starcoach-hackathon/zarinpal-analytics-backend
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

docs(api): approve request size limits

Browse Source
This commit is contained in:
Amirhossein Khalili
2026-08-20 18:25:15 +03:30
parent e54c8e8319
commit e8028d5f46
1 changed files with 4 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

7
docs/API-SPEC.md
View File

@@ -225,8 +225,8 @@ Approved existing limits remain unchanged:
API boundary limits: API boundary limits:
- Proposed: JSON request body is limited to 16 KiB; requests with no defined body reject non-empty bodies. - Approved: JSON request bodies are limited to 16 KiB; requests with no defined body reject non-empty bodies.
- Proposed: request target/query string is limited to 8 KiB at the public edge. - Approved: the request target/query string is limited to 8 KiB at the public edge.
- Approved: detail pages default to 25 rows and cannot exceed 100. - Approved: detail pages default to 25 rows and cannot exceed 100.
- Approved: synchronous CSV export is limited to 100,000 rows, 50 MiB estimated uncompressed output, and 60 seconds, with 3 requests/10 minutes and burst 1 per user and merchant. - Approved: synchronous CSV export is limited to 100,000 rows, 50 MiB estimated uncompressed output, and 60 seconds, with 3 requests/10 minutes and burst 1 per user and merchant.
@@ -278,10 +278,11 @@ Correlate `requestId`, authenticated user/merchant internal ids, run id, section
- Analytics-access and CSV-export audit records are retained for 90 days and are accessible only to explicitly authorized backend operators; the MVP exposes no merchant audit-history surface. - Analytics-access and CSV-export audit records are retained for 90 days and are accessible only to explicitly authorized backend operators; the MVP exposes no merchant audit-history surface.
- Detail responses and CSV exports show the existing opaque source terminal reference as `شناسه پایانه`; it is tenant-scoped trace data and never an authorization input. - Detail responses and CSV exports show the existing opaque source terminal reference as `شناسه پایانه`; it is tenant-scoped trace data and never an authorization input.
- RFC 9457 problem `type` URIs use `https://zarinpal.amiirkhl.ir/docs/errors/{error-slug}` and resolve to human-readable error documentation. - RFC 9457 problem `type` URIs use `https://zarinpal.amiirkhl.ir/docs/errors/{error-slug}` and resolve to human-readable error documentation.
- Public-edge requests are limited to 16 KiB for JSON bodies and 8 KiB for the request target/query string.
## Remaining product questions ## Remaining product questions
1. Approve or revise the proposed public-edge request limits: 16 KiB for JSON bodies and 8 KiB for the request target/query string. None. Final approval of this complete capability spec and its OpenAPI contract remains the SDD gate before implementation planning.
## Standards references ## Standards references