ah yes, you have tripped over a very frustrating and confusing behavior in the ServiceCallout. It is not possible to simply "build the string" for the URL in the way you have done. You can replace {backendURL} with a pure hostname, but it cannot contain a slash, or the ServiceCallout will not behave properly. Despite what the trace shows, the policy is not doing what you think it should.
For a related question on this topic, see this Q&A.
The way to do it for you is to configure your serviceCallout like this:
<ServiceCallout name="SC-ToBackend-Alternative">
<Request>
<Set>
<Headers>
<Header name="Authorization">Basic abcd</Header>
</Headers>
<Verb>POST</Verb>
<Path>{servicecallout_path}</Path>
</Set>
</Request>
<Response>revokeTokenResponse</Response>
<Timeout>60000</Timeout>
<Response>calloutResponse</Response>
<HTTPTargetConnection>
<URL>https://this.will.be.changed</URL>
</HTTPTargetConnection>
</ServiceCallout>
And then... prior to that step in your policy flow, use a different policy to set 2 variables - one for the host and one for the path. In the case you would like to use the "message template" idea for building the URL, you can do it in a JS step like this:
<Javascript name='JS-AssignServiceCalloutUrlVariables' timeLimit='200' >
<Properties>
<Property name='hostvar'>servicecallout.SC-ToBackend.target.url</Property>
<Property name='pathvar'>servicecallout_path</Property>
<Property name='urltemplate'>https://{backendURL}/v1/organizations/{organization.name}/oauth2/revoke?enduser=1&app=2</Property>
</Properties>
<IncludeURL>jsc://messageTemplate.js</IncludeURL>
<ResourceURL>jsc://assignServiceCalloutUrlVariables.js</ResourceURL>
</Javascript>
The magic JS in assignServiceCalloutUrlVariables.js looks like this:
var urlvalue = (new MessageTemplate(properties.urltemplate)).fill();
var re = new RegExp('^(https?://[^/]+)(/.*)$');
var match = re.exec(urlvalue);
if (match) {
context.setVariable(properties.hostvar, match[1]);
context.setVariable(properties.pathvar, match[2]);
}
And the flow looks like this:
<Step>
<Name>KVM-ReadTargetUrl</Name>
</Step>
<Step>
<Name>JS-AssignServiceCalloutUrlVariables</Name>
</Step>
<Step>
<Name>SC-ToBackend</Name>
</Step>see attached for the working code.frontend.zip
Alternatively, you could read both HOST and PATH from KVM and set them both. In that case you would have something like this in the ServiceCallout:
<ServiceCallout name="SC-ToBackend">
<Request>
<Set>
<Headers>
<Header name="Authorization">Basic abcd</Header>
</Headers>
<Verb>POST</Verb>
</Set>
</Request>
<Response>revokeTokenResponse</Response>
<Timeout>60000</Timeout>
<Response>calloutResponse</Response>
<HTTPTargetConnection>
<URL>https://{backendHost}/{backendPathAndQuery}</URL>
</HTTPTargetConnection>
</ServiceCallout>
LinkedIn
Twitter
