Request Size Limiting Policy

Block incoming requests where the body is greater than a specific size. You can limit the payload size in bytes, kilobytes, or megabytes (default).

Because prompt payloads are client-controlled and can be large, capping request size stops oversized bodies before AI Gateway forwards them to an AI Model Provider.

For security reasons, we suggest enabling this Policy across your AI Gateway traffic to prevent a DOS (Denial of Service) attack.

The following example creates a global Request Size Limiting Policy that rejects any request body larger than 256 kilobytes:

curl -X POST https://{region}.api.konghq.com/v1/ai-gateways/{AIGatewayId}/policies \
    --header "accept: application/json" \
    --header "Content-Type: application/json" \
    --header "Authorization: Bearer $KONNECT_TOKEN" \
    --data '
    {
      "display_name": "Request Size Limiting - Global",
      "name": "request-size-limiting-global",
      "type": "request-size-limiting",
      "enabled": true,
      "global": true,
      "config": {
        "allowed_payload_size": 256,
        "size_unit": "kilobytes"
      }
    }
    '

ai_gateway_policies:
  - ref: request-size-limiting-global
    ai_gateway: !lookup {id: !env AI_GATEWAY_ID}
    display_name: Request Size Limiting - Global
    name: request-size-limiting-global
    type: request-size-limiting
    enabled: true
    global: true
    config:
      allowed_payload_size: 256
      size_unit: kilobytes