Why APIs need pagination
Returning thousands of rows in one response wastes memory, network bandwidth and client processing time. Pagination limits the result size and lets clients retrieve data incrementally.
Filtering and sorting need validation
Filter values can normally be passed as SQL parameters. Sort column names are different because SQL parameters cannot safely represent arbitrary identifiers, so the application should map allowed client values to known SQL expressions.
Offset and cursor approaches
Offset pagination is simple and useful for many screens. Cursor pagination can provide more stable navigation over large, frequently changing datasets because it avoids repeatedly skipping earlier rows.
Practice: add page number, maximum page size, category filtering and an allow-listed sort field to a product endpoint.