5. Pagination and filtering

5.1 Pagination (generic list and reporting list)

Parameter	Type	Default	Rules
limit	integer	25	Digits only, 1 to 100. Otherwise 400 VALIDATION_ERROR.
cursor	string	none	Generic lists: a UUID (the last id of the previous page). Reporting: a UUID. Anything else is 400.

Response shape (generic list):

{
  "data": {
    "items": [ { "id": "...", "...": "..." } ],
    "nextCursor": "0190f2c4-6b3e-7a1d-8c2f-00000000000a",
    "total": null
  },
  "error": null,
  "requestId": "<request-id>"
}

Reporting list returns { "items": [...], "nextCursor": <uuid or null> } (no total field).

Ordering is by id descending (time-ordered UUIDv7 per the architecture notes). nextCursor is null when there is no further page. total is always null.

5.2 Filtering

• The generic list endpoint reads only limit and cursor. There are no field filters in code.
• Scope filtering is applied server-side from the actor's assignments (for example, a state coordinator sees only records in their states). Clients cannot widen it.
• Some lists are restricted to the caller's own rows (exports: requester; notifications: recipient).