title: Azure APIM calls function even though there was an error
body: <p>I have an Azure APIM which checks the request bearer JWT token:</p>
  <pre><code>    &lt;inbound&gt;
          &lt;base /&gt;
          &lt;set-variable name=&quot;TenantId&quot; value=&quot;
              @{
                  var tenantId = context.Request.Headers.GetValueOrDefault(&quot;TenantId&quot;,&quot;&quot;);
           
                      if (tenantId != null) {
                          return tenantId;
                      }
                   
              return null;
      }&quot; /&gt;
          &lt;limit-concurrency key=&quot;@((string)context.Variables[&quot;TenantId&quot;])&quot; max-count=&quot;1&quot;&gt;
              &lt;set-header name=&quot;Ocp-Apim-Subscription-Key&quot; exists-action=&quot;delete&quot; /&gt;
              &lt;set-header name=&quot;subscription-key&quot; exists-action=&quot;delete&quot; /&gt;
              &lt;set-variable name=&quot;JWTIssuer&quot; value=&quot;
      @{
          var authStr = context.Request.Headers.GetValueOrDefault(&quot;Authorization&quot;,&quot;&quot;);
          if (authStr.StartsWith(&quot;Bearer&quot;)) {
              var jwt = authStr.Substring(&quot;Bearer &quot;.Length).AsJwt();
              if (jwt != null) {
                  return jwt.Issuer;
              }
          }
          return null;
      }&quot; /&gt;
              
              &lt;choose&gt;
                  &lt;when condition=&quot;@(context.Variables.GetValueOrDefault(&quot;JWTIssuer&quot;, &quot;&quot;) == &quot;&lt;URL of issuer&gt;&quot;)&quot;&gt;
                      &lt;!-- Authorisation using HPCA token --&gt;
                      &lt;validate-jwt header-name=&quot;Authorization&quot; failed-validation-httpcode=&quot;401&quot; failed-validation-error-message=&quot;Unauthorized&quot; require-expiration-time=&quot;true&quot; require-scheme=&quot;Bearer&quot; require-signed-tokens=&quot;true&quot;&gt;
                          &lt;openid-config url=&quot;&lt;Open Id Url&gt;&quot; /&gt;
                          &lt;required-claims&gt;
                              &lt;claim name=&quot;MyClaim&quot; match=&quot;any&quot; separator=&quot;,&quot;&gt;
                                  &lt;value&gt;X&lt;/value&gt;
                              &lt;/claim&gt;
                          &lt;/required-claims&gt;
                      &lt;/validate-jwt&gt;
                  &lt;/when&gt;
                  &lt;!-- HPCA Error handling --&gt;
                  &lt;otherwise&gt;
                      &lt;return-response&gt;
                          &lt;set-status code=&quot;401&quot; reason=&quot;Unauthorized&quot; /&gt;
                          &lt;set-header name=&quot;WWW-Authenticate&quot; exists-action=&quot;override&quot;&gt;
                              &lt;value&gt;Bearer error &quot;Invalid HPCA token&quot;&lt;/value&gt;
                          &lt;/set-header&gt;
                      &lt;/return-response&gt;
                  &lt;/otherwise&gt;
              &lt;/choose&gt;            
          &lt;/limit-concurrency&gt;
      &lt;/inbound&gt;
  &lt;on-error&gt;
          &lt;base /&gt;
          &lt;return-response&gt;
              &lt;set-status code=&quot;@(context.Response.StatusCode)&quot; reason=&quot;@(context.Response.StatusReason)&quot; /&gt;
          &lt;/return-response&gt;
      &lt;/on-error&gt;
  </code></pre>
  <p>This all works as expected: if either the issuer is incorrect or the JWT token is invalid, then the  OnError handler is invoked and a 401 error status is returned to the caller. The problem is, if i add a call to a function after the Choose policy:</p>
  <pre><code>     &lt;/otherwise&gt;
                  &lt;/choose&gt;    
      &lt;send-request mode=&quot;copy&quot; response-variable-name=&quot;Response&quot; timeout=&quot;10&quot; ignore-error=&quot;false&quot;&gt;
                      &lt;set-url&gt;https://myfuncApp.azurewebsites.net/api/Function1&lt;/set-url&gt;
                      &lt;set-method&gt;POST&lt;/set-method&gt;
                      
                  &lt;/send-request&gt;
                  &lt;return-response response-variable-name=&quot;Response&quot;&gt;
                      &lt;set-status code=&quot;@(context.Response.StatusCode)&quot; reason=&quot;@(context.Response.StatusReason)&quot; /&gt;
                  &lt;/return-response&gt;
  &lt;/limit-concurrency&gt;
  &lt;/inbound&gt;
  </code></pre>
  <p>Then even with a invalid bearer token and the error handler being invoked, the APIM <em>still</em> proceeds to call the function: the return response within the error handler is seemingly ignored - why ? I can fudge it by wrapping the send-request within another conditional (i.e. check the context.Response.StatusCode isn't 401) but this doesn't seem right to me.</p>