@Sridhar Chinnakkannu Thanks for reaching out.
To call any external service you can refer to this document where you can make any external service HTTP call. In your case you need to build the request as per your external scanning API accepts it using the policy.
I am not sure what do you refer to Temporary storage here. Do you mean to hold the request content at the APIM end? The APIM limits are documented here for request limits.
When a large request is sent to Azure API Management (APIM), the request is temporarily stored in memory while it is being processed. If the request is too large to fit in memory, APIM will return an HTTP 413 Payload Too Large response to the client.
APIM does not store the request permanently unless you have configured it to do so using the log-to-eventhub policy that store your details in EventHub.