<policies>
    <inbound>
        <base />
        <!-- TODO: limit by client_id, not token itself -->
        <rate-limit-by-key calls="30" renewal-period="10" counter-key="@(context.Request.Headers.GetValueOrDefault("Authorization",""))" />
        <choose>
            <when condition="@(context.Request.Certificate != null && context.Request.Certificate.NotAfter > DateTime.Now)">
                <set-header name="Client-Certificate" exists-action="override">
                    <value>@(context.Request.Certificate.GetRawCertDataString())</value>
                </set-header>
            </when>
            <otherwise>
                <set-header name="Client-Certificate" exists-action="override">
                    <value />
                </set-header>
            </otherwise>
        </choose>
    </inbound>
    <backend>
        <base />
    </backend>
    <outbound>
        <base />
    </outbound>
    <on-error>
        <base />
    </on-error>
</policies>