Empty response body in API Management developer portal

Question

I have set up an API in API Management and it works fine when execute the request in test tab or when executing request from postman or code. But when execute the request from Developer portal a get a 200 but no response body. CORS is configured for developer portal.

Looking at the trace when it fails Content-Length = 0 Why?

        "backend": [{
                "source": "forward-request",
                "timestamp": "2024-02-07T14:38:01.9181750Z",
                "elapsed": "00:00:00.0025508",
                "data": {
                    "message": "Request is being forwarded to the backend service. Timeout set to 300 seconds",
                    "request": {
                        "method": "GET",
                        "url": "https://api-test.riksbank.se/swea/v1/CalendarDays/2023-12-01",
                        "headers": [{
                                "name": "Host",
                                "value": "api-test.riksbank.se"
                            }, {
                                "name": "sec-ch-ua",
                                "value": "\"Not A(Brand\";v=\"99\",\"Microsoft Edge\";v=\"121\",\"Chromium\";v=\"121\""
                            }, {
                                "name": "X-Forwarded-For",
                                "value": "82.196.122.132"
                            }, {
                                "name": "sec-ch-ua-mobile",
                                "value": "?0"
                            }, {
                                "name": "Ocp-Apim-Subscription-Key",
                                "value": "**************"
                            }, {
                                "name": "sec-ch-ua-platform",
                                "value": "\"Windows\""
                            }, {
                                "name": "Origin",
                                "value": "https://apim-garbo-test.developer.azure-api.net"
                            }, {
                                "name": "Sec-Fetch-Site",
                                "value": "same-site"
                            }, {
                                "name": "Sec-Fetch-Mode",
                                "value": "cors"
                            }, {
                                "name": "Sec-Fetch-Dest",
                                "value": "empty"
                            }, {
                                "name": "Cache-Control",
                                "value": "no-cache"
                            }, {
                                "name": "Accept",
                                "value": "*/*"
                            }, {
                                "name": "Accept-Encoding",
                                "value": "gzip,deflate,br"
                            }, {
                                "name": "Accept-Language",
                                "value": "sv,en;q=0.9,en-GB;q=0.8,en-US;q=0.7"
                            }, {
                                "name": "Referer",
                                "value": "https://apim-garbo-test.developer.azure-api.net/"
                            }, {
                                "name": "User-Agent",
                                "value": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36 Edg/121.0.0.0"
                            }, {
                                "name": "Request-Id",
                                "value": "|**************"
                            }, {
                                "name": "Request-Context",
                                "value": "appId=cid-v1:****************"
                            }
                        ]
                    }
                }
            }, {
                "source": "forward-request",
                "timestamp": "2024-02-07T14:38:01.9494874Z",
                "elapsed": "00:00:00.0419873",
                "data": {
                    "response": {
                        "status": {
                            "code": 200,
                            "reason": "OK"
                        },
                        "headers": [{
                                "name": "Request-Context",
                                "value": "appId=cid-v1:********************"
                            }, {
                                "name": "Content-Length",
                                "value": "0"
                            }, {
                                "name": "Date",
                                "value": "Wed, 07 Feb 2024 14:38:01 GMT"
                            }
                        ]
                    }
                }
            }
        ],
        "outbound": [{
                "source": "set-header",
                "timestamp": "2024-02-07T14:38:01.9494874Z",
                "elapsed": "00:00:00.0420724",
                "data": "Header `Ocp-Apim-Subscription-Key` was removed."
            }, {
                "source": "cors",
                "timestamp": "2024-02-07T14:38:01.9494874Z",
                "elapsed": "00:00:00.0433825",
                "data": {
                    "message": "Headers starting with 'Access-Control-' were removed from the response. ",
                    "headers": [{
                            "name": "Access-Control-Allow-Credentials",
                            "value": "true"
                        }, {
                            "name": "Access-Control-Expose-Headers",
                            "value": "Request-Context,Content-Length,Date,Ocp-Apim-Trace-Location"
                        }
                    ]
                }
            }, {
                "source": "transfer-response",
                "timestamp": "2024-02-07T14:38:01.9494874Z",
                "elapsed": "00:00:00.0436569",
                "data": {
                    "message": "Response has been sent to the caller in full"
                }
            }
        ]

Trace when excecute from Postman

        "backend": [{
                "source": "forward-request",
                "timestamp": "2024-02-07T14:36:47.2743790Z",
                "elapsed": "00:00:00.0348681",
                "data": {
                    "message": "Request is being forwarded to the backend service. Timeout set to 300 seconds",
                    "request": {
                        "method": "GET",
                        "url": "https://api-test.riksbank.se/swea/v1/CalendarDays/2023-12-08",
                        "headers": [{
                                "name": "Host",
                                "value": "api-test.riksbank.se"
                            }, {
                                "name": "Ocp-Apim-Subscription-Key",
                                "value": "*****************"
                            }, {
                                "name": "X-Forwarded-For",
                                "value": "82.196.122.132"
                            }, {
                                "name": "Postman-Token",
                                "value": "*******************"
                            }, {
                                "name": "Cache-Control",
                                "value": "no-cache"
                            }, {
                                "name": "Accept",
                                "value": "*/*"
                            }, {
                                "name": "Accept-Encoding",
                                "value": "gzip,deflate,br"
                            }, {
                                "name": "User-Agent",
                                "value": "PostmanRuntime/7.36.1"
                            }, {
                                "name": "Request-Id",
                                "value": "|************"
                            }, {
                                "name": "Request-Context",
                                "value": "appId=cid-v1:*************"
                            }
                        ]
                    }
                }
            }, {
                "source": "forward-request",
                "timestamp": "2024-02-07T14:36:47.3837627Z",
                "elapsed": "00:00:00.1376096",
                "data": {
                    "response": {
                        "status": {
                            "code": 200,
                            "reason": "OK"
                        },
                        "headers": [{
                                "name": "Transfer-Encoding",
                                "value": "chunked"
                            }, {
                                "name": "Request-Context",
                                "value": "appId=cid-v1:*************"
                            }, {
                                "name": "api-supported-versions",
                                "value": "1.0"
                            }, {
                                "name": "Content-Type",
                                "value": "application/json; charset=utf-8"
                            }, {
                                "name": "Date",
                                "value": "Wed, 07 Feb 2024 14:36:47 GMT"
                            }
                        ]
                    }
                }
            }
        ],
        "outbound": [{
                "source": "set-header",
                "timestamp": "2024-02-07T14:36:47.3837627Z",
                "elapsed": "00:00:00.1380505",
                "data": "Header `Ocp-Apim-Subscription-Key` was removed."
            }, {
                "source": "transfer-response",
                "timestamp": "2024-02-07T14:36:47.4462660Z",
                "elapsed": "00:00:00.2126077",
                "data": {
                    "message": "Response has been sent to the caller in full"
                }
            }
        ]

Any ideas?

Answer 1

Update for the community: After reviewing the logs and trace, found the backend API (which is another APIM) was returning 200 with empty body. This happens only from the developer portal (not Postman or Test tab from azure portal) due to CORS validation. The reason was due to Origin header being forwarded to the backend API as well which didn't have CORS policy for that origin (i.e. developer portal). Hence the backend API returned 200 responses with empty body.

So, removing the header via policy works or adjust CORS settings in the backend API to allow the developer portal.

<set-header name="Origin" exists-action="delete" />

I hope this helps others with similar question.