What Happens When Someone Asks Your API for Everything at Once?

A client had been bulk-loading data straight into the database with SQL, to speed up onboarding new customers. It’s a reasonable instinct, SQL is fast and easily repeatable with minimal effort, but writing directly to the database skips the permission checks, validation and auditing the application does for you. So I suggested our platform’s built-in REST API instead, and built them a Postman collection to try it. Somewhere in the testing they sent off a couple of requests with no page size on them, and the development server ran out of memory and fell over. Then it did it again.