Unlike ModSecurity, REQUEST_XML is an alias for XML, as we also support RESPONSE_XML. That’s because of response body processing. Coraza only supports two XPATH expressions, //@* and /* which are hardcoded. That’s because of the lack of libxml2 support.
https://coraza.io/docs/seclang/variables/#xml