@Override
    public AuthorizationResult evaluate(final AuthorizableResource resource, final AuthorizationRequest request) throws Throwable {
        val entity = Map.of("resource", resource, "request", request);
        val finalHeaders = headers
            .entrySet()
            .stream()
            .map(entry -> {
                val key = entry.getKey();
                val value = SpringExpressionLanguageValueResolver.getInstance().resolve(entry.getValue());
                return Map.entry(key, value);
            })
            .collect(Collectors.toMap(Map.Entry::getKey, Map.Entry::getValue));

        val exec = HttpExecutionRequest.builder()
            .method(HttpMethod.valueOf(method.toUpperCase(Locale.ENGLISH).trim()))
            .url(url)
            .headers(finalHeaders)
            .entity(MAPPER.writeValueAsString(entity))
            .build();
        val response = HttpUtils.execute(exec);
        val authorized = response != null && HttpStatus.valueOf(response.getCode()).is2xxSuccessful();
        return authorized ? AuthorizationResult.granted("OK") : AuthorizationResult.denied("Denied");
    }
Headers, defined as a Map, to include in the request when making the REST call.
support/cas-server-support-heimdall/src/main/java/org/apereo/cas/heimdall/authorizer/resource/policy/RestfulAuthorizationPolicy.java