Azure API Management Add Auth token param using rewite url/set param?

Question

Help;

Trying to call Dynamics Marketing API from api management however the api has and end point that requires emApplicationtoken to be set as a query param which I don't want to expose and also the Origin header url as the api management url which again i don't want to expose to the public api.

I try to use set the following policy for all operations

<inbound>
    <base />
     <set-header name="Origin" exists-action="append">
        <value>https://someurl</value>
    </set-header>
    <set-query-parameter name="emApplicationtoken" exists-action="append">
        <value>somekeyvalue</value>
    </set-query-parameter>
</inbound>

However looking at the trace it never applies. I then tried to use URL rewrite thinking that because the params dont exist then it cant override them or append so ill try adding the emAuthetication toaken by using the following policy

 <inbound>
    <base />
  
    <rewrite-uri template="/EvtMgmt/api/v2.0/events/{readableEventId}?emApplicationtoken=sametoken=" copy-unmatched-params="true" />
    -->
 </inbound>

Again, the policy doesn't apply

Here is the api design screen. its a simple API

Screenshot of API setup:

Here is a link to the Event API i am calling in the background. I can get the function working in API management by setting the query params and header, but they are exposed to the public Api which I need to avoid (don't want people seeing the auth token).

https://learn.microsoft.com/en-us/dynamics365/marketing/developer/using-events-api

Hoping some one can tell me what Im doing wrong. Im quite new to API management, and i cant find any real help for this specific problem.

To note when I put the param and header in the policies do apply byt then muck up the url function by duplicating the param and header detail.

Thanks in advance.