> ## Documentation Index
> Fetch the complete documentation index at: https://docs.neuraltrust.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Azure APIM

> TrustGuard from Azure API Management send-request policies.

Use **`send-request`** on inbound (prompt) and outbound (completion).

## Coverage

| Surface    | Monitor | Block | Redact |
| ---------- | :-----: | :---: | :----: |
| LLM input  |    ✅    |   ✅   |    ❌   |
| LLM output |    ✅    |   ✅   |    ❌   |
| Tool-level |    ➖    |   ➖   |    ➖   |

**Ask** — the policy maps the verdict onto a boolean, so an `ask` gate is
**allowed** and recorded. Write the rule as **Block** if you need a hard stop.

**Use it when** you publish AI APIs through APIM and want the control alongside
your other policies. **Not when** you will only deploy the inbound policy and
expect full coverage — without the outbound one, completions are never inspected.

**Limits.** No masking in the documented policy. `preserveContent: true` is not
optional: without it the body is consumed and your backend receives an empty
request.

Full comparison: [Coverage](/trustguard/integrations/coverage).

1. Create an API key on the collector.
2. Inbound: `POST` evaluate with `direction: "input"`. Return 403 on `block`; rewrite the
   body from `transformed_payload` on `transform`.
3. Outbound: same with `direction: "output"`.

```xml theme={null}
<inbound>
  <send-request mode="new" response-variable-name="guard" timeout="10">
    <set-url>{TRUSTGUARD_URL}/v1/evaluate</set-url>
    <set-method>POST</set-method>
    <set-header name="Authorization" exists-action="override">
      <value>Bearer <collector-api-key></value>
    </set-header>
    <set-body>@(JsonConvert.SerializeObject(new {
      protocol = "llm",
      direction = "input",
      payload = new { input = context.Request.Body.As<string>(preserveContent: true) },
      consumer_id = context.Subscription?.Id ?? "",
      session_id = context.Request.Headers.GetValueOrDefault("X-Session-Id", "")
    }))</set-body>
  </send-request>
  <choose>
    <when condition="@(((IResponse)context.Variables["guard"]).Body.As<JObject>()["status"].Value<string>() == "block")">
      <return-response>
        <set-status code="403" reason="Blocked by TrustGuard" />
      </return-response>
    </when>
    <when condition="@(((IResponse)context.Variables["guard"]).Body.As<JObject>()["status"].Value<string>() == "transform")">
      <set-body>@(((IResponse)context.Variables["guard"]).Body.As<JObject>()["transformed_payload"]["input"].Value<string>())</set-body>
    </when>
  </choose>
</inbound>
```