Yes there is a feature where apiman will parse the request BEFORE applying the policies. This will make the HTTP request body available to all policies in the chain, should they need them.
You can enable this on a per-API basis in the apiman UI.
When this feature is enabled, your custom policy can access the request body as an object found in the
IPolicyContext object. For example:
Object
payload = context.getAttribute("apiman.request-payload");
The type of thing that you get depends on the API's endpoint type. The endpoint type might be JSON, XML, or SOAP. I think it might be possible to have some other kind of endpoint type, but those three are handled by the request body parser feature.
Here is what you'll get as that payload object, depending on endpoint type:
JSON - Java Map object as a result of parsing the JSON data using Jackson
XML - org.w3c.dom.Document
Soap - javax.xml.soap.SOAPEnvelope
Anything Else - byte[]
So for example, if your endpoint type is XML, then you could do this in your policy implementation (in the doApply() method):
org.w3c.dom.Document
requestBody = (org.w3c.dom.Document) context.gettAttribute("apiman.request-payload");
And then you could make some decision using the request data and e.g. call doFailure().
Also note - you can *change* the request body at this point as well. For example you could apply a XML Transformation to the w3c Document, resulting in a new w3c Document object, which you could store in the Policy Context (at the same key, obviously).
That new document would then get serialized and sent as the request body to the backing API impl. There may be some Content-Length issues if you do that, I can't remember...
-Eric