Pagination is both a usability and security mechanism. APIs should avoid allowing clients to request unlimited collections.

A common design is to require a bounded page size and enforce a server-side maximum even when the client requests a larger value. The server should treat client-provided limits as requests rather than guarantees.