The key to this is the "Extract REST Request Attributes" filter. If I type in "REST" into the search box on Policy Studio, it helpfully narrows down the filter list to just the filters related to REST.
When I drag in an "Extract REST Request Attributes" filter, I see this configuration below. As you can see, you can have the API Server read API parameters from the querystring or from HTTP POST parameters.
Once I place this filter into a policy which is mapped to a REST endpoint on the API Server (e.g. a relative path), I can then access the REST parameters in other filters.
Let's say a parameter is passed like this:
I can now access the content of the "customerID" parameter like this:
${http.querystring.customerID}
{{ parent.title || parent.header.title}}
{{ parent.tldr }}
{{ parent.linkDescription }}
{{ parent.urlSource.name }}