echo api with oauth2- talking to the AS of an AAD tenant

Ive setup api management to induce the developer console's client to get an authorization code grant from my AAD (federated) tenant. All the evidence is that that step works. However, the site backend step of converting code into token seems to fail, with the AAD reporting a missing parameter via a client-shown error screen:

An error has occurred while authorizing access via api manager: invalid_resource AADSTS50001: Resource identifier is not provided.
Trace ID: 7d408b1f-8b2a-4e0c-8781-1e7d295e34a7
Correlation ID: 73c33ba0-66fd-468e-8b8d-53fd0fb56e7a
Timestamp: 2015-02-18 20:36:05Z

any ideas?

note my AAD-token and AAD-authorization endpoints use the tenant OID (e.g. https://login.windows.net/bcbf53cf-af9a-4584-b4c9-6d8b01b3781d/oauth2/authorize), ignoring documentation in api manager that suggests -STRANGELY - using unknown appid and tokened values where one normally uses tenant fields when talking to AAD.

obviously, the resource parameter is missing on the posited web call to the token endpoint... so how might I fix this?

-----------

Use of the auth endpoint of AAD seems to suceed, note: