Pagination pattern defined and consistent
Why it matters
An API where /api/users uses cursor-based pagination and /api/orders uses offset/limit forces every consumer to write different pagination logic per endpoint. Worse, an endpoint with no pagination at all returns unbounded result sets that will eventually OOM the server or time out for large collections. iso-25010:2011 compatibility.interoperability is directly impacted: a generic list component cannot be built once and reused, and any SDK wrapping the API must special-case every list endpoint.
Severity rationale
High because inconsistent pagination patterns prevent generic client-side list handling and unbounded collections create reliability failures at scale.
Remediation
Define one pagination response shape as a generic type and apply it to every list endpoint:
interface PaginatedResponse<T> {
data: T[]
meta: {
page: number
limit: number
total: number
totalPages: number
}
}
// Use identically across all list endpoints:
// GET /api/users?page=1&limit=20
// GET /api/orders?page=2&limit=10
// Same envelope, same parameter names
Enforce a maximum page size (100 items) server-side to prevent consumers from accidentally requesting unbounded results. See the query-param-naming check for consistent parameter naming across these endpoints.
DetectionPro
The detection method for this pattern is part of AuditBuffet Pro.
The full method (what to look for, pass and fail conditions, and how results get reported) ships inside the API Design Audit. The pattern definition, severity rationale, and remediation remain openly licensed under CC-BY-4.0.
External references
- iso-25010:2011 · compatibility.interoperability — Interoperability — consistent pagination contract enables generic client code
Taxons
History
- 2026-04-18·v1.0.0·Initial import from api-design·automated