---
id: STORE-1
family: GR-STORE
level: core
profiles: [storage-api]
posture: normative-target
added: "1.0"
changed: "1.0"
source: https://flowdrop.io/spec/rules/gr-store/store-1
specification: FlowDrop Workflow Specification 1.0-draft
licence: CC BY 4.0
---

# STORE-1 — A request body is bounded before anything is parsed

*GR-STORE (Part I) · level: core · profiles: storage-api · added in 1.0*

The cheapest refusals come first. A body that is too large, too deeply nested, or not JSON at all is turned away before any workflow-level meaning is read out of it.

## The rule

> **Normative.** This is the rule.
>
> 1. A request body must be JSON whose top level is an object or an array.
>
> 2. A body that is empty, is not well-formed JSON, decodes to a scalar (`null` included), exceeds 8 MiB of octets, or nests 64 levels or deeper is refused with 400, and nothing is stored.
>
> 3. An implementation must accept a document nested 63 levels deep.


## What it means

This is the storage door's own copy of the gate API-1 describes: the same
checks, with the numbers fixed. A body over 8 MiB, nested 64 levels or
deeper, malformed, or not an object or array at its top level never reaches
workflow-level meaning.

The depth bound is easy to get off by one. The bound is a maximum *depth*, so
a document nested 64 levels deep is already one level past what is accepted;
the deepest document an implementation must accept nests 63 levels.

The other clause that bites is the one API-1 states in general and this rule
makes concrete: a door whose body is optional is not a door the gate skips.
An absent body is fine, but a body that is present and malformed is refused
like any other — the gate does not degrade "nothing to check" into "nothing
checked".

## Example

A door whose body is optional still runs whatever is actually sent through
the same gate as any other door.

```http title="A scalar, not a shape the gate can work with" verdict="400 refused"
POST /api/flowdrop/workflows/{workflow}/playground/sessions

5
```

```http title="Well-formed on the outside, broken underneath" verdict="400 refused"
POST /api/flowdrop/workflows/{workflow}/playground/sessions

{"name": "unterminated
```

Sending nothing at all to this same door is still accepted — the gate's
bounds apply to what is sent, not to whether something was sent.

## Related rules

- Names: API-1
- Referenced by: API-1

---

Rule identifiers are permanent and are never renumbered. This specification carries
no implementation status: each implementation publishes its own standing against
these rules. Licensed CC BY 4.0.