Skip to content
Sarj Code Standards

require-constrained-api-integer

Declare numeric bounds for scalar integer FastAPI request parameters.

SARJ553 Rule source Tests Catalog JSON

Why

A bare integer request parameter accepts negative and arbitrarily large values even when the service expects a bounded page size or ordinal.

Fix

Use PositiveInt, NonNegativeInt or a domain Annotated type, or declare the appropriate Query/Path bounds. Keep signed and sentinel contracts explicit with a reasoned local exception.

Examples

Before — flagged The history API accepts any signed integer
api.py
from fastapi import APIRouter


router = APIRouter()




@router.get("/versions")
def versions(limit: int = 25):
    return limit
After — preferred Declare the valid numeric domain
api.py
from fastapi import APIRouter
from pydantic import PositiveInt


router = APIRouter()




@router.get("/versions")
def versions(limit: PositiveInt = 25):
    return limit