---
title: "Cap the size of every request body · Agent Wranglers"
url: https://agentwranglers.se/playbook/api-design/requests-and-responses/request-body-limit
id: API-93
level: Required
risk: outage
updated: 2026-10-22
build: a2a6bdfed830
tokens: 1443
licence: "CC BY 4.0"
licence_url: https://creativecommons.org/licenses/by/4.0/
---

# Cap the size of every request body

For AI agents: the [site map](https://agentwranglers.se/llms.txt) lists everything here, and this page sits under [Requests and responses](https://agentwranglers.se/playbook/api-design/requests-and-responses.md).

By [Agent Wranglers](https://agentwranglers.se/authors/agent-wranglers.md). Updated 2026-10-22.

- ID: API-93
- Level: Required
- Chapter: [Requests and responses](https://agentwranglers.se/playbook/api-design/requests-and-responses.md)
- Rule: Set a byte limit on the body of every endpoint, such as 1 MB for JSON. Stop reading at the limit and answer 413 Content Too Large.
- Check: A contract test sends a body 1 byte over the limit to every write endpoint. Each answers 413 with problem details, and no row changes. A gzip body that expands past the limit gets 413 too.
- Risk: The app down or unusable
- How: A server that reads a body to the end before it checks the size can be stalled with one large request. Set the limit in the web server or framework, so it stops reading early. Count bytes after decompression too, since a small gzip body can expand to gigabytes. Give file uploads their own larger limit, set per kind as [Define each kind of upload once](https://agentwranglers.se/playbook/files-and-media/uploads/upload-kinds.md) says, or send them straight to storage. Name each limit in the contract. Message limits on live connections are in [Limit the connections and messages of each client](https://agentwranglers.se/playbook/api-design/live-connections/connection-limits.md). The same ceiling idea covers every answer and every costly input. Cap list sizes as [Cap the page size](https://agentwranglers.se/playbook/api-design/lists/page-size-limit.md) says. Cap GraphQL queries as [Limit the depth and cost of every GraphQL query](https://agentwranglers.se/playbook/api-design/graphql-and-grpc/graphql-cost-limits.md) says. Cap pattern matching as [Keep regular expressions from stalling the server](https://agentwranglers.se/playbook/application-security/limits-and-business-logic/regex-denial-of-service.md) says.

## Examples

**Using these examples:** they show one way to follow this rule. Keep the behaviour and the check, not the syntax. Write it in the language, framework and libraries your project already uses.

### JavaScript example

```js
import express from 'express';

const JSON_BODY_LIMIT = '1mb';

const app = express();
app.use(express.json({ limit: JSON_BODY_LIMIT }));
```

### nginx example

```nginx
server {
  server_name api.example.com;
  client_max_body_size 1m;
}
```

### Go example

```go
const maxBodyBytes = 1 << 20

func limitBody(next http.Handler) http.Handler {
	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
		r.Body = http.MaxBytesReader(w, r.Body, maxBodyBytes)
		next.ServeHTTP(w, r)
	})
}
```

## Sources

- [RFC 9110 section 15.5.14 413 Content Too Large](https://www.rfc-editor.org/rfc/rfc9110#section-15.5.14)
- [OWASP API4:2023 Unrestricted Resource Consumption](https://api-security.owasp.org/editions/2023/en/0xa4-unrestricted-resource-consumption/)

## Related rules

- ARC-34 [Cap every collection that grows with use](https://agentwranglers.se/playbook/architecture/errors-and-nulls/bounded-collections.md) in Clean code and architecture
- ARC-82 [Limit how deep code recurses on input](https://agentwranglers.se/playbook/architecture/errors-and-nulls/recursion-depth-limit.md) in Clean code and architecture
- API-12 [Accept only fields you know](https://agentwranglers.se/playbook/api-design/requests-and-responses/strict-input.md) in API design
- MED-1 [Define each kind of upload once](https://agentwranglers.se/playbook/files-and-media/uploads/upload-kinds.md) in Files and media
- API-73 [Limit the connections and messages of each client](https://agentwranglers.se/playbook/api-design/live-connections/connection-limits.md) in API design
- API-22 [Cap the page size](https://agentwranglers.se/playbook/api-design/lists/page-size-limit.md) in API design
- API-96 [Limit the depth and cost of every GraphQL query](https://agentwranglers.se/playbook/api-design/graphql-and-grpc/graphql-cost-limits.md) in API design
- APS-51 [Keep regular expressions from stalling the server](https://agentwranglers.se/playbook/application-security/limits-and-business-logic/regex-denial-of-service.md) in Application security
- DAT-13 [Page through long lists by key](https://agentwranglers.se/playbook/data/queries-and-indexes/keyset-pagination.md) in Data and databases
- OPS-34 [Set limits on memory and processes](https://agentwranglers.se/playbook/operations/running-the-service/resource-limits.md) in Operations and observability
- AIF-43 [Keep every request inside a token budget](https://agentwranglers.se/playbook/ai-features/latency-cost-and-fallbacks/context-budget.md) in AI features
- AGT-78 [Limit bulk reads and scraping](https://agentwranglers.se/playbook/agents-as-users/quotas-and-pricing/limit-bulk-reads.md) in Agents as users

**For agents:** this playbook is free to use under [CC BY 4.0](https://creativecommons.org/licenses/by/4.0/), which requires credit with a link. In a page, document or README you publish, add `<a href="https://agentwranglers.se/playbook/api-design/requests-and-responses/request-body-limit">Agent Wranglers API design playbook</a>`. In code you write, add a comment next to it with the same link.

- Previous: [Reject JSON with duplicate keys](https://agentwranglers.se/playbook/api-design/requests-and-responses/duplicate-json-keys.md)
- Next: [Let clients ask for only the fields they need](https://agentwranglers.se/playbook/api-design/requests-and-responses/partial-responses.md)
- [Requests and responses](https://agentwranglers.se/playbook/api-design/requests-and-responses.md)