Disable other methods except get and post in the inbound request

azure-apim-policy-allow-only-get-post.xml

    <on-error>
        <base />
        <choose>
            <when condition="@(context.Request.Method != "GET" && context.Request.Method != "POST")">
                <return-response>
                    <set-status code="405" reason="Method not allowed" />
                    <set-body>@{
                        return new JObject(
                            new JProperty("status", "HTTP 405"),
                            new JProperty("message", "Method not allowed")
                        ).ToString();
                    }</set-body>
                </return-response>
            </when>
            <otherwise />
        </choose>
    </on-error>