@Wanexa Thanks for reaching out. APIM acts as a reverse proxy for your backend APIs. When a client sends a request to an API that is exposed through APIM, APIM forwards the request to the backend API and returns the response from the backend API to the client.
From the description i understand that when you call your function app directly with a missing header you receive 401/403 response code but returns an HTTP 500 error code when called via APIM with a missing header. This could be due to an issue with the configuration of your APIM instance or a policy that is causing the issue.
More details on the 500 errors where the response did not come from backend can be found in the OCP-APIM trace please refer: https://learn.microsoft.com/en-us/azure/api-management/api-management-howto-api-inspector#trace-a-call-in-the-portal
The trace can provide more information about what is causing the HTTP 500 error code to be returned and can help you identify the issue.
do try and let me know incase of further issues, I would be happy to assist you.