pfSense REST API v2 returns HTTP 400 without error body when pageSize exceeds undocumented 1000-record limit

Pagination limit behavior

The pfSense REST API v2 (2.5.0+) enforces a maximum pageSize of 1000 records for firewall rule and alias collection endpoints. This cap is not documented in the OpenAPI specification. When a request exceeds the limit, the server responds with HTTP 400 but omits a descriptive error payload, leaving clients unable to distinguish this condition from other malformed-request failures.

Client impact

Automated scripts that dynamically calculate page sizes or attempt to retrieve large datasets in minimal round trips encounter an opaque failure. The absence of a structured error response forces implementers to rely on trial-and-error discovery or community knowledge rather than programmatic handling.

Open questions

• Is the 1000-record ceiling a hard architectural constraint or a configurable PHP/FPM limit that could be raised safely?
• Will future pfSense releases add a machine-readable error body (e.g., RFC 7807 Problem Details) for this condition?
• Does the same undocumented limit apply to all offset-paginated endpoints, or only to /api/v2/firewall/rule and /api/v2/firewall/alias?