The API Manager UI is sending pointcutData: null in the request body. However, the Management Plane's OpenAPI specification no longer accepts this property for outbound policy endpoints, causing the 400 Bad Request validation failure.
Bug Confirmed
Our product team has identified and logged this as a known bug:
Bug ID: W-21834107
Status: Pending Release
A fix is in progress and will be included in an upcoming release. We will notify you as soon as there is a timeline update or the fix becomes available.
Track the known issue here > https://help.salesforce.com/s/issue?id=a02Ka00000mmnrx
Workaround :
While the fix is pending, you can apply outbound policies by calling the API Manager API directly via curl, omitting the pointcutData field from the request body:
curl -X POST "https://anypoint.mulesoft.com/apimanager/xapi/v1/organizations/{orgId}/environments/{envId}/apis/{apiId}/policies/outbound-policies" \
-H "Authorization: Bearer <token>" \
-H "Content-Type: application/json" \
-d '{"configurationData":{...},"apiVersionId":...,"groupId":"...","assetId":"credential-injection-oauth2","assetVersion":"1.2.0","label":null,"upstreamIds":["..."]}'
This has been confirmed to return HTTP 201 and the policy will appear in the API Manager UI successfully.
005318026

We use three kinds of cookies on our websites: required, functional, and advertising. You can choose whether functional and advertising cookies apply. Click on the different cookie categories to find out more about each category and to change the default settings.
Privacy Statement
Required cookies are necessary for basic website functionality. Some examples include: session cookies needed to transmit the website, authentication cookies, and security cookies.
Functional cookies enhance functions, performance, and services on the website. Some examples include: cookies used to analyze site traffic, cookies used for market research, and cookies used to display advertising that is not directed to a particular individual.
Advertising cookies track activity across websites in order to understand a viewer’s interests, and direct them specific marketing. Some examples include: cookies used for remarketing, or interest-based advertising.