In the default service resolver its only * as such people use a catchall page.
/*
So it catches and errors nicely for anyone trying to guess a url. Instead of the Standard API Gateway error.
? does not work and context variables are un-resolved at this point.
The one caveat is service resolver does some weighting based on * so you need to be careful how you use it because it doesnt always get you the result you expect.
Meaning,
Different types of matches are considered prefix and suffix similar to thinking of it as file extension and path because any URL with characters after the wildcard (*) is considered a file extension even if there is no period. So /*a and /*.a are both considered suffix matches Consider the two URLs: /zar* and /zar/*a. If a request is issued with the URL=/zar/bbbbbba the policy at URL=/zar* wins the conflict resolution.
And there are other small caveats like this based on internal weighting of the service resolver.