later inspection. but using call to .As() later on again will once more parse raw response into JSON doing same work again and being a performance hit.
or do <set-variable name="tokenstate" value="((IResponse)context.Variables["tokenstate"]).Body.As<JObject>()" />. This will overwrite value of tokenstate variable with parsed JSON body that can be used later on multiple times as it will be stored in memory now.

Answer 2

just to add a solution, if you need validate some fields from request api policy may use:
place this below inbound tag:
<set-variable name="<some>" value="#(context.Request.Body.As<string>())" />
<choose>
<when condition="#(!((string) context.Variables["<some>"]).Contains("<some>"))">
<return-response>
<set-status code="400" reason="badRequest" />
<set-header name="<some>" exists-action="override">
<value><some></value>
</set-header>
<set-body />
</return-response>
</when>
<otherwise>
<return-response />
</otherwise>
</choose>