Ability to customize HTTP response code and response body

We have enabled the additional scope check in the IBM API Connect.
This functionality is called “Advanced Scope check” in the documentation. We have defined an external custom scope check in the ‘x-scopeValidate' attribute in our swagger definitions for all the API's that need this functionality. This application also checks whether the consent is still valid and not expired or revoked. In that case, it will return a 200 OK. In any other case, it will return most likely a 401 Unauthorized HTTP status code but other HTTP Status codes are possible.

Because of this, during an API call IBM API connect will call our custom scope check. In the happy flow, the custom scope check returns a 200 OK status code and the API call is redirected to the correct API by the IBM API product. When the consent is expired the custom scope check will return an HTTP response code of 401 to the IBM API Connect. The IBM API Connect will convert this 401 HTTP status code to a 403 HTTP status code and returns this to the API consumer with a static error message in the body.

To be compliant with the PSD2 legislation we need the ability to pass the HTTP status code and body contents directly to the API consumers when the response of the custom scope check is not an HTTP status code of 200. In the above example, we would like to return a 403 HTTP status code with the corresponding body to the API consumer if the custom scope check is returning a 403 HTTP status code.
We want to pass our own exact error message which will be according to the PSD2 specifications. Appending the error message to the current error message returned will break these specifications and confuse the consumers.