API Management Standard v2 decodes %2F in URL path before routing – classic (Developer) tier preserves it. By design?

For Standard v2, treat %2F as decoded before operation matching and keep the wildcard route (or move the slash-containing value out of the path), because no APIM policy or documented instance setting can preserve the original encoded slash at that stage.^1^

What can be concluded

• Standard v2: The behavior you reproduced is consistent with the published Microsoft Q&A guidance: %2F is decoded during path handling, before policies can restore it, and there is no built-in configuration for preserving encoded slashes in path parameters.^1^
• Consumption: The same behavior is independently reported and accepted as non-configurable through policies.^2^
• Basic v2 and Premium v2: The available public material does not explicitly establish a tier-wide contract for encoded-slash handling across every v2 SKU. Basic v2, Standard v2, and Premium v2 use the v2 gateway family, but the gateway comparison currently does not document %2F normalization.^3^ Therefore, Standard v2’s observed behavior should not be presented as a guaranteed specification for Basic v2 or Premium v2 without confirmation from Azure Support.
• Classic versus v2: Microsoft documents these as different managed gateway families built on different service architectures.^3^ It does not publicly document the implementation-level reason that classic preserves %2F in this case while Standard v2 normalizes it. Also, classic stv2 is unrelated to the v2 service tiers; stv2 is the compute-platform generation for classic tiers.^4^

Your cross-routing tests already isolate APIM as the differentiator, so no further Application Gateway or firewall troubleshooting is indicated.

Supported mitigations

Your /asset/{*filePath} mitigation is appropriate across APIM tiers. APIM officially supports wildcard operations for arbitrary path values, although Microsoft cautions that broad wildcard operations can increase API security exposure.^5^

Apply explicit validation after matching:

1. Retain GET /asset/{*filePath}.
2. Split the decoded value at the final / in the backend or a policy:
   • folderPath = folder1/sub1/sub2
   • assetName = file.html
3. Reject empty paths, ./.. segments, unexpected extensions, and paths outside the permitted asset namespace.
4. Ensure the wildcard operation does not unintentionally shadow more-specific operations.

If the API contract can change, stronger long-term alternatives are:

• Put folderPath in a query parameter.
• Encode it using a slash-free representation such as Base64url, then decode and validate it in the backend.^2^
• Model folders as repeated or separately named parameters instead of treating / as data.

rewrite-uri cannot recover the wire representation once operation matching has received the normalized path. It can only construct a new backend URL from information still available at policy execution.^6^ The policy catalog likewise contains no “preserve encoded path separators” setting.^7^

Configuration, support, and roadmap

There is no publicly documented instance-level switch or support-enabled setting for preserving %2F on Standard v2. A support request is still appropriate to obtain:

• confirmation for the exact region and gateway build;
• an explicit answer for Basic v2 and Premium v2;
• confirmation whether the behavior is a permanent compatibility constraint or a candidate product change.

No public APIM release entry through the June 2026 release identifies encoded-slash preservation as a planned feature or delivered fix.^8^ Absence from public release notes is not a commitment that it will never change; it means there is currently no documented roadmap or ETA.

Documentation request

Submit feedback directly on the gateway comparison page using its Feedback control, categorizing it as a documentation omission and including:

• classic Developer (stv2) versus Standard v2;
• the exact request containing %2F;
• the resulting operation-match difference;
• confirmation that normalization precedes policy execution;
• the wildcard workaround;
• a request for a compatibility row covering path normalization and encoded separators.

Microsoft Learn’s feedback system routes documentation feedback to the relevant content teams; some repositories also expose a GitHub issue option.^9^

References

1. URL Encoding Issue in Azure API Management - Encoded Forward Slash (%2F ...
2. URL Encoding Issue in Azure API Management - Encoded Forward Slash (%2F) Getting Decoded Automatically - Microsoft Q&A
3. API gateway in Azure API Management
4. Azure API Management v2 tiers
5. Manually add an API
6. Rewrite URL
7. Azure API Management Policy Reference | Microsoft Learn
8. Releases: Azure/API-Management - GitHub
9. Provide feedback for Microsoft Learn content