A request body is bounded before anything is parsed
The cheapest refusals come first. A body that is too large, too deeply nested, or not JSON at all is turned away before any workflow-level meaning is read out of it.
The rule
- A request body must be JSON whose top level is an object or an array.
- A body that is empty, is not well-formed JSON, decodes to a scalar (
nullincluded), exceeds 8 MiB of octets, or nests 64 levels or deeper is refused with 400, and nothing is stored. - An implementation must accept a document nested 63 levels deep.
What it means
This is the storage door's own copy of the gate API-1 describes: the same checks, with the numbers fixed. A body over 8 MiB, nested 64 levels or deeper, malformed, or not an object or array at its top level never reaches workflow-level meaning.
The depth bound is easy to get off by one. The bound is a maximum depth, so a document nested 64 levels deep is already one level past what is accepted; the deepest document an implementation must accept nests 63 levels.
The other clause that bites is the one API-1 states in general and this rule makes concrete: a door whose body is optional is not a door the gate skips. An absent body is fine, but a body that is present and malformed is refused like any other — the gate does not degrade "nothing to check" into "nothing checked".
Example
A door whose body is optional still runs whatever is actually sent through the same gate as any other door.
POST /api/flowdrop/workflows/{workflow}/playground/sessions
5POST /api/flowdrop/workflows/{workflow}/playground/sessions
{"name": "unterminatedSending nothing at all to this same door is still accepted — the gate's bounds apply to what is sent, not to whether something was sent.