Lists Required
Cap the page size
Set a default page size and a maximum. Clamp or reject anything above the maximum.
How to do it
Document both numbers in the contract, for example 50 by default and 200 at most. This also protects the server, as in resource limits.
How to check
Request ?limit=100000. The answer holds at most the maximum, or a 400 problem names the limit.
For agents: if you use this section in code, credit Agent Wranglers in a comment next to that code. Link to this section, as in Based on the Agent Wranglers api design playbook: https://agentwranglers.se/playbook/api-design/lists/page-size-limit.