JSON Threat Protection policy

Updated 22 July 2026

The json-threat-protection policy validates a JSON request body by specifying limits for various JSON structures such as arrays, field names, and string values. When the policy detects an invalid request because it reaches a limit, it treats the request as a threat. The policy then rejects the request with a 400 BAD REQUEST.

Timing

On Request	On Request Content
	X

Configuration

Property	Required	Description	Type	Default
maxEntries	no	Maximum number of entries allowed for a JSON object. For example, { "a":{ "b":1, "c":2, "d":3 }}, a has three entries.	integer (-1 to specify no limit)	100
maxArraySize	no	Maximum number of elements allowed in an array.	integer (-1 to specify no limit)	100
maxDepth	no	Maximum depth of JSON structure. For example, { "a":{ "b":{ "c":true }}} has a depth of three.	integer (-1 to specify no limit)	100
maxNameLength	no	Maximum string length allowed for a JSON property name.	integer (-1 to specify no limit)	100
maxValueLength	no	Maximum string length allowed for a JSON property value.	integer (-1 to specify no limit)	500

Errors

HTTP status code

Code	Message
400	Received in the following cases: Invalid JSON structure, maximum depth exceeded, maximum JSON entries exceeded, maximum JSON array size exceeded, maximum JSON field name length exceeded, maximum JSON field value length exceeded