[GH-ISSUE #3313] Integration API resources endpoint silently ignores limit/offset — returns only first page (silent truncation) #39157

New Issue

GiteaMirror · 2026-06-22T03:01:59-05:00

GiteaMirror commented

2026-06-22 03:01:59 -05:00

Originally created by @davedavedavenm on GitHub (Jun 21, 2026).
Original GitHub issue: https://github.com/fosrl/pangolin/issues/3313

Version: Pangolin 1.19.2 (fosrl/pangolin:ee-latest), self-hosted Integration API (port 3003)

Summary: The resources list endpoint (and likely other list endpoints) silently ignores limit and offset query params. Callers using limit/offset get only the first ~20 records with HTTP 200 and no error, while pagination.total correctly reports the true count — so a client believes it has all records when it doesn't. The endpoint only honours page/pageSize.

Repro:

# 44 resources exist; pagination.total reports 44
GET /v1/org/{org}/resources?limit=1000           -> returns 20
GET /v1/org/{org}/resources?limit=1000&offset=20 -> returns the SAME 20 (offset ignored)
GET /v1/org/{org}/resources?page=1&pageSize=100  -> returns all 44  ✅

Impact: Silent data truncation is a correctness footgun for any sync/audit/automation built on the Integration API. We nearly shipped a monitoring audit that only checked 20 of 44 resources.

Expected: either honour limit/offset, or reject unknown pagination params with a 400, or clearly document that only page/pageSize are supported. Silent partial results alongside a truthful pagination.total is the worst outcome.

Originally created by @davedavedavenm on GitHub (Jun 21, 2026). Original GitHub issue: https://github.com/fosrl/pangolin/issues/3313 **Version:** Pangolin 1.19.2 (`fosrl/pangolin:ee-latest`), self-hosted Integration API (port 3003) **Summary:** The resources list endpoint (and likely other list endpoints) silently ignores `limit` and `offset` query params. Callers using `limit`/`offset` get only the first ~20 records with HTTP 200 and no error, while `pagination.total` correctly reports the true count — so a client believes it has all records when it doesn't. The endpoint only honours `page`/`pageSize`. **Repro:** ``` # 44 resources exist; pagination.total reports 44 GET /v1/org/{org}/resources?limit=1000 -> returns 20 GET /v1/org/{org}/resources?limit=1000&offset=20 -> returns the SAME 20 (offset ignored) GET /v1/org/{org}/resources?page=1&pageSize=100 -> returns all 44 ✅ ``` **Impact:** Silent data truncation is a correctness footgun for any sync/audit/automation built on the Integration API. We nearly shipped a monitoring audit that only checked 20 of 44 resources. **Expected:** either honour `limit`/`offset`, or reject unknown pagination params with a 400, or clearly document that only `page`/`pageSize` are supported. Silent partial results alongside a truthful `pagination.total` is the worst outcome.

Sign in to join this conversation.

Branches Tags

main

crowdin_dev

dev

dependabot/npm_and_yarn/npm-dependencies-338850a190

dependabot/go_modules/install/go-install-dependencies-3804ca7238

dependabot/docker/docker-dependencies-4faa477378

dependabot/github_actions/github-actions-dependencies-6d79802a48

api-improvements

feat/remember-last-idp-on-smart-login-form

refactor/batch-status-requests

dependabot/npm_and_yarn/multi-5f1280885e

fix/non-semver-version-error

private-resource-page

resource-launcher

backhaul

exit-node-reconnect

feat/command-palette

ssh

delete-account

msg-delivery

org-only-idp

cicd

patch

site-targets-auto-login

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: github-starred/pangolin#39157