Describe the bug

GET /api/public/v2/scores?limit=N for N > 100 returns data: [] and meta: null with HTTP 200. No 4xx, no error message, no indication that the request exceeded the documented max. A naive caller that requests limit=200 sees an empty page and concludes "no scores exist."

To reproduce

Langfuse Cloud (US), observed 2026-05-11.

curl -sS -u "$PK:$SK" "$BASE/api/public/v2/scores?limit=101" \
  | jq '{data_len:(.data|length), meta:.meta, status:"HTTP 200"}'

{ "data_len": 0, "meta": null, "status": "HTTP 200" }

Same response shape for limit=200. limit=100 works normally (returns up to 100 rows with full meta).

SDK and container versions

Cloud (US). No SDK — reproduced with curl.

Additional information

Surfaced during investigation of #13559. Suggested fix: return HTTP 400 with { "error": "limit must be ≤100" } (or whatever the documented max is). Silent empty responses make this hard to debug, especially for batch verification scripts that fan out across many sessions.

Are you interested to contribute a fix for this bug?

No.