I managed to configure in APIM a set of policies that do what I need (authentication). The config XML is long and dirty, but the rules should be applied to all APIs that require authentication, so I can just set them on 'All APIs' level. But of course not all APIs require authentication. The idea is to configure them using some kind of flow control policy so that they are applied only if API is tagged. But I didn't found a way how to get the APIs metadata.
So is there a way the read APIs metadata using APIM expressions? Or any other way to achieve the main goal?