The amount of data returned by the API must be restricted.

Restrict exposing excessively large sets of data that could be used to discover vulnerabilities or extract sensitive information. This will protect sensitive information and prevent performance bottlenecks caused by returning large, unnecessary datasets.

Verify the amount of data returned by the API is restricted.

Check API endpoints: Review the various API endpoints and the data they return. Look for endpoints that might expose excessively large datasets or sensitive information (e.g., entire user lists, full transaction histories).

If the API exposes unusually large volumes of data in a single response (entire datasets, unrestricted record sets, or bulk exports without proper limits or pagination) this is a finding.

Ensure API responses are small and contain only the data necessary for the client's request.

To ensure that the amount of data returned by an API is appropriately restricted, implement and test measures like pagination, field filtering, query parameters, server-side limits, and proper access control.