The rule that could not see the path
The requirement is to send /api/* to one backend and everything else to another, and to block any request whose body contains a particular pattern.
The balancer in front is a layer-4 device. It forwards the TCP stream and terminates nothing, so it can see addresses and ports. The path is inside the encrypted payload, and so is the body. Neither rule can be expressed by a device that never sees the plaintext.
Boundaries, outermost first: Encrypted to here: Layer-4 balancer (addresses, ports), The two rules (by path, by body; FAILED: not expressible here), Client (sends HTTPS) Outside every boundary: Web backend (everything else), API backend (wants /api/*), an empty slot for the where the session ends, an empty slot for the where a body can be read Connections: Client calls Layer-4 balancer (step 1) Layer-4 balancer calls where the session ends — still opaque (step 2) where the session ends calls API backend (step 3) where the session ends calls Web backend (step 4) where a body can be read controls where the session ends — sees plaintext (step 5) The two rules must NOT reach Layer-4 balancer — no visibility here