How to complete the challenge GET /api/todos (400) ?_limit too high

By Alan Richardson · Published 2026-07-30

How to issue a GET request on a top level entity endpoint with a pagination limit above the allowed maximum.

GET /api/todos (400) ?_limit too high

Issue a GET request on the /api/todos end point with a pagination limit above the configured maximum to receive a 400 status code.

• the maximum supported _limit value is 20
• _limit=21 is too high for this API
• this challenge is passed by receiving a 400 response for the invalid pagination request

Basic Instructions

• Issue a GET request to end point "/api/todos"
  • https://apichallenges.com/api/todos
• The request should have an X-CHALLENGER header to track challenge completion
• Add _limit=21 as a URL parameter:
  • https://apichallenges.com/api/todos?_limit=21
• The response status code should be 400 because the pagination limit is too high

Try it now

GET /api/todos?_limit=21 to trigger validation for a high limit

Example Request

> GET /api/todos?_limit=21 HTTP/1.1
> Host: apichallenges.com
> User-Agent: rest-client
> X-CHALLENGER: x-challenger-guid
> Accept: application/json

Example Response

< HTTP/1.1 400 Bad Request
< Connection: close
< Content-Type: application/json
< X-Challenger: x-challenger-guid

The response body contains validation details explaining that the requested pagination limit is too high.

Lessons Learned

• _limit has an upper bound, so pagination parameters need validation like request bodies do.
• 400 Bad Request is appropriate when the query parameter itself is invalid.
• Boundary tests should check just below, at, and above the documented maximum.

Suggested Experiments

• Compare _limit=20 with _limit=21 to identify the first failing value.
• Send a non-numeric _limit and compare its error body with the too-high limit response.

Experiment with this endpoint