As silent mentioned in comments, the message
cache-control: no-cache should not really be indicative whether the cache was being used. The
<cache-lookup> policy is correct in your APIM.
When you request the api(for test in APIM page) first time, click "Trace" --> "Inbound". You can find the message
Cache lookup resulted in a miss because there is no cache when you request first time.
And then click "Outbound", you can find
Response will be buffered during streaming and stored in the cache after it is received in full.
Then, since you specified the cache be stored for 1000 seconds, so if you request again in 1000 seconds, you can find the message
Cache lookup resulted in a hit! under "Inbound".
Please test in your side, and if the result is same with what I mentioned above, the policy
<cache-lookup> works fine in your APIM.