Pagination and filtering

Never return everything.

Two approaches

Offset paging is simple and drifts when rows are inserted while you page. Cursor paging passes an opaque marker for the last item seen and stays stable under change.

Always apply a default limit, even when the caller forgets.
Return whether more pages exist rather than making the client guess.

Filtering and sorting

Query parameters filter and order results. Validate them against a list you allow, because passing them into a query is how injection happens.