API Design · Junior · Question 56 of 75

What's a sensible maximum for a list endpoint's `limit` parameter?

1Exactly 1
2No limit at all
✓Correct answer: A documented cap (e.g. 100), with a smaller default, so clients can't request unbounded results

Explanation

Unbounded limits are a denial-of-service risk listed in the OWASP API Top 10 (unrestricted resource consumption).

Further reading

Test yourself

Take the API Design · Junior quiz: questions and options are shuffled, and you get a review of your mistakes at the end.