code: @Override
      public RequestCtx handleRequest(HttpServletRequest request,
                                      HttpServletResponse response)
      throws IOException, ServletException {
  
          RequestCtx req = null;
  
          String action = request.getParameter("action");
  
          if (action == null) {
              throw new ServletException("Invalid request, action parameter must be specified.");
          }
  
  
          Map<URI, AttributeValue> actions = new HashMap<URI, AttributeValue>();
          Map<URI, AttributeValue> resAttr;
  
          try {
  
              resAttr = ResourceAttributes.getRepositoryResources();
  
              // note - no API specified in legacy XACML, so none specified here
              /*
              actions.put(Constants.ACTION.API.getURI(),
                          Constants.ACTION.APIA.getStringAttribute()));
              */
  
              if (action.equals("status")) {
                  actions.put(Constants.ACTION.ID.getURI(),
                              Constants.ACTION.SERVER_STATUS.getStringAttribute());
              } else if (action.equals("reloadPolicies")) {
                  actions.put(Constants.ACTION.ID.getURI(),
                              Constants.ACTION.RELOAD_POLICIES.getStringAttribute());
              } else if (action.equals("modifyDatastreamControlGroup")) {
                  // FCREPO-765, no specific URI defined for this operation
                  actions.put(Constants.ACTION.ID.getURI(),
                              Constants.ACTION.RELOAD_POLICIES.getStringAttribute());
              } else {
                  throw new ServletException("Invalid request, invalid action parameter specified:" + action);
              }
  
  
              req =
                  getContextHandler().buildRequest(getSubjects(request),
                                                   actions,
                                                   resAttr,
                                                   getEnvironment(request));
  
              LogUtil.statLog(request.getRemoteUser(),
                              Constants.ACTION.LIST_METHODS.uri,
                              Constants.FEDORA_REPOSITORY_PID.uri,
                              null);
          } catch (Exception e) {
              logger.error(e.getMessage(), e);
              throw new ServletException(e);
          }
  
          return req;
      }
docs: /*
  (non-Javadoc)
  @see
  org.fcrepo.server.security.xacml.pep.rest.filters.RESTFilter#handleRequest(javax.servlet
  .http.HttpServletRequest, javax.servlet.http.HttpServletResponse)