fix(api): restore query limits on v1 list endpoints (#12876)

> Stacked on zitadel/zitadel#12875 (reuses `SystemDefaults.QueryLimit`).
Retarget to `main` once that's merged.

## Which Problems Are Solved

The v1 list endpoints (admin, auth, management, system) apply no limit.
A request without `limit` returns all matching rows, and an explicit
`limit` is never capped. The same applies to the 6 change endpoints
(`ListOrgChanges`, `ListUserChanges`, `ListProjectChanges`,
`ListProjectGrantChanges`, `ListAppChanges`, `ListMyUserChanges`).
Without a limit, they return the full history of the object. The only
bound is the audit log retention, which restricts events by age (not by
count) and is disabled by default (`AuditLogRetention: 0s`).

This is a regression. The v1 endpoints previously applied
`Auth/Admin/Mgmt.SearchLimit` (1000) through `EnsureLimit`: a missing
limit defaulted to 1000, and a higher limit was rejected. The check
lived in the old eventsourcing repositories and was dropped when the
endpoints were migrated to the `query` package:
#2342, #2433, #2383, #2612, #2820, #2818, #2838, #3075, #3096.
The `ListQuery.limit` docs still describe the old behavior.

## How the Problems Are Solved

- New `SystemDefaults.V1QueryLimit`: uses `MaxQueryLimit` (1000 by
default) as both the default and the maximum, restoring the previous v1
behavior. Limits above it return `InvalidArgument` (`QUERY-4M0fs`).
- `object.ListQueryToModel` now takes the `SystemDefaults` and applies
it. All 43 v1 call sites were updated.
- The change endpoints apply the same check through
`change.ChangeQueryToModel` (their `ChangeQuery.limit` docs promise the
same default and maximum). Console always passes 30 / 20 there.
- `SystemDefaults` is passed to the admin and system servers. Management
and auth already had them.
- Removed the `Auth.SearchLimit` and `Admin.SearchLimit` configs:
  - `Admin.SearchLimit` was never read.
- `Auth.SearchLimit` only capped the refresh tokens of
`ListMyRefreshTokens` and `RevokeAllMyRefreshTokens` (which revokes the
listed tokens). Both now use `MaxQueryLimit` instead, with the same
default of 1000. This only concerns the legacy refresh tokens, which
haven't been issued since v2.53.
- Unknown config keys are ignored, so existing configs and env vars keep
working.
- Removed the unused `EnsureLimit` methods.
- The v1 list converters take the context first, followed by the system
defaults.
- Updated the `ListQuery.limit` and `ChangeQuery.limit` API docs and the
`MaxQueryLimit` comment in `defaults.yaml`, which now describes where it
applies (v1 lists and change histories, refresh tokens) and that the
events API (`ListEvents`) keeps its own cap of 1000.

## ⚠️ Behavior change

- Requests without `limit` return at most `MaxQueryLimit` (1000)
results.
- Requests with `limit` > 1000 fail with `InvalidArgument`.
- Self-hosters can restore the previous behavior with `MaxQueryLimit:
0`. This applies globally, including to v2.

Console: all v1 list calls pass page sizes ≤ 250, except two that load
all projects of an organization:
- the startup project preload (`listProjects(0, 0)` /
`listGrantedProjects(0, 0)`), used for the project counts, shortcuts and
breadcrumbs. zitadel/zitadel#12881 replaces it (counts from
`details.totalResult`, projects loaded by ID).
- the projects grid view (`project-grid.component.ts`), which has no
pagination. With the default of 1000, it only misses projects (and
pinned grid entries) for organizations with more than 1000 owned or
granted projects. The largest organizations on ZITADEL Cloud are well
below 1000 projects.

## Additional Changes

- Deprecated the unused `query` and `result` fields of
`ListProjectGrantMemberRolesRequest`. The endpoint has no list
semantics: it always returns all roles possible on the project grant
level, like the other member role endpoints, whose requests are empty.

## Additional Context

- Tests:
  - unit tests for `V1QueryLimit` and `ListQueryToModel`
- limit-exceeded integration tests for admin `ListOrgs`, management
`ListUsers`, `ListProjects` and `ListOrgChanges`, and system
`ListInstances`
- A technical advisory covering both PRs is planned.
- Needs a v4.x backport together with zitadel/zitadel#12875.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

---------

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>

cmd/defaults.yaml

@@ -621,8 +621,6 @@ Executions:
   DenyList: # ZITADEL_EXECUTIONS_DENYLIST (comma separated list)
 
 Auth:
-  # See Projections.BulkLimit
-  SearchLimit: 1000 # ZITADEL_AUTH_SEARCHLIMIT
   Spooler:
     # See Projections.TransationDuration
     TransactionDuration: 10s #ZITADEL_AUTH_SPOOLER_TRANSACTIONDURATION
@@ -635,8 +633,6 @@ Auth:
   AmountOfCachedAuthRequests: 0 #ZITADEL_AUTH_AMOUNTOFCACHEDAUTHREQUESTS
 
 Admin:
-  # See Projections.BulkLimit
-  SearchLimit: 1000 # ZITADEL_ADMIN_SEARCHLIMIT
   Spooler:
     # See Projections.TransationDuration
     TransactionDuration: 10s
@@ -1046,8 +1042,12 @@ SystemDefaults:
   # DefaultQueryLimit limits the number of items returned by a single v2 (or newer) API list request without explicitly passing a limit.
   # 0 disables the default and returns all items.
   DefaultQueryLimit: 100 # ZITADEL_SYSTEMDEFAULTS_DEFAULTQUERYLIMIT
-  # MaxQueryLimit is the highest limit that can be explicitly passed in a single v2 (or newer) API list request.
+  # MaxQueryLimit is the highest limit that can be explicitly passed in a single API list request,
+  # including the list and change history requests of the v1 APIs.
   # Requests exceeding it fail with an InvalidArgument error. 0 disables the maximum.
+  # The v1 APIs also use it as default if no limit is passed, as well as the limit for the refresh tokens
+  # listed and revoked by the auth API (ListMyRefreshTokens, RevokeAllMyRefreshTokens).
+  # The events API (ListEvents) is not affected and always returns at most 1000 events.
   MaxQueryLimit: 1000 # ZITADEL_SYSTEMDEFAULTS_MAXQUERYLIMIT
   # The maximum duration of the IDP intent lifetime after which the IDP intent expires and can not be retrieved or used anymore.
   # Note that this time is measured only after the IdP intent was successful and not after the IDP intent was created.

cmd/start/start.go

@@ -523,7 +523,7 @@ func startAPIs(
 		return nil, fmt.Errorf("error starting admin repo: %w", err)
 	}
 
-	if err := apis.RegisterServer(ctx, system.CreateServer(commands, queries, config.Database.DatabaseName(), config.DefaultInstance, config.ExternalDomain), tlsConfig); err != nil {
+	if err := apis.RegisterServer(ctx, system.CreateServer(config.SystemDefaults, commands, queries, config.Database.DatabaseName(), config.DefaultInstance, config.ExternalDomain), tlsConfig); err != nil {
 		return nil, err
 	}
 	if err := apis.RegisterService(ctx, instance_v2beta.CreateServer(config.SystemDefaults, commands, queries, config.Database.DatabaseName(), config.DefaultInstance, config.ExternalDomain)); err != nil {
@@ -532,7 +532,7 @@ func startAPIs(
 	if err := apis.RegisterService(ctx, instance_v2.CreateServer(config.SystemDefaults, commands, queries, config.DefaultInstance, config.ExternalDomain, permissionCheck)); err != nil {
 		return nil, err
 	}
-	if err := apis.RegisterServer(ctx, admin.CreateServer(config.Database.DatabaseName(), commands, queries, keys.User, config.AuditLogRetention), tlsConfig); err != nil {
+	if err := apis.RegisterServer(ctx, admin.CreateServer(config.SystemDefaults, config.Database.DatabaseName(), commands, queries, keys.User, config.AuditLogRetention), tlsConfig); err != nil {
 		return nil, err
 	}
 	if err := apis.RegisterServer(ctx, management.CreateServer(commands, queries, config.SystemDefaults, keys.User), tlsConfig); err != nil {

internal/api/grpc/admin/email.go

@@ -93,7 +93,7 @@ func (s *Server) UpdateEmailProviderSMTPPassword(ctx context.Context, req *admin
 }
 
 func (s *Server) ListEmailProviders(ctx context.Context, req *admin_pb.ListEmailProvidersRequest) (*admin_pb.ListEmailProvidersResponse, error) {
-	queries, err := listEmailProvidersToModel(req)
+	queries, err := listEmailProvidersToModel(s.systemDefaults, req)
 	if err != nil {
 		return nil, err
 	}

internal/api/grpc/admin/email_converters.go

@@ -6,6 +6,7 @@ import (
 	"github.com/zitadel/zitadel/internal/api/authz"
 	"github.com/zitadel/zitadel/internal/api/grpc/object"
 	"github.com/zitadel/zitadel/internal/command"
+	"github.com/zitadel/zitadel/internal/config/systemdefaults"
 	"github.com/zitadel/zitadel/internal/domain"
 	"github.com/zitadel/zitadel/internal/notification/channels/smtp"
 	"github.com/zitadel/zitadel/internal/query"
@@ -13,8 +14,11 @@ import (
 	settings_pb "github.com/zitadel/zitadel/pkg/grpc/settings"
 )
 
-func listEmailProvidersToModel(req *admin_pb.ListEmailProvidersRequest) (*query.SMTPConfigsSearchQueries, error) {
-	offset, limit, asc := object.ListQueryToModel(req.Query)
+func listEmailProvidersToModel(defaults systemdefaults.SystemDefaults, req *admin_pb.ListEmailProvidersRequest) (*query.SMTPConfigsSearchQueries, error) {
+	offset, limit, asc, err := object.ListQueryToModel(defaults, req.Query)
+	if err != nil {
+		return nil, err
+	}
 	return &query.SMTPConfigsSearchQueries{
 		SearchRequest: query.SearchRequest{
 			Offset: offset,

internal/api/grpc/admin/email_converters_test.go

@@ -12,6 +12,7 @@ import (
 
 	"github.com/zitadel/zitadel/internal/api/authz"
 	"github.com/zitadel/zitadel/internal/command"
+	"github.com/zitadel/zitadel/internal/config/systemdefaults"
 	"github.com/zitadel/zitadel/internal/domain"
 	"github.com/zitadel/zitadel/internal/notification/channels/smtp"
 	"github.com/zitadel/zitadel/internal/query"
@@ -51,7 +52,7 @@ func Test_listEmailProvidersToModel(t *testing.T) {
 	}
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
-			got, err := listEmailProvidersToModel(tt.args.req)
+			got, err := listEmailProvidersToModel(systemdefaults.SystemDefaults{MaxQueryLimit: 1000}, tt.args.req)
 			require.NoError(t, err)
 			assert.Equal(t, tt.res, got)
 		})

internal/api/grpc/admin/iam_member.go

@@ -19,7 +19,7 @@ func (s *Server) ListIAMMemberRoles(ctx context.Context, req *admin_pb.ListIAMMe
 }
 
 func (s *Server) ListIAMMembers(ctx context.Context, req *admin_pb.ListIAMMembersRequest) (*admin_pb.ListIAMMembersResponse, error) {
-	queries, err := ListIAMMembersRequestToQuery(req)
+	queries, err := ListIAMMembersRequestToQuery(s.systemDefaults, req)
 	if err != nil {
 		return nil, err
 	}

internal/api/grpc/admin/iam_member_converter.go

@@ -4,6 +4,7 @@ import (
 	member_grpc "github.com/zitadel/zitadel/internal/api/grpc/member"
 	"github.com/zitadel/zitadel/internal/api/grpc/object"
 	"github.com/zitadel/zitadel/internal/command"
+	"github.com/zitadel/zitadel/internal/config/systemdefaults"
 	"github.com/zitadel/zitadel/internal/query"
 	admin_pb "github.com/zitadel/zitadel/pkg/grpc/admin"
 	member_pb "github.com/zitadel/zitadel/pkg/grpc/member"
@@ -25,8 +26,11 @@ func UpdateIAMMemberToCommand(req *admin_pb.UpdateIAMMemberRequest, instanceID s
 	}
 }
 
-func ListIAMMembersRequestToQuery(req *admin_pb.ListIAMMembersRequest) (*query.IAMMembersQuery, error) {
-	offset, limit, asc := object.ListQueryToModel(req.Query)
+func ListIAMMembersRequestToQuery(defaults systemdefaults.SystemDefaults, req *admin_pb.ListIAMMembersRequest) (*query.IAMMembersQuery, error) {
+	offset, limit, asc, err := object.ListQueryToModel(defaults, req.Query)
+	if err != nil {
+		return nil, err
+	}
 	queries, err := member_grpc.MemberQueriesToQuery(req.Queries)
 	if err != nil {
 		return nil, err

internal/api/grpc/admin/iam_settings.go

@@ -8,7 +8,7 @@ import (
 )
 
 func (s *Server) ListSecretGenerators(ctx context.Context, req *admin_pb.ListSecretGeneratorsRequest) (*admin_pb.ListSecretGeneratorsResponse, error) {
-	queries, err := listSecretGeneratorToModel(req)
+	queries, err := listSecretGeneratorToModel(s.systemDefaults, req)
 	if err != nil {
 		return nil, err
 	}

internal/api/grpc/admin/iam_settings_converter.go

@@ -9,6 +9,7 @@ import (
 	"github.com/zitadel/zitadel/internal/api/grpc/object"
 	obj_grpc "github.com/zitadel/zitadel/internal/api/grpc/object"
 	"github.com/zitadel/zitadel/internal/command"
+	"github.com/zitadel/zitadel/internal/config/systemdefaults"
 	"github.com/zitadel/zitadel/internal/crypto"
 	"github.com/zitadel/zitadel/internal/domain"
 	"github.com/zitadel/zitadel/internal/query"
@@ -17,8 +18,11 @@ import (
 	settings_pb "github.com/zitadel/zitadel/pkg/grpc/settings"
 )
 
-func listSecretGeneratorToModel(req *admin_pb.ListSecretGeneratorsRequest) (*query.SecretGeneratorSearchQueries, error) {
-	offset, limit, asc := object.ListQueryToModel(req.Query)
+func listSecretGeneratorToModel(defaults systemdefaults.SystemDefaults, req *admin_pb.ListSecretGeneratorsRequest) (*query.SecretGeneratorSearchQueries, error) {
+	offset, limit, asc, err := object.ListQueryToModel(defaults, req.Query)
+	if err != nil {
+		return nil, err
+	}
 	queries, err := SecretGeneratorQueriesToModel(req.Queries)
 	if err != nil {
 		return nil, err

internal/api/grpc/admin/idp.go

@@ -20,7 +20,7 @@ func (s *Server) GetIDPByID(ctx context.Context, req *admin_pb.GetIDPByIDRequest
 }
 
 func (s *Server) ListIDPs(ctx context.Context, req *admin_pb.ListIDPsRequest) (*admin_pb.ListIDPsResponse, error) {
-	queries, err := listIDPsToModel(authz.GetInstance(ctx).InstanceID(), req)
+	queries, err := listIDPsToModel(s.systemDefaults, authz.GetInstance(ctx).InstanceID(), req)
 	if err != nil {
 		return nil, err
 	}
@@ -165,7 +165,7 @@ func (s *Server) GetProviderByID(ctx context.Context, req *admin_pb.GetProviderB
 }
 
 func (s *Server) ListProviders(ctx context.Context, req *admin_pb.ListProvidersRequest) (*admin_pb.ListProvidersResponse, error) {
-	queries, err := listProvidersToQuery(authz.GetInstance(ctx).InstanceID(), req)
+	queries, err := listProvidersToQuery(s.systemDefaults, authz.GetInstance(ctx).InstanceID(), req)
 	if err != nil {
 		return nil, err
 	}

internal/api/grpc/admin/idp_converter.go

@@ -8,6 +8,7 @@ import (
 	idp_grpc "github.com/zitadel/zitadel/internal/api/grpc/idp"
 	"github.com/zitadel/zitadel/internal/api/grpc/object"
 	"github.com/zitadel/zitadel/internal/command"
+	"github.com/zitadel/zitadel/internal/config/systemdefaults"
 	"github.com/zitadel/zitadel/internal/domain"
 	"github.com/zitadel/zitadel/internal/eventstore/v1/models"
 	"github.com/zitadel/zitadel/internal/query"
@@ -88,8 +89,11 @@ func updateJWTConfigToDomain(req *admin_pb.UpdateIDPJWTConfigRequest) *domain.JW
 	}
 }
 
-func listIDPsToModel(instanceID string, req *admin_pb.ListIDPsRequest) (*query.IDPSearchQueries, error) {
-	offset, limit, asc := object.ListQueryToModel(req.Query)
+func listIDPsToModel(defaults systemdefaults.SystemDefaults, instanceID string, req *admin_pb.ListIDPsRequest) (*query.IDPSearchQueries, error) {
+	offset, limit, asc, err := object.ListQueryToModel(defaults, req.Query)
+	if err != nil {
+		return nil, err
+	}
 	queries, err := idpQueriesToModel(req.Queries)
 	if err != nil {
 		return nil, err
@@ -163,8 +167,11 @@ func idpUserLinksToDomain(idps []*query.IDPUserLink) []*domain.UserIDPLink {
 	return externalIDPs
 }
 
-func listProvidersToQuery(instanceID string, req *admin_pb.ListProvidersRequest) (*query.IDPTemplateSearchQueries, error) {
-	offset, limit, asc := object.ListQueryToModel(req.Query)
+func listProvidersToQuery(defaults systemdefaults.SystemDefaults, instanceID string, req *admin_pb.ListProvidersRequest) (*query.IDPTemplateSearchQueries, error) {
+	offset, limit, asc, err := object.ListQueryToModel(defaults, req.Query)
+	if err != nil {
+		return nil, err
+	}
 	queries, err := providerQueriesToQuery(req.Queries)
 	if err != nil {
 		return nil, err

internal/api/grpc/admin/instance.go

@@ -19,7 +19,7 @@ func (s *Server) GetMyInstance(ctx context.Context, _ *admin_pb.GetMyInstanceReq
 }
 
 func (s *Server) ListInstanceDomains(ctx context.Context, req *admin_pb.ListInstanceDomainsRequest) (*admin_pb.ListInstanceDomainsResponse, error) {
-	queries, err := ListInstanceDomainsRequestToModel(req)
+	queries, err := ListInstanceDomainsRequestToModel(s.systemDefaults, req)
 	if err != nil {
 		return nil, err
 	}
@@ -40,7 +40,7 @@ func (s *Server) ListInstanceDomains(ctx context.Context, req *admin_pb.ListInst
 }
 
 func (s *Server) ListInstanceTrustedDomains(ctx context.Context, req *admin_pb.ListInstanceTrustedDomainsRequest) (*admin_pb.ListInstanceTrustedDomainsResponse, error) {
-	queries, err := ListInstanceTrustedDomainsRequestToModel(req)
+	queries, err := ListInstanceTrustedDomainsRequestToModel(s.systemDefaults, req)
 	if err != nil {
 		return nil, err
 	}

internal/api/grpc/admin/instance_converter.go

@@ -3,13 +3,17 @@ package admin
 import (
 	instance_grpc "github.com/zitadel/zitadel/internal/api/grpc/instance"
 	"github.com/zitadel/zitadel/internal/api/grpc/object"
+	"github.com/zitadel/zitadel/internal/config/systemdefaults"
 	"github.com/zitadel/zitadel/internal/query"
 	admin_pb "github.com/zitadel/zitadel/pkg/grpc/admin"
 	"github.com/zitadel/zitadel/pkg/grpc/instance"
 )
 
-func ListInstanceDomainsRequestToModel(req *admin_pb.ListInstanceDomainsRequest) (*query.InstanceDomainSearchQueries, error) {
-	offset, limit, asc := object.ListQueryToModel(req.Query)
+func ListInstanceDomainsRequestToModel(defaults systemdefaults.SystemDefaults, req *admin_pb.ListInstanceDomainsRequest) (*query.InstanceDomainSearchQueries, error) {
+	offset, limit, asc, err := object.ListQueryToModel(defaults, req.Query)
+	if err != nil {
+		return nil, err
+	}
 	queries, err := instance_grpc.DomainQueriesToModel(req.Queries)
 	if err != nil {
 		return nil, err
@@ -40,8 +44,11 @@ func fieldNameToInstanceDomainColumn(fieldName instance.DomainFieldName) query.C
 	}
 }
 
-func ListInstanceTrustedDomainsRequestToModel(req *admin_pb.ListInstanceTrustedDomainsRequest) (*query.InstanceTrustedDomainSearchQueries, error) {
-	offset, limit, asc := object.ListQueryToModel(req.Query)
+func ListInstanceTrustedDomainsRequestToModel(defaults systemdefaults.SystemDefaults, req *admin_pb.ListInstanceTrustedDomainsRequest) (*query.InstanceTrustedDomainSearchQueries, error) {
+	offset, limit, asc, err := object.ListQueryToModel(defaults, req.Query)
+	if err != nil {
+		return nil, err
+	}
 	queries, err := instance_grpc.TrustedDomainQueriesToModel(req.Queries)
 	if err != nil {
 		return nil, err

internal/api/grpc/admin/integration_test/list_limit_test.go

@@ -0,0 +1,23 @@
+//go:build integration
+
+package admin_test
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/require"
+	"google.golang.org/grpc/codes"
+	"google.golang.org/grpc/status"
+
+	admin_pb "github.com/zitadel/zitadel/pkg/grpc/admin"
+	"github.com/zitadel/zitadel/pkg/grpc/object"
+)
+
+func TestServer_ListOrgs_LimitExceeded(t *testing.T) {
+	t.Parallel()
+
+	_, err := Client.ListOrgs(AdminCTX, &admin_pb.ListOrgsRequest{
+		Query: &object.ListQuery{Limit: 1001},
+	})
+	require.Equal(t, codes.InvalidArgument, status.Code(err))
+}

internal/api/grpc/admin/login_policy.go

@@ -34,7 +34,11 @@ func (s *Server) UpdateLoginPolicy(ctx context.Context, p *admin_pb.UpdateLoginP
 }
 
 func (s *Server) ListLoginPolicyIDPs(ctx context.Context, req *admin_pb.ListLoginPolicyIDPsRequest) (*admin_pb.ListLoginPolicyIDPsResponse, error) {
-	res, err := s.query.IDPLoginPolicyLinks(ctx, authz.GetInstance(ctx).InstanceID(), ListLoginPolicyIDPsRequestToQuery(req), false)
+	queries, err := ListLoginPolicyIDPsRequestToQuery(s.systemDefaults, req)
+	if err != nil {
+		return nil, err
+	}
+	res, err := s.query.IDPLoginPolicyLinks(ctx, authz.GetInstance(ctx).InstanceID(), queries, false)
 	if err != nil {
 		return nil, err
 	}

internal/api/grpc/admin/login_policy_converter.go

@@ -4,6 +4,7 @@ import (
 	"github.com/zitadel/zitadel/internal/api/grpc/object"
 	policy_grpc "github.com/zitadel/zitadel/internal/api/grpc/policy"
 	"github.com/zitadel/zitadel/internal/command"
+	"github.com/zitadel/zitadel/internal/config/systemdefaults"
 	"github.com/zitadel/zitadel/internal/query"
 	admin_pb "github.com/zitadel/zitadel/pkg/grpc/admin"
 )
@@ -30,13 +31,16 @@ func updateLoginPolicyToCommand(p *admin_pb.UpdateLoginPolicyRequest) *command.C
 	}
 }
 
-func ListLoginPolicyIDPsRequestToQuery(req *admin_pb.ListLoginPolicyIDPsRequest) *query.IDPLoginPolicyLinksSearchQuery {
-	offset, limit, asc := object.ListQueryToModel(req.Query)
+func ListLoginPolicyIDPsRequestToQuery(defaults systemdefaults.SystemDefaults, req *admin_pb.ListLoginPolicyIDPsRequest) (*query.IDPLoginPolicyLinksSearchQuery, error) {
+	offset, limit, asc, err := object.ListQueryToModel(defaults, req.Query)
+	if err != nil {
+		return nil, err
+	}
 	return &query.IDPLoginPolicyLinksSearchQuery{
 		SearchRequest: query.SearchRequest{
 			Offset: offset,
 			Limit:  limit,
 			Asc:    asc,
 		},
-	}
+	}, nil
 }

internal/api/grpc/admin/milestone.go

@@ -9,7 +9,7 @@ import (
 )
 
 func (s *Server) ListMilestones(ctx context.Context, req *admin.ListMilestonesRequest) (*admin.ListMilestonesResponse, error) {
-	queries, err := listMilestonesToModel(authz.GetInstance(ctx).InstanceID(), req)
+	queries, err := listMilestonesToModel(s.systemDefaults, authz.GetInstance(ctx).InstanceID(), req)
 	if err != nil {
 		return nil, err
 	}

internal/api/grpc/admin/milestone_converter.go

@@ -4,6 +4,7 @@ import (
 	"google.golang.org/protobuf/types/known/timestamppb"
 
 	"github.com/zitadel/zitadel/internal/api/grpc/object"
+	"github.com/zitadel/zitadel/internal/config/systemdefaults"
 	"github.com/zitadel/zitadel/internal/query"
 	"github.com/zitadel/zitadel/internal/repository/milestone"
 	"github.com/zitadel/zitadel/internal/zerrors"
@@ -11,8 +12,11 @@ import (
 	milestone_pb "github.com/zitadel/zitadel/pkg/grpc/milestone"
 )
 
-func listMilestonesToModel(instanceID string, req *admin_pb.ListMilestonesRequest) (*query.MilestonesSearchQueries, error) {
-	offset, limit, asc := object.ListQueryToModel(req.Query)
+func listMilestonesToModel(defaults systemdefaults.SystemDefaults, instanceID string, req *admin_pb.ListMilestonesRequest) (*query.MilestonesSearchQueries, error) {
+	offset, limit, asc, err := object.ListQueryToModel(defaults, req.Query)
+	if err != nil {
+		return nil, err
+	}
 	queries, err := milestoneQueriesToModel(req.GetQueries())
 	instanceIDQuery, err := query.NewTextQuery(query.MilestoneInstanceIDColID, instanceID, query.TextEquals)
 	if err != nil {

internal/api/grpc/admin/org.go

@@ -54,7 +54,7 @@ func (s *Server) GetOrgByID(ctx context.Context, req *admin_pb.GetOrgByIDRequest
 }
 
 func (s *Server) ListOrgs(ctx context.Context, req *admin_pb.ListOrgsRequest) (*admin_pb.ListOrgsResponse, error) {
-	queries, err := listOrgRequestToModel(req)
+	queries, err := listOrgRequestToModel(s.systemDefaults, req)
 	if err != nil {
 		return nil, err
 	}

internal/api/grpc/admin/org_converter.go

@@ -3,12 +3,16 @@ package admin
 import (
 	"github.com/zitadel/zitadel/internal/api/grpc/object"
 	org_grpc "github.com/zitadel/zitadel/internal/api/grpc/org"
+	"github.com/zitadel/zitadel/internal/config/systemdefaults"
 	"github.com/zitadel/zitadel/internal/query"
 	"github.com/zitadel/zitadel/pkg/grpc/admin"
 )
 
-func listOrgRequestToModel(req *admin.ListOrgsRequest) (*query.OrgSearchQueries, error) {
-	offset, limit, asc := object.ListQueryToModel(req.Query)
+func listOrgRequestToModel(defaults systemdefaults.SystemDefaults, req *admin.ListOrgsRequest) (*query.OrgSearchQueries, error) {
+	offset, limit, asc, err := object.ListQueryToModel(defaults, req.Query)
+	if err != nil {
+		return nil, err
+	}
 	queries, err := org_grpc.OrgQueriesToModel(req.Queries)
 	if err != nil {
 		return nil, err

internal/api/grpc/admin/server.go

@@ -11,6 +11,7 @@ import (
 	"github.com/zitadel/zitadel/internal/api/authz"
 	"github.com/zitadel/zitadel/internal/api/grpc/server"
 	"github.com/zitadel/zitadel/internal/command"
+	"github.com/zitadel/zitadel/internal/config/systemdefaults"
 	"github.com/zitadel/zitadel/internal/crypto"
 	"github.com/zitadel/zitadel/internal/query"
 	"github.com/zitadel/zitadel/pkg/grpc/admin"
@@ -25,6 +26,7 @@ var _ admin.AdminServiceServer = (*Server)(nil)
 type Server struct {
 	admin.UnimplementedAdminServiceServer
 	database          string
+	systemDefaults    systemdefaults.SystemDefaults
 	command           *command.Commands
 	query             *query.Queries
 	assetsAPIDomain   func(context.Context) string
@@ -37,6 +39,7 @@ type Config struct {
 }
 
 func CreateServer(
+	systemDefaults systemdefaults.SystemDefaults,
 	database string,
 	command *command.Commands,
 	query *query.Queries,
@@ -44,6 +47,7 @@ func CreateServer(
 	auditLogRetention time.Duration,
 ) *Server {
 	return &Server{
+		systemDefaults:    systemDefaults,
 		database:          database,
 		command:           command,
 		query:             query,

internal/api/grpc/admin/sms.go

@@ -9,7 +9,7 @@ import (
 )
 
 func (s *Server) ListSMSProviders(ctx context.Context, req *admin_pb.ListSMSProvidersRequest) (*admin_pb.ListSMSProvidersResponse, error) {
-	queries, err := listSMSConfigsToModel(req)
+	queries, err := listSMSConfigsToModel(s.systemDefaults, req)
 	if err != nil {
 		return nil, err
 	}

internal/api/grpc/admin/sms_converter.go

@@ -8,14 +8,18 @@ import (
 	"github.com/zitadel/zitadel/internal/api/authz"
 	"github.com/zitadel/zitadel/internal/api/grpc/object"
 	"github.com/zitadel/zitadel/internal/command"
+	"github.com/zitadel/zitadel/internal/config/systemdefaults"
 	"github.com/zitadel/zitadel/internal/domain"
 	"github.com/zitadel/zitadel/internal/query"
 	admin_pb "github.com/zitadel/zitadel/pkg/grpc/admin"
 	settings_pb "github.com/zitadel/zitadel/pkg/grpc/settings"
 )
 
-func listSMSConfigsToModel(req *admin_pb.ListSMSProvidersRequest) (*query.SMSConfigsSearchQueries, error) {
-	offset, limit, asc := object.ListQueryToModel(req.Query)
+func listSMSConfigsToModel(defaults systemdefaults.SystemDefaults, req *admin_pb.ListSMSProvidersRequest) (*query.SMSConfigsSearchQueries, error) {
+	offset, limit, asc, err := object.ListQueryToModel(defaults, req.Query)
+	if err != nil {
+		return nil, err
+	}
 	return &query.SMSConfigsSearchQueries{
 		SearchRequest: query.SearchRequest{
 			Offset: offset,

internal/api/grpc/admin/sms_converters_test.go

@@ -13,6 +13,7 @@ import (
 
 	"github.com/zitadel/zitadel/internal/api/authz"
 	"github.com/zitadel/zitadel/internal/command"
+	"github.com/zitadel/zitadel/internal/config/systemdefaults"
 	"github.com/zitadel/zitadel/internal/domain"
 	"github.com/zitadel/zitadel/internal/query"
 	admin_pb "github.com/zitadel/zitadel/pkg/grpc/admin"
@@ -51,7 +52,7 @@ func Test_listSMSConfigsToModel(t *testing.T) {
 	}
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
-			got, err := listSMSConfigsToModel(tt.args.req)
+			got, err := listSMSConfigsToModel(systemdefaults.SystemDefaults{MaxQueryLimit: 1000}, tt.args.req)
 			require.NoError(t, err)
 			assert.Equal(t, tt.res, got)
 		})

internal/api/grpc/admin/smtp.go

@@ -78,7 +78,7 @@ func (s *Server) UpdateSMTPConfigPassword(ctx context.Context, req *admin_pb.Upd
 
 // Deprecated: use [ListEmailProviders] instead.
 func (s *Server) ListSMTPConfigs(ctx context.Context, req *admin_pb.ListSMTPConfigsRequest) (*admin_pb.ListSMTPConfigsResponse, error) {
-	queries, err := listSMTPConfigsToModel(req)
+	queries, err := listSMTPConfigsToModel(s.systemDefaults, req)
 	if err != nil {
 		return nil, err
 	}

internal/api/grpc/admin/smtp_converters.go

@@ -2,14 +2,18 @@ package admin
 
 import (
 	"github.com/zitadel/zitadel/internal/api/grpc/object"
+	"github.com/zitadel/zitadel/internal/config/systemdefaults"
 	"github.com/zitadel/zitadel/internal/domain"
 	"github.com/zitadel/zitadel/internal/query"
 	admin_pb "github.com/zitadel/zitadel/pkg/grpc/admin"
 	settings_pb "github.com/zitadel/zitadel/pkg/grpc/settings"
 )
 
-func listSMTPConfigsToModel(req *admin_pb.ListSMTPConfigsRequest) (*query.SMTPConfigsSearchQueries, error) {
-	offset, limit, asc := object.ListQueryToModel(req.Query)
+func listSMTPConfigsToModel(defaults systemdefaults.SystemDefaults, req *admin_pb.ListSMTPConfigsRequest) (*query.SMTPConfigsSearchQueries, error) {
+	offset, limit, asc, err := object.ListQueryToModel(defaults, req.Query)
+	if err != nil {
+		return nil, err
+	}
 	return &query.SMTPConfigsSearchQueries{
 		SearchRequest: query.SearchRequest{
 			Offset: offset,

internal/api/grpc/auth/idp.go

@@ -9,7 +9,7 @@ import (
 )
 
 func (s *Server) ListMyLinkedIDPs(ctx context.Context, req *auth_pb.ListMyLinkedIDPsRequest) (*auth_pb.ListMyLinkedIDPsResponse, error) {
-	q, err := ListMyLinkedIDPsRequestToQuery(ctx, req)
+	q, err := ListMyLinkedIDPsRequestToQuery(ctx, s.defaults, req)
 	if err != nil {
 		return nil, err
 	}

internal/api/grpc/auth/idp_converter.go

@@ -5,13 +5,17 @@ import (
 
 	"github.com/zitadel/zitadel/internal/api/authz"
 	"github.com/zitadel/zitadel/internal/api/grpc/object"
+	"github.com/zitadel/zitadel/internal/config/systemdefaults"
 	"github.com/zitadel/zitadel/internal/domain"
 	"github.com/zitadel/zitadel/internal/query"
 	auth_pb "github.com/zitadel/zitadel/pkg/grpc/auth"
 )
 
-func ListMyLinkedIDPsRequestToQuery(ctx context.Context, req *auth_pb.ListMyLinkedIDPsRequest) (*query.IDPUserLinksSearchQuery, error) {
-	offset, limit, asc := object.ListQueryToModel(req.Query)
+func ListMyLinkedIDPsRequestToQuery(ctx context.Context, defaults systemdefaults.SystemDefaults, req *auth_pb.ListMyLinkedIDPsRequest) (*query.IDPUserLinksSearchQuery, error) {
+	offset, limit, asc, err := object.ListQueryToModel(defaults, req.Query)
+	if err != nil {
+		return nil, err
+	}
 	q, err := query.NewIDPUserLinksUserIDSearchQuery(authz.GetCtxData(ctx).UserID)
 	if err != nil {
 		return nil, err

internal/api/grpc/auth/metadata_converter.go

@@ -3,6 +3,7 @@ package auth
 import (
 	"github.com/zitadel/zitadel/internal/api/grpc/metadata"
 	"github.com/zitadel/zitadel/internal/api/grpc/object"
+	"github.com/zitadel/zitadel/internal/config/systemdefaults"
 	"github.com/zitadel/zitadel/internal/domain"
 	"github.com/zitadel/zitadel/internal/query"
 	"github.com/zitadel/zitadel/pkg/grpc/auth"
@@ -19,8 +20,11 @@ func BulkSetMetadataToDomain(req *auth.BulkSetMyMetadataRequest) []*domain.Metad
 	return metadata
 }
 
-func ListUserMetadataToQuery(req *auth.ListMyMetadataRequest) (*query.UserMetadataSearchQueries, error) {
-	offset, limit, asc := object.ListQueryToModel(req.Query)
+func ListUserMetadataToQuery(defaults systemdefaults.SystemDefaults, req *auth.ListMyMetadataRequest) (*query.UserMetadataSearchQueries, error) {
+	offset, limit, asc, err := object.ListQueryToModel(defaults, req.Query)
+	if err != nil {
+		return nil, err
+	}
 	queries, err := metadata.UserMetadataQueriesToQuery(req.Queries)
 	if err != nil {
 		return nil, err

internal/api/grpc/auth/permission.go

@@ -44,7 +44,7 @@ func (s *Server) ListMyProjectPermissions(ctx context.Context, _ *auth_pb.ListMy
 }
 
 func (s *Server) ListMyMemberships(ctx context.Context, req *auth_pb.ListMyMembershipsRequest) (*auth_pb.ListMyMembershipsResponse, error) {
-	request, err := ListMyMembershipsRequestToModel(ctx, req)
+	request, err := ListMyMembershipsRequestToModel(ctx, s.defaults, req)
 	if err != nil {
 		return nil, err
 	}

internal/api/grpc/auth/permission_converter.go

@@ -6,12 +6,16 @@ import (
 	"github.com/zitadel/zitadel/internal/api/authz"
 	"github.com/zitadel/zitadel/internal/api/grpc/object"
 	user_grpc "github.com/zitadel/zitadel/internal/api/grpc/user"
+	"github.com/zitadel/zitadel/internal/config/systemdefaults"
 	"github.com/zitadel/zitadel/internal/query"
 	auth_pb "github.com/zitadel/zitadel/pkg/grpc/auth"
 )
 
-func ListMyMembershipsRequestToModel(ctx context.Context, req *auth_pb.ListMyMembershipsRequest) (*query.MembershipSearchQuery, error) {
-	offset, limit, asc := object.ListQueryToModel(req.Query)
+func ListMyMembershipsRequestToModel(ctx context.Context, defaults systemdefaults.SystemDefaults, req *auth_pb.ListMyMembershipsRequest) (*query.MembershipSearchQuery, error) {
+	offset, limit, asc, err := object.ListQueryToModel(defaults, req.Query)
+	if err != nil {
+		return nil, err
+	}
 	queries, err := user_grpc.MembershipQueriesToQuery(req.Queries)
 	if err != nil {
 		return nil, err

internal/api/grpc/auth/user.go

@@ -10,6 +10,7 @@ import (
 	"github.com/zitadel/zitadel/internal/api/grpc/org"
 	user_grpc "github.com/zitadel/zitadel/internal/api/grpc/user"
 	"github.com/zitadel/zitadel/internal/command"
+	"github.com/zitadel/zitadel/internal/config/systemdefaults"
 	"github.com/zitadel/zitadel/internal/eventstore"
 	"github.com/zitadel/zitadel/internal/eventstore/v1/models"
 	"github.com/zitadel/zitadel/internal/query"
@@ -61,15 +62,9 @@ func (s *Server) RemoveMyUser(ctx context.Context, _ *auth_pb.RemoveMyUserReques
 }
 
 func (s *Server) ListMyUserChanges(ctx context.Context, req *auth_pb.ListMyUserChangesRequest) (*auth_pb.ListMyUserChangesResponse, error) {
-	var (
-		limit    uint64
-		sequence uint64
-		asc      bool
-	)
-	if req.Query != nil {
-		limit = uint64(req.Query.Limit)
-		sequence = req.Query.Sequence
-		asc = req.Query.Asc
+	limit, sequence, asc, err := change.ChangeQueryToModel(s.defaults, req.Query)
+	if err != nil {
+		return nil, err
 	}
 
 	query := eventstore.NewSearchQueryBuilder(eventstore.ColumnsEvent).
@@ -97,7 +92,7 @@ func (s *Server) ListMyUserChanges(ctx context.Context, req *auth_pb.ListMyUserC
 }
 
 func (s *Server) ListMyMetadata(ctx context.Context, req *auth_pb.ListMyMetadataRequest) (*auth_pb.ListMyMetadataResponse, error) {
-	queries, err := ListUserMetadataToQuery(req)
+	queries, err := ListUserMetadataToQuery(s.defaults, req)
 	if err != nil {
 		return nil, err
 	}
@@ -151,7 +146,7 @@ func ctxToObjectRoot(ctx context.Context) models.ObjectRoot {
 }
 
 func (s *Server) ListMyUserGrants(ctx context.Context, req *auth_pb.ListMyUserGrantsRequest) (*auth_pb.ListMyUserGrantsResponse, error) {
-	queries, err := ListMyUserGrantsRequestToQuery(ctx, req)
+	queries, err := ListMyUserGrantsRequestToQuery(ctx, s.defaults, req)
 	if err != nil {
 		return nil, err
 	}
@@ -166,7 +161,7 @@ func (s *Server) ListMyUserGrants(ctx context.Context, req *auth_pb.ListMyUserGr
 }
 
 func (s *Server) ListMyProjectOrgs(ctx context.Context, req *auth_pb.ListMyProjectOrgsRequest) (*auth_pb.ListMyProjectOrgsResponse, error) {
-	queries, err := ListMyProjectOrgsRequestToQuery(req)
+	queries, err := ListMyProjectOrgsRequestToQuery(s.defaults, req)
 	if err != nil {
 		return nil, err
 	}
@@ -261,8 +256,11 @@ func appendIfNotExists(array []string, value string) []string {
 	return append(array, value)
 }
 
-func ListMyProjectOrgsRequestToQuery(req *auth_pb.ListMyProjectOrgsRequest) (*query.OrgSearchQueries, error) {
-	offset, limit, asc := obj_grpc.ListQueryToModel(req.Query)
+func ListMyProjectOrgsRequestToQuery(defaults systemdefaults.SystemDefaults, req *auth_pb.ListMyProjectOrgsRequest) (*query.OrgSearchQueries, error) {
+	offset, limit, asc, err := obj_grpc.ListQueryToModel(defaults, req.Query)
+	if err != nil {
+		return nil, err
+	}
 	queries, err := org.OrgQueriesToModel(req.Queries)
 	if err != nil {
 		return nil, err

internal/api/grpc/auth/user_grant.go

@@ -6,12 +6,16 @@ import (
 	"github.com/zitadel/zitadel/internal/api/authz"
 	"github.com/zitadel/zitadel/internal/api/grpc/object"
 	"github.com/zitadel/zitadel/internal/api/grpc/user"
+	"github.com/zitadel/zitadel/internal/config/systemdefaults"
 	"github.com/zitadel/zitadel/internal/query"
 	auth_pb "github.com/zitadel/zitadel/pkg/grpc/auth"
 )
 
-func ListMyUserGrantsRequestToQuery(ctx context.Context, req *auth_pb.ListMyUserGrantsRequest) (*query.UserGrantsQueries, error) {
-	offset, limit, asc := object.ListQueryToModel(req.Query)
+func ListMyUserGrantsRequestToQuery(ctx context.Context, defaults systemdefaults.SystemDefaults, req *auth_pb.ListMyUserGrantsRequest) (*query.UserGrantsQueries, error) {
+	offset, limit, asc, err := object.ListQueryToModel(defaults, req.Query)
+	if err != nil {
+		return nil, err
+	}
 	userGrantUserID, err := query.NewUserGrantUserIDSearchQuery(authz.GetCtxData(ctx).UserID)
 	if err != nil {
 		return nil, err

internal/api/grpc/change/changes.go

@@ -3,12 +3,23 @@ package change
 import (
 	"google.golang.org/protobuf/types/known/timestamppb"
 
+	"github.com/zitadel/zitadel/internal/config/systemdefaults"
 	"github.com/zitadel/zitadel/internal/domain"
 	"github.com/zitadel/zitadel/internal/query"
 	change_pb "github.com/zitadel/zitadel/pkg/grpc/change"
 	"github.com/zitadel/zitadel/pkg/grpc/message"
 )
 
+// ChangeQueryToModel returns the limit, the sequence and the sorting order of the change query.
+// The limit is defaulted and checked by [systemdefaults.SystemDefaults.V1QueryLimit].
+func ChangeQueryToModel(defaults systemdefaults.SystemDefaults, query *change_pb.ChangeQuery) (limit, sequence uint64, asc bool, err error) {
+	limit, err = defaults.V1QueryLimit(uint64(query.GetLimit()))
+	if err != nil {
+		return 0, 0, false, err
+	}
+	return limit, query.GetSequence(), query.GetAsc(), nil
+}
+
 func EventsToChangesPb(changes []*query.Event, assetAPIPrefix string) []*change_pb.Change {
 	c := make([]*change_pb.Change, len(changes))
 	for i, change := range changes {

internal/api/grpc/change/changes_test.go

@@ -0,0 +1,53 @@
+package change
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+
+	"github.com/zitadel/zitadel/internal/config/systemdefaults"
+	"github.com/zitadel/zitadel/internal/zerrors"
+	change_pb "github.com/zitadel/zitadel/pkg/grpc/change"
+)
+
+func TestChangeQueryToModel(t *testing.T) {
+	defaults := systemdefaults.SystemDefaults{
+		DefaultQueryLimit: 100,
+		MaxQueryLimit:     1000,
+	}
+	tests := []struct {
+		name         string
+		query        *change_pb.ChangeQuery
+		wantLimit    uint64
+		wantSequence uint64
+		wantAsc      bool
+		wantErr      error
+	}{
+		{
+			name:      "nil query, max limit as default",
+			query:     nil,
+			wantLimit: 1000,
+		},
+		{
+			name:         "all fields set",
+			query:        &change_pb.ChangeQuery{Sequence: 5, Limit: 30, Asc: true},
+			wantLimit:    30,
+			wantSequence: 5,
+			wantAsc:      true,
+		},
+		{
+			name:    "limit exceeds max",
+			query:   &change_pb.ChangeQuery{Sequence: 5, Limit: 1001, Asc: true},
+			wantErr: zerrors.ThrowInvalidArgument(nil, "QUERY-4M0fs", "Errors.Query.LimitExceeded"),
+		},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			limit, sequence, asc, err := ChangeQueryToModel(defaults, tt.query)
+			assert.ErrorIs(t, err, tt.wantErr)
+			assert.Equal(t, tt.wantLimit, limit)
+			assert.Equal(t, tt.wantSequence, sequence)
+			assert.Equal(t, tt.wantAsc, asc)
+		})
+	}
+}

internal/api/grpc/management/actions.go

@@ -10,7 +10,7 @@ import (
 )
 
 func (s *Server) ListActions(ctx context.Context, req *mgmt_pb.ListActionsRequest) (*mgmt_pb.ListActionsResponse, error) {
-	query, err := listActionsToQuery(authz.GetCtxData(ctx).OrgID, req)
+	query, err := listActionsToQuery(s.systemDefaults, authz.GetCtxData(ctx).OrgID, req)
 	if err != nil {
 		return nil, err
 	}

internal/api/grpc/management/actions_converter.go

@@ -3,6 +3,7 @@ package management
 import (
 	action_grpc "github.com/zitadel/zitadel/internal/api/grpc/action"
 	"github.com/zitadel/zitadel/internal/api/grpc/object"
+	"github.com/zitadel/zitadel/internal/config/systemdefaults"
 	"github.com/zitadel/zitadel/internal/domain"
 	"github.com/zitadel/zitadel/internal/eventstore/v1/models"
 	"github.com/zitadel/zitadel/internal/query"
@@ -31,8 +32,11 @@ func updateActionRequestToDomain(req *mgmt_pb.UpdateActionRequest) *domain.Actio
 	}
 }
 
-func listActionsToQuery(orgID string, req *mgmt_pb.ListActionsRequest) (_ *query.ActionSearchQueries, err error) {
-	offset, limit, asc := object.ListQueryToModel(req.Query)
+func listActionsToQuery(defaults systemdefaults.SystemDefaults, orgID string, req *mgmt_pb.ListActionsRequest) (_ *query.ActionSearchQueries, err error) {
+	offset, limit, asc, err := object.ListQueryToModel(defaults, req.Query)
+	if err != nil {
+		return nil, err
+	}
 	queries := make([]query.SearchQuery, len(req.Queries)+1)
 	queries[0], err = query.NewActionResourceOwnerQuery(orgID)
 	if err != nil {

internal/api/grpc/management/idp.go

@@ -20,7 +20,7 @@ func (s *Server) GetOrgIDPByID(ctx context.Context, req *mgmt_pb.GetOrgIDPByIDRe
 }
 
 func (s *Server) ListOrgIDPs(ctx context.Context, req *mgmt_pb.ListOrgIDPsRequest) (*mgmt_pb.ListOrgIDPsResponse, error) {
-	queries, err := listIDPsToModel(ctx, req)
+	queries, err := listIDPsToModel(ctx, s.systemDefaults, req)
 	if err != nil {
 		return nil, err
 	}
@@ -157,7 +157,7 @@ func (s *Server) GetProviderByID(ctx context.Context, req *mgmt_pb.GetProviderBy
 }
 
 func (s *Server) ListProviders(ctx context.Context, req *mgmt_pb.ListProvidersRequest) (*mgmt_pb.ListProvidersResponse, error) {
-	queries, err := listProvidersToQuery(ctx, req)
+	queries, err := listProvidersToQuery(ctx, s.systemDefaults, req)
 	if err != nil {
 		return nil, err
 	}

internal/api/grpc/management/idp_converter.go

@@ -11,6 +11,7 @@ import (
 	idp_grpc "github.com/zitadel/zitadel/internal/api/grpc/idp"
 	"github.com/zitadel/zitadel/internal/api/grpc/object"
 	"github.com/zitadel/zitadel/internal/command"
+	"github.com/zitadel/zitadel/internal/config/systemdefaults"
 	"github.com/zitadel/zitadel/internal/domain"
 	"github.com/zitadel/zitadel/internal/eventstore/v1/models"
 	"github.com/zitadel/zitadel/internal/query"
@@ -90,8 +91,11 @@ func updateJWTConfigToDomain(req *mgmt_pb.UpdateOrgIDPJWTConfigRequest) *domain.
 	}
 }
 
-func listIDPsToModel(ctx context.Context, req *mgmt_pb.ListOrgIDPsRequest) (queries *query.IDPSearchQueries, err error) {
-	offset, limit, asc := object.ListQueryToModel(req.Query)
+func listIDPsToModel(ctx context.Context, defaults systemdefaults.SystemDefaults, req *mgmt_pb.ListOrgIDPsRequest) (queries *query.IDPSearchQueries, err error) {
+	offset, limit, asc, err := object.ListQueryToModel(defaults, req.Query)
+	if err != nil {
+		return nil, err
+	}
 	q, err := idpQueriesToModel(req.Queries)
 	if err != nil {
 		return nil, err
@@ -153,8 +157,11 @@ func userLinksToDomain(idps []*query.IDPUserLink) []*domain.UserIDPLink {
 	return links
 }
 
-func listProvidersToQuery(ctx context.Context, req *mgmt_pb.ListProvidersRequest) (*query.IDPTemplateSearchQueries, error) {
-	offset, limit, asc := object.ListQueryToModel(req.Query)
+func listProvidersToQuery(ctx context.Context, defaults systemdefaults.SystemDefaults, req *mgmt_pb.ListProvidersRequest) (*query.IDPTemplateSearchQueries, error) {
+	offset, limit, asc, err := object.ListQueryToModel(defaults, req.Query)
+	if err != nil {
+		return nil, err
+	}
 	queries, err := providerQueriesToQuery(req.Queries)
 	if err != nil {
 		return nil, err

internal/api/grpc/management/integration_test/list_limit_test.go

@@ -0,0 +1,42 @@
+//go:build integration
+
+package management_test
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/require"
+	"google.golang.org/grpc/codes"
+	"google.golang.org/grpc/status"
+
+	"github.com/zitadel/zitadel/pkg/grpc/change"
+	mgmt_pb "github.com/zitadel/zitadel/pkg/grpc/management"
+	"github.com/zitadel/zitadel/pkg/grpc/object"
+)
+
+func TestServer_ListUsers_LimitExceeded(t *testing.T) {
+	t.Parallel()
+
+	_, err := Client.ListUsers(OrgCTX, &mgmt_pb.ListUsersRequest{
+		Query: &object.ListQuery{Limit: 1001},
+	})
+	require.Equal(t, codes.InvalidArgument, status.Code(err))
+}
+
+func TestServer_ListProjects_LimitExceeded(t *testing.T) {
+	t.Parallel()
+
+	_, err := Client.ListProjects(OrgCTX, &mgmt_pb.ListProjectsRequest{
+		Query: &object.ListQuery{Limit: 1001},
+	})
+	require.Equal(t, codes.InvalidArgument, status.Code(err))
+}
+
+func TestServer_ListOrgChanges_LimitExceeded(t *testing.T) {
+	t.Parallel()
+
+	_, err := Client.ListOrgChanges(OrgCTX, &mgmt_pb.ListOrgChangesRequest{
+		Query: &change.ChangeQuery{Limit: 1001},
+	})
+	require.Equal(t, codes.InvalidArgument, status.Code(err))
+}

internal/api/grpc/management/org.go

@@ -38,15 +38,9 @@ func (s *Server) GetOrgByDomainGlobal(ctx context.Context, req *mgmt_pb.GetOrgBy
 }
 
 func (s *Server) ListOrgChanges(ctx context.Context, req *mgmt_pb.ListOrgChangesRequest) (*mgmt_pb.ListOrgChangesResponse, error) {
-	var (
-		limit    uint64
-		sequence uint64
-		asc      bool
-	)
-	if req.Query != nil {
-		limit = uint64(req.Query.Limit)
-		sequence = req.Query.Sequence
-		asc = req.Query.Asc
+	limit, sequence, asc, err := change_grpc.ChangeQueryToModel(s.systemDefaults, req.Query)
+	if err != nil {
+		return nil, err
 	}
 
 	query := eventstore.NewSearchQueryBuilder(eventstore.ColumnsEvent).
@@ -161,7 +155,7 @@ func (s *Server) GetOrgIAMPolicy(ctx context.Context, _ *mgmt_pb.GetOrgIAMPolicy
 }
 
 func (s *Server) ListOrgDomains(ctx context.Context, req *mgmt_pb.ListOrgDomainsRequest) (*mgmt_pb.ListOrgDomainsResponse, error) {
-	queries, err := ListOrgDomainsRequestToModel(req)
+	queries, err := ListOrgDomainsRequestToModel(s.systemDefaults, req)
 	if err != nil {
 		return nil, err
 	}
@@ -263,7 +257,7 @@ func (s *Server) ListOrgMemberRoles(ctx context.Context, _ *mgmt_pb.ListOrgMembe
 }
 
 func (s *Server) ListOrgMembers(ctx context.Context, req *mgmt_pb.ListOrgMembersRequest) (*mgmt_pb.ListOrgMembersResponse, error) {
-	queries, err := ListOrgMembersRequestToModel(ctx, req)
+	queries, err := ListOrgMembersRequestToModel(ctx, s.systemDefaults, req)
 	if err != nil {
 		return nil, err
 	}
@@ -320,7 +314,7 @@ func (s *Server) getClaimedUserIDsOfOrgDomain(ctx context.Context, orgDomain, or
 }
 
 func (s *Server) ListOrgMetadata(ctx context.Context, req *mgmt_pb.ListOrgMetadataRequest) (*mgmt_pb.ListOrgMetadataResponse, error) {
-	metadataQueries, err := ListOrgMetadataToDomain(req)
+	metadataQueries, err := ListOrgMetadataToDomain(s.systemDefaults, req)
 	if err != nil {
 		return nil, err
 	}

internal/api/grpc/management/org_converter.go

@@ -9,14 +9,18 @@ import (
 	"github.com/zitadel/zitadel/internal/api/grpc/object"
 	org_grpc "github.com/zitadel/zitadel/internal/api/grpc/org"
 	"github.com/zitadel/zitadel/internal/command"
+	"github.com/zitadel/zitadel/internal/config/systemdefaults"
 	"github.com/zitadel/zitadel/internal/domain"
 	"github.com/zitadel/zitadel/internal/eventstore/v1/models"
 	"github.com/zitadel/zitadel/internal/query"
 	mgmt_pb "github.com/zitadel/zitadel/pkg/grpc/management"
 )
 
-func ListOrgDomainsRequestToModel(req *mgmt_pb.ListOrgDomainsRequest) (*query.OrgDomainSearchQueries, error) {
-	offset, limit, asc := object.ListQueryToModel(req.Query)
+func ListOrgDomainsRequestToModel(defaults systemdefaults.SystemDefaults, req *mgmt_pb.ListOrgDomainsRequest) (*query.OrgDomainSearchQueries, error) {
+	offset, limit, asc, err := object.ListQueryToModel(defaults, req.Query)
+	if err != nil {
+		return nil, err
+	}
 	queries, err := org_grpc.DomainQueriesToModel(req.Queries)
 	if err != nil {
 		return nil, err
@@ -84,9 +88,12 @@ func UpdateOrgMemberRequestToCommand(req *mgmt_pb.UpdateOrgMemberRequest, orgID
 	}
 }
 
-func ListOrgMembersRequestToModel(ctx context.Context, req *mgmt_pb.ListOrgMembersRequest) (*query.OrgMembersQuery, error) {
+func ListOrgMembersRequestToModel(ctx context.Context, defaults systemdefaults.SystemDefaults, req *mgmt_pb.ListOrgMembersRequest) (*query.OrgMembersQuery, error) {
 	ctxData := authz.GetCtxData(ctx)
-	offset, limit, asc := object.ListQueryToModel(req.Query)
+	offset, limit, asc, err := object.ListQueryToModel(defaults, req.Query)
+	if err != nil {
+		return nil, err
+	}
 	queries, err := member_grpc.MemberQueriesToQuery(req.Queries)
 	if err != nil {
 		return nil, err
@@ -121,8 +128,11 @@ func BulkSetOrgMetadataToDomain(req *mgmt_pb.BulkSetOrgMetadataRequest) []*domai
 	return metadata
 }
 
-func ListOrgMetadataToDomain(req *mgmt_pb.ListOrgMetadataRequest) (*query.OrgMetadataSearchQueries, error) {
-	offset, limit, asc := object.ListQueryToModel(req.Query)
+func ListOrgMetadataToDomain(defaults systemdefaults.SystemDefaults, req *mgmt_pb.ListOrgMetadataRequest) (*query.OrgMetadataSearchQueries, error) {
+	offset, limit, asc, err := object.ListQueryToModel(defaults, req.Query)
+	if err != nil {
+		return nil, err
+	}
 	queries, err := metadata.OrgMetadataQueriesToQuery(req.Queries)
 	if err != nil {
 		return nil, err

internal/api/grpc/management/policy_login.go

@@ -66,7 +66,11 @@ func (s *Server) ResetLoginPolicyToDefault(ctx context.Context, req *mgmt_pb.Res
 }
 
 func (s *Server) ListLoginPolicyIDPs(ctx context.Context, req *mgmt_pb.ListLoginPolicyIDPsRequest) (*mgmt_pb.ListLoginPolicyIDPsResponse, error) {
-	res, err := s.query.IDPLoginPolicyLinks(ctx, authz.GetCtxData(ctx).OrgID, ListLoginPolicyIDPsRequestToQuery(req), false)
+	queries, err := ListLoginPolicyIDPsRequestToQuery(s.systemDefaults, req)
+	if err != nil {
+		return nil, err
+	}
+	res, err := s.query.IDPLoginPolicyLinks(ctx, authz.GetCtxData(ctx).OrgID, queries, false)
 	if err != nil {
 		return nil, err
 	}

internal/api/grpc/management/policy_login_converter.go

@@ -5,6 +5,7 @@ import (
 	"github.com/zitadel/zitadel/internal/api/grpc/object"
 	policy_grpc "github.com/zitadel/zitadel/internal/api/grpc/policy"
 	"github.com/zitadel/zitadel/internal/command"
+	"github.com/zitadel/zitadel/internal/config/systemdefaults"
 	"github.com/zitadel/zitadel/internal/query"
 	mgmt_pb "github.com/zitadel/zitadel/pkg/grpc/management"
 )
@@ -66,13 +67,16 @@ func updateLoginPolicyToCommand(p *mgmt_pb.UpdateCustomLoginPolicyRequest) *comm
 	}
 }
 
-func ListLoginPolicyIDPsRequestToQuery(req *mgmt_pb.ListLoginPolicyIDPsRequest) *query.IDPLoginPolicyLinksSearchQuery {
-	offset, limit, asc := object.ListQueryToModel(req.Query)
+func ListLoginPolicyIDPsRequestToQuery(defaults systemdefaults.SystemDefaults, req *mgmt_pb.ListLoginPolicyIDPsRequest) (*query.IDPLoginPolicyLinksSearchQuery, error) {
+	offset, limit, asc, err := object.ListQueryToModel(defaults, req.Query)
+	if err != nil {
+		return nil, err
+	}
 	return &query.IDPLoginPolicyLinksSearchQuery{
 		SearchRequest: query.SearchRequest{
 			Offset: offset,
 			Limit:  limit,
 			Asc:    asc,
 		},
-	}
+	}, nil
 }

internal/api/grpc/management/project.go

@@ -42,7 +42,7 @@ func (s *Server) GetGrantedProjectByID(ctx context.Context, req *mgmt_pb.GetGran
 }
 
 func (s *Server) ListProjects(ctx context.Context, req *mgmt_pb.ListProjectsRequest) (*mgmt_pb.ListProjectsResponse, error) {
-	queries, err := listProjectRequestToModel(req)
+	queries, err := listProjectRequestToModel(s.systemDefaults, req)
 	if err != nil {
 		return nil, err
 	}
@@ -65,15 +65,9 @@ func (s *Server) ListProjects(ctx context.Context, req *mgmt_pb.ListProjectsRequ
 }
 
 func (s *Server) ListProjectGrantChanges(ctx context.Context, req *mgmt_pb.ListProjectGrantChangesRequest) (*mgmt_pb.ListProjectGrantChangesResponse, error) {
-	var (
-		limit    uint64
-		sequence uint64
-		asc      bool
-	)
-	if req.Query != nil {
-		limit = uint64(req.Query.Limit)
-		sequence = req.Query.Sequence
-		asc = req.Query.Asc
+	limit, sequence, asc, err := change_grpc.ChangeQueryToModel(s.systemDefaults, req.Query)
+	if err != nil {
+		return nil, err
 	}
 
 	query := eventstore.NewSearchQueryBuilder(eventstore.ColumnsEvent).
@@ -104,7 +98,7 @@ func (s *Server) ListProjectGrantChanges(ctx context.Context, req *mgmt_pb.ListP
 }
 
 func (s *Server) ListGrantedProjects(ctx context.Context, req *mgmt_pb.ListGrantedProjectsRequest) (*mgmt_pb.ListGrantedProjectsResponse, error) {
-	queries, err := listGrantedProjectsRequestToModel(req)
+	queries, err := listGrantedProjectsRequestToModel(s.systemDefaults, req)
 	if err != nil {
 		return nil, err
 	}
@@ -127,7 +121,7 @@ func (s *Server) ListGrantedProjects(ctx context.Context, req *mgmt_pb.ListGrant
 }
 
 func (s *Server) ListGrantedProjectRoles(ctx context.Context, req *mgmt_pb.ListGrantedProjectRolesRequest) (*mgmt_pb.ListGrantedProjectRolesResponse, error) {
-	queries, err := listGrantedProjectRolesRequestToModel(req)
+	queries, err := listGrantedProjectRolesRequestToModel(s.systemDefaults, req)
 	if err != nil {
 		return nil, err
 	}
@@ -146,15 +140,9 @@ func (s *Server) ListGrantedProjectRoles(ctx context.Context, req *mgmt_pb.ListG
 }
 
 func (s *Server) ListProjectChanges(ctx context.Context, req *mgmt_pb.ListProjectChangesRequest) (*mgmt_pb.ListProjectChangesResponse, error) {
-	var (
-		limit    uint64
-		sequence uint64
-		asc      bool
-	)
-	if req.Query != nil {
-		limit = uint64(req.Query.Limit)
-		sequence = req.Query.Sequence
-		asc = req.Query.Asc
+	limit, sequence, asc, err := change_grpc.ChangeQueryToModel(s.systemDefaults, req.Query)
+	if err != nil {
+		return nil, err
 	}
 
 	query := eventstore.NewSearchQueryBuilder(eventstore.ColumnsEvent).
@@ -248,7 +236,7 @@ func (s *Server) RemoveProject(ctx context.Context, req *mgmt_pb.RemoveProjectRe
 }
 
 func (s *Server) ListProjectRoles(ctx context.Context, req *mgmt_pb.ListProjectRolesRequest) (*mgmt_pb.ListProjectRolesResponse, error) {
-	queries, err := listProjectRolesRequestToModel(req)
+	queries, err := listProjectRolesRequestToModel(s.systemDefaults, req)
 	if err != nil {
 		return nil, err
 	}
@@ -346,7 +334,7 @@ func (s *Server) ListProjectMemberRoles(ctx context.Context, _ *mgmt_pb.ListProj
 }
 
 func (s *Server) ListProjectMembers(ctx context.Context, req *mgmt_pb.ListProjectMembersRequest) (*mgmt_pb.ListProjectMembersResponse, error) {
-	queries, err := ListProjectMembersRequestToModel(ctx, req)
+	queries, err := ListProjectMembersRequestToModel(ctx, s.systemDefaults, req)
 	if err != nil {
 		return nil, err
 	}

internal/api/grpc/management/project_application.go

@@ -29,7 +29,7 @@ func (s *Server) GetAppByID(ctx context.Context, req *mgmt_pb.GetAppByIDRequest)
 }
 
 func (s *Server) ListApps(ctx context.Context, req *mgmt_pb.ListAppsRequest) (*mgmt_pb.ListAppsResponse, error) {
-	queries, err := ListAppsRequestToModel(ctx, req)
+	queries, err := ListAppsRequestToModel(ctx, s.systemDefaults, req)
 	if err != nil {
 		return nil, err
 	}
@@ -44,15 +44,9 @@ func (s *Server) ListApps(ctx context.Context, req *mgmt_pb.ListAppsRequest) (*m
 }
 
 func (s *Server) ListAppChanges(ctx context.Context, req *mgmt_pb.ListAppChangesRequest) (*mgmt_pb.ListAppChangesResponse, error) {
-	var (
-		limit    uint64
-		sequence uint64
-		asc      bool
-	)
-	if req.Query != nil {
-		limit = uint64(req.Query.Limit)
-		sequence = req.Query.Sequence
-		asc = req.Query.Asc
+	limit, sequence, asc, err := change_grpc.ChangeQueryToModel(s.systemDefaults, req.Query)
+	if err != nil {
+		return nil, err
 	}
 
 	query := eventstore.NewSearchQueryBuilder(eventstore.ColumnsEvent).
@@ -271,7 +265,7 @@ func (s *Server) GetAppKey(ctx context.Context, req *mgmt_pb.GetAppKeyRequest) (
 }
 
 func (s *Server) ListAppKeys(ctx context.Context, req *mgmt_pb.ListAppKeysRequest) (*mgmt_pb.ListAppKeysResponse, error) {
-	queries, err := ListAPIClientKeysRequestToQuery(ctx, req)
+	queries, err := ListAPIClientKeysRequestToQuery(ctx, s.systemDefaults, req)
 	if err != nil {
 		return nil, err
 	}

internal/api/grpc/management/project_application_converter.go

@@ -10,14 +10,18 @@ import (
 	authn_grpc "github.com/zitadel/zitadel/internal/api/grpc/authn"
 	"github.com/zitadel/zitadel/internal/api/grpc/object"
 	app_grpc "github.com/zitadel/zitadel/internal/api/grpc/project"
+	"github.com/zitadel/zitadel/internal/config/systemdefaults"
 	"github.com/zitadel/zitadel/internal/domain"
 	"github.com/zitadel/zitadel/internal/eventstore/v1/models"
 	"github.com/zitadel/zitadel/internal/query"
 	mgmt_pb "github.com/zitadel/zitadel/pkg/grpc/management"
 )
 
-func ListAppsRequestToModel(ctx context.Context, req *mgmt_pb.ListAppsRequest) (*query.AppSearchQueries, error) {
-	offset, limit, asc := object.ListQueryToModel(req.Query)
+func ListAppsRequestToModel(ctx context.Context, defaults systemdefaults.SystemDefaults, req *mgmt_pb.ListAppsRequest) (*query.AppSearchQueries, error) {
+	offset, limit, asc, err := object.ListQueryToModel(defaults, req.Query)
+	if err != nil {
+		return nil, err
+	}
 	queries, err := app_grpc.AppQueriesToModel(req.Queries)
 	if err != nil {
 		return nil, err
@@ -193,7 +197,7 @@ func AddAPIClientKeyRequestToDomain(key *mgmt_pb.AddAppKeyRequest) *domain.Appli
 	}
 }
 
-func ListAPIClientKeysRequestToQuery(ctx context.Context, req *mgmt_pb.ListAppKeysRequest) (*query.AuthNKeySearchQueries, error) {
+func ListAPIClientKeysRequestToQuery(ctx context.Context, defaults systemdefaults.SystemDefaults, req *mgmt_pb.ListAppKeysRequest) (*query.AuthNKeySearchQueries, error) {
 	resourceOwner, err := query.NewAuthNKeyResourceOwnerQuery(authz.GetCtxData(ctx).OrgID)
 	if err != nil {
 		return nil, err
@@ -206,7 +210,10 @@ func ListAPIClientKeysRequestToQuery(ctx context.Context, req *mgmt_pb.ListAppKe
 	if err != nil {
 		return nil, err
 	}
-	offset, limit, asc := object.ListQueryToModel(req.Query)
+	offset, limit, asc, err := object.ListQueryToModel(defaults, req.Query)
+	if err != nil {
+		return nil, err
+	}
 	return &query.AuthNKeySearchQueries{
 		SearchRequest: query.SearchRequest{
 			Offset: offset,

internal/api/grpc/management/project_converter.go

@@ -10,6 +10,7 @@ import (
 	"github.com/zitadel/zitadel/internal/api/grpc/object"
 	proj_grpc "github.com/zitadel/zitadel/internal/api/grpc/project"
 	"github.com/zitadel/zitadel/internal/command"
+	"github.com/zitadel/zitadel/internal/config/systemdefaults"
 	"github.com/zitadel/zitadel/internal/domain"
 	"github.com/zitadel/zitadel/internal/eventstore/v1/models"
 	"github.com/zitadel/zitadel/internal/query"
@@ -122,8 +123,11 @@ func UpdateProjectMemberRequestToCommand(req *mgmt_pb.UpdateProjectMemberRequest
 	}
 }
 
-func listProjectRequestToModel(req *mgmt_pb.ListProjectsRequest) (*query.ProjectSearchQueries, error) {
-	offset, limit, asc := object.ListQueryToModel(req.Query)
+func listProjectRequestToModel(defaults systemdefaults.SystemDefaults, req *mgmt_pb.ListProjectsRequest) (*query.ProjectSearchQueries, error) {
+	offset, limit, asc, err := object.ListQueryToModel(defaults, req.Query)
+	if err != nil {
+		return nil, err
+	}
 	queries, err := proj_grpc.ProjectQueriesToModel(req.Queries)
 	if err != nil {
 		return nil, err
@@ -138,8 +142,11 @@ func listProjectRequestToModel(req *mgmt_pb.ListProjectsRequest) (*query.Project
 	}, nil
 }
 
-func listGrantedProjectsRequestToModel(req *mgmt_pb.ListGrantedProjectsRequest) (*query.ProjectGrantSearchQueries, error) {
-	offset, limit, asc := object.ListQueryToModel(req.Query)
+func listGrantedProjectsRequestToModel(defaults systemdefaults.SystemDefaults, req *mgmt_pb.ListGrantedProjectsRequest) (*query.ProjectGrantSearchQueries, error) {
+	offset, limit, asc, err := object.ListQueryToModel(defaults, req.Query)
+	if err != nil {
+		return nil, err
+	}
 	queries, err := proj_grpc.ProjectQueriesToModel(req.Queries)
 	if err != nil {
 		return nil, err
@@ -154,8 +161,11 @@ func listGrantedProjectsRequestToModel(req *mgmt_pb.ListGrantedProjectsRequest)
 	}, nil
 }
 
-func listProjectRolesRequestToModel(req *mgmt_pb.ListProjectRolesRequest) (*query.ProjectRoleSearchQueries, error) {
-	offset, limit, asc := object.ListQueryToModel(req.Query)
+func listProjectRolesRequestToModel(defaults systemdefaults.SystemDefaults, req *mgmt_pb.ListProjectRolesRequest) (*query.ProjectRoleSearchQueries, error) {
+	offset, limit, asc, err := object.ListQueryToModel(defaults, req.Query)
+	if err != nil {
+		return nil, err
+	}
 	queries, err := proj_grpc.RoleQueriesToModel(req.Queries)
 	if err != nil {
 		return nil, err
@@ -170,8 +180,11 @@ func listProjectRolesRequestToModel(req *mgmt_pb.ListProjectRolesRequest) (*quer
 	}, nil
 }
 
-func listGrantedProjectRolesRequestToModel(req *mgmt_pb.ListGrantedProjectRolesRequest) (*query.ProjectRoleSearchQueries, error) {
-	offset, limit, asc := object.ListQueryToModel(req.Query)
+func listGrantedProjectRolesRequestToModel(defaults systemdefaults.SystemDefaults, req *mgmt_pb.ListGrantedProjectRolesRequest) (*query.ProjectRoleSearchQueries, error) {
+	offset, limit, asc, err := object.ListQueryToModel(defaults, req.Query)
+	if err != nil {
+		return nil, err
+	}
 	queries, err := proj_grpc.RoleQueriesToModel(req.Queries)
 	if err != nil {
 		return nil, err
@@ -186,8 +199,11 @@ func listGrantedProjectRolesRequestToModel(req *mgmt_pb.ListGrantedProjectRolesR
 	}, nil
 }
 
-func ListProjectMembersRequestToModel(ctx context.Context, req *mgmt_pb.ListProjectMembersRequest) (*query.ProjectMembersQuery, error) {
-	offset, limit, asc := object.ListQueryToModel(req.Query)
+func ListProjectMembersRequestToModel(ctx context.Context, defaults systemdefaults.SystemDefaults, req *mgmt_pb.ListProjectMembersRequest) (*query.ProjectMembersQuery, error) {
+	offset, limit, asc, err := object.ListQueryToModel(defaults, req.Query)
+	if err != nil {
+		return nil, err
+	}
 	queries, err := member_grpc.MemberQueriesToQuery(req.Queries)
 	if err != nil {
 		return nil, err

internal/api/grpc/management/project_grant.go

@@ -27,7 +27,7 @@ func (s *Server) GetProjectGrantByID(ctx context.Context, req *mgmt_pb.GetProjec
 }
 
 func (s *Server) ListProjectGrants(ctx context.Context, req *mgmt_pb.ListProjectGrantsRequest) (*mgmt_pb.ListProjectGrantsResponse, error) {
-	queries, err := listProjectGrantsRequestToModel(req)
+	queries, err := listProjectGrantsRequestToModel(s.systemDefaults, req)
 	if err != nil {
 		return nil, err
 	}
@@ -46,7 +46,7 @@ func (s *Server) ListProjectGrants(ctx context.Context, req *mgmt_pb.ListProject
 }
 
 func (s *Server) ListAllProjectGrants(ctx context.Context, req *mgmt_pb.ListAllProjectGrantsRequest) (*mgmt_pb.ListAllProjectGrantsResponse, error) {
-	queries, err := listAllProjectGrantsRequestToModel(req)
+	queries, err := listAllProjectGrantsRequestToModel(s.systemDefaults, req)
 	if err != nil {
 		return nil, err
 	}
@@ -165,7 +165,7 @@ func (s *Server) ListProjectGrantMemberRoles(ctx context.Context, req *mgmt_pb.L
 }
 
 func (s *Server) ListProjectGrantMembers(ctx context.Context, req *mgmt_pb.ListProjectGrantMembersRequest) (*mgmt_pb.ListProjectGrantMembersResponse, error) {
-	queries, err := ListProjectGrantMembersRequestToModel(ctx, req)
+	queries, err := ListProjectGrantMembersRequestToModel(ctx, s.systemDefaults, req)
 	if err != nil {
 		return nil, err
 	}

internal/api/grpc/management/project_grant_converter.go

@@ -7,6 +7,7 @@ import (
 	member_grpc "github.com/zitadel/zitadel/internal/api/grpc/member"
 	"github.com/zitadel/zitadel/internal/api/grpc/object"
 	"github.com/zitadel/zitadel/internal/command"
+	"github.com/zitadel/zitadel/internal/config/systemdefaults"
 	"github.com/zitadel/zitadel/internal/eventstore/v1/models"
 	"github.com/zitadel/zitadel/internal/query"
 	"github.com/zitadel/zitadel/internal/zerrors"
@@ -14,8 +15,11 @@ import (
 	proj_pb "github.com/zitadel/zitadel/pkg/grpc/project"
 )
 
-func listProjectGrantsRequestToModel(req *mgmt_pb.ListProjectGrantsRequest) (*query.ProjectGrantSearchQueries, error) {
-	offset, limit, asc := object.ListQueryToModel(req.Query)
+func listProjectGrantsRequestToModel(defaults systemdefaults.SystemDefaults, req *mgmt_pb.ListProjectGrantsRequest) (*query.ProjectGrantSearchQueries, error) {
+	offset, limit, asc, err := object.ListQueryToModel(defaults, req.Query)
+	if err != nil {
+		return nil, err
+	}
 	queries, err := ProjectGrantQueriesToModel(req)
 	if err != nil {
 		return nil, err
@@ -58,8 +62,11 @@ func ProjectGrantQueryToModel(apiQuery *proj_pb.ProjectGrantQuery) (query.Search
 		return nil, zerrors.ThrowInvalidArgument(nil, "PROJECT-M099f", "List.Query.Invalid")
 	}
 }
-func listAllProjectGrantsRequestToModel(req *mgmt_pb.ListAllProjectGrantsRequest) (*query.ProjectGrantSearchQueries, error) {
-	offset, limit, asc := object.ListQueryToModel(req.Query)
+func listAllProjectGrantsRequestToModel(defaults systemdefaults.SystemDefaults, req *mgmt_pb.ListAllProjectGrantsRequest) (*query.ProjectGrantSearchQueries, error) {
+	offset, limit, asc, err := object.ListQueryToModel(defaults, req.Query)
+	if err != nil {
+		return nil, err
+	}
 	queries, err := AllProjectGrantQueriesToModel(req)
 	if err != nil {
 		return nil, err
@@ -123,8 +130,11 @@ func UpdateProjectGrantRequestToCommand(req *mgmt_pb.UpdateProjectGrantRequest,
 	}
 }
 
-func ListProjectGrantMembersRequestToModel(ctx context.Context, req *mgmt_pb.ListProjectGrantMembersRequest) (*query.ProjectGrantMembersQuery, error) {
-	offset, limit, asc := object.ListQueryToModel(req.Query)
+func ListProjectGrantMembersRequestToModel(ctx context.Context, defaults systemdefaults.SystemDefaults, req *mgmt_pb.ListProjectGrantMembersRequest) (*query.ProjectGrantMembersQuery, error) {
+	offset, limit, asc, err := object.ListQueryToModel(defaults, req.Query)
+	if err != nil {
+		return nil, err
+	}
 	queries, err := member_grpc.MemberQueriesToQuery(req.Queries)
 	if err != nil {
 		return nil, err

internal/api/grpc/management/user.go

@@ -59,7 +59,7 @@ func (s *Server) GetUserByLoginNameGlobal(ctx context.Context, req *mgmt_pb.GetU
 }
 
 func (s *Server) ListUsers(ctx context.Context, req *mgmt_pb.ListUsersRequest) (*mgmt_pb.ListUsersResponse, error) {
-	queries, err := ListUsersRequestToModel(req)
+	queries, err := ListUsersRequestToModel(s.systemDefaults, req)
 	if err != nil {
 		return nil, err
 	}
@@ -80,15 +80,9 @@ func (s *Server) ListUsers(ctx context.Context, req *mgmt_pb.ListUsersRequest) (
 }
 
 func (s *Server) ListUserChanges(ctx context.Context, req *mgmt_pb.ListUserChangesRequest) (*mgmt_pb.ListUserChangesResponse, error) {
-	var (
-		limit    uint64
-		sequence uint64
-		asc      bool
-	)
-	if req.Query != nil {
-		limit = uint64(req.Query.Limit)
-		sequence = req.Query.Sequence
-		asc = req.Query.Asc
+	limit, sequence, asc, err := change_grpc.ChangeQueryToModel(s.systemDefaults, req.Query)
+	if err != nil {
+		return nil, err
 	}
 
 	query := eventstore.NewSearchQueryBuilder(eventstore.ColumnsEvent).
@@ -134,7 +128,7 @@ func (s *Server) IsUserUnique(ctx context.Context, req *mgmt_pb.IsUserUniqueRequ
 }
 
 func (s *Server) ListUserMetadata(ctx context.Context, req *mgmt_pb.ListUserMetadataRequest) (*mgmt_pb.ListUserMetadataResponse, error) {
-	metadataQueries, err := ListUserMetadataToDomain(req)
+	metadataQueries, err := ListUserMetadataToDomain(s.systemDefaults, req)
 	if err != nil {
 		return nil, err
 	}
@@ -765,7 +759,7 @@ func (s *Server) GetMachineKeyByIDs(ctx context.Context, req *mgmt_pb.GetMachine
 }
 
 func (s *Server) ListMachineKeys(ctx context.Context, req *mgmt_pb.ListMachineKeysRequest) (*mgmt_pb.ListMachineKeysResponse, error) {
-	q, err := ListMachineKeysRequestToQuery(ctx, req)
+	q, err := ListMachineKeysRequestToQuery(ctx, s.systemDefaults, req)
 	if err != nil {
 		return nil, err
 	}
@@ -861,7 +855,7 @@ func (s *Server) GetPersonalAccessTokenByIDs(ctx context.Context, req *mgmt_pb.G
 }
 
 func (s *Server) ListPersonalAccessTokens(ctx context.Context, req *mgmt_pb.ListPersonalAccessTokensRequest) (*mgmt_pb.ListPersonalAccessTokensResponse, error) {
-	queries, err := ListPersonalAccessTokensRequestToQuery(ctx, req)
+	queries, err := ListPersonalAccessTokensRequestToQuery(ctx, s.systemDefaults, req)
 	if err != nil {
 		return nil, err
 	}
@@ -900,7 +894,7 @@ func (s *Server) RemovePersonalAccessToken(ctx context.Context, req *mgmt_pb.Rem
 }
 
 func (s *Server) ListHumanLinkedIDPs(ctx context.Context, req *mgmt_pb.ListHumanLinkedIDPsRequest) (*mgmt_pb.ListHumanLinkedIDPsResponse, error) {
-	queries, err := ListHumanLinkedIDPsRequestToQuery(ctx, req)
+	queries, err := ListHumanLinkedIDPsRequestToQuery(ctx, s.systemDefaults, req)
 	if err != nil {
 		return nil, err
 	}
@@ -925,7 +919,7 @@ func (s *Server) RemoveHumanLinkedIDP(ctx context.Context, req *mgmt_pb.RemoveHu
 }
 
 func (s *Server) ListUserMemberships(ctx context.Context, req *mgmt_pb.ListUserMembershipsRequest) (*mgmt_pb.ListUserMembershipsResponse, error) {
-	request, err := ListUserMembershipsRequestToModel(ctx, req)
+	request, err := ListUserMembershipsRequestToModel(ctx, s.systemDefaults, req)
 	if err != nil {
 		return nil, err
 	}

internal/api/grpc/management/user_converter.go

@@ -13,6 +13,7 @@ import (
 	"github.com/zitadel/zitadel/internal/api/grpc/object"
 	user_grpc "github.com/zitadel/zitadel/internal/api/grpc/user"
 	"github.com/zitadel/zitadel/internal/command"
+	"github.com/zitadel/zitadel/internal/config/systemdefaults"
 	"github.com/zitadel/zitadel/internal/domain"
 	"github.com/zitadel/zitadel/internal/eventstore/v1/models"
 	"github.com/zitadel/zitadel/internal/query"
@@ -20,8 +21,11 @@ import (
 	"github.com/zitadel/zitadel/pkg/grpc/user"
 )
 
-func ListUsersRequestToModel(req *mgmt_pb.ListUsersRequest) (*query.UserSearchQueries, error) {
-	offset, limit, asc := object.ListQueryToModel(req.Query)
+func ListUsersRequestToModel(defaults systemdefaults.SystemDefaults, req *mgmt_pb.ListUsersRequest) (*query.UserSearchQueries, error) {
+	offset, limit, asc, err := object.ListQueryToModel(defaults, req.Query)
+	if err != nil {
+		return nil, err
+	}
 	queries, err := user_grpc.UserQueriesToQuery(req.Queries, 0 /*start from level 0*/)
 	if err != nil {
 		return nil, err
@@ -73,8 +77,11 @@ func BulkSetUserMetadataToDomain(req *mgmt_pb.BulkSetUserMetadataRequest) []*dom
 	return metadata
 }
 
-func ListUserMetadataToDomain(req *mgmt_pb.ListUserMetadataRequest) (*query.UserMetadataSearchQueries, error) {
-	offset, limit, asc := object.ListQueryToModel(req.Query)
+func ListUserMetadataToDomain(defaults systemdefaults.SystemDefaults, req *mgmt_pb.ListUserMetadataRequest) (*query.UserMetadataSearchQueries, error) {
+	offset, limit, asc, err := object.ListQueryToModel(defaults, req.Query)
+	if err != nil {
+		return nil, err
+	}
 	queries, err := metadata.UserMetadataQueriesToQuery(req.Queries)
 	if err != nil {
 		return nil, err
@@ -206,7 +213,7 @@ func UpdateMachineRequestToCommand(req *mgmt_pb.UpdateMachineRequest, orgID stri
 	}
 }
 
-func ListMachineKeysRequestToQuery(ctx context.Context, req *mgmt_pb.ListMachineKeysRequest) (*query.AuthNKeySearchQueries, error) {
+func ListMachineKeysRequestToQuery(ctx context.Context, defaults systemdefaults.SystemDefaults, req *mgmt_pb.ListMachineKeysRequest) (*query.AuthNKeySearchQueries, error) {
 	resourcOwner, err := query.NewAuthNKeyResourceOwnerQuery(authz.GetCtxData(ctx).OrgID)
 	if err != nil {
 		return nil, err
@@ -215,7 +222,10 @@ func ListMachineKeysRequestToQuery(ctx context.Context, req *mgmt_pb.ListMachine
 	if err != nil {
 		return nil, err
 	}
-	offset, limit, asc := object.ListQueryToModel(req.Query)
+	offset, limit, asc, err := object.ListQueryToModel(defaults, req.Query)
+	if err != nil {
+		return nil, err
+	}
 	return &query.AuthNKeySearchQueries{
 		SearchRequest: query.SearchRequest{
 			Offset: offset,
@@ -284,7 +294,7 @@ func RemovePersonalAccessTokenRequestToCommand(req *mgmt_pb.RemovePersonalAccess
 	}
 }
 
-func ListPersonalAccessTokensRequestToQuery(ctx context.Context, req *mgmt_pb.ListPersonalAccessTokensRequest) (*query.PersonalAccessTokenSearchQueries, error) {
+func ListPersonalAccessTokensRequestToQuery(ctx context.Context, defaults systemdefaults.SystemDefaults, req *mgmt_pb.ListPersonalAccessTokensRequest) (*query.PersonalAccessTokenSearchQueries, error) {
 	resourceOwner, err := query.NewPersonalAccessTokenResourceOwnerSearchQuery(authz.GetCtxData(ctx).OrgID)
 	if err != nil {
 		return nil, err
@@ -293,7 +303,10 @@ func ListPersonalAccessTokensRequestToQuery(ctx context.Context, req *mgmt_pb.Li
 	if err != nil {
 		return nil, err
 	}
-	offset, limit, asc := object.ListQueryToModel(req.Query)
+	offset, limit, asc, err := object.ListQueryToModel(defaults, req.Query)
+	if err != nil {
+		return nil, err
+	}
 	return &query.PersonalAccessTokenSearchQueries{
 		SearchRequest: query.SearchRequest{
 			Offset: offset,
@@ -319,8 +332,11 @@ func RemoveHumanLinkedIDPRequestToDomain(ctx context.Context, req *mgmt_pb.Remov
 	}
 }
 
-func ListHumanLinkedIDPsRequestToQuery(ctx context.Context, req *mgmt_pb.ListHumanLinkedIDPsRequest) (*query.IDPUserLinksSearchQuery, error) {
-	offset, limit, asc := object.ListQueryToModel(req.Query)
+func ListHumanLinkedIDPsRequestToQuery(ctx context.Context, defaults systemdefaults.SystemDefaults, req *mgmt_pb.ListHumanLinkedIDPsRequest) (*query.IDPUserLinksSearchQuery, error) {
+	offset, limit, asc, err := object.ListQueryToModel(defaults, req.Query)
+	if err != nil {
+		return nil, err
+	}
 	userQuery, err := query.NewIDPUserLinksUserIDSearchQuery(req.UserId)
 	if err != nil {
 		return nil, err
@@ -339,8 +355,11 @@ func ListHumanLinkedIDPsRequestToQuery(ctx context.Context, req *mgmt_pb.ListHum
 	}, nil
 }
 
-func ListUserMembershipsRequestToModel(ctx context.Context, req *mgmt_pb.ListUserMembershipsRequest) (*query.MembershipSearchQuery, error) {
-	offset, limit, asc := object.ListQueryToModel(req.Query)
+func ListUserMembershipsRequestToModel(ctx context.Context, defaults systemdefaults.SystemDefaults, req *mgmt_pb.ListUserMembershipsRequest) (*query.MembershipSearchQuery, error) {
+	offset, limit, asc, err := object.ListQueryToModel(defaults, req.Query)
+	if err != nil {
+		return nil, err
+	}
 	queries, err := user_grpc.MembershipQueriesToQuery(req.Queries)
 	if err != nil {
 		return nil, err

internal/api/grpc/management/user_grant.go

@@ -29,7 +29,7 @@ func (s *Server) GetUserGrantByID(ctx context.Context, req *mgmt_pb.GetUserGrant
 }
 
 func (s *Server) ListUserGrants(ctx context.Context, req *mgmt_pb.ListUserGrantRequest) (*mgmt_pb.ListUserGrantResponse, error) {
-	queries, err := ListUserGrantsRequestToQuery(ctx, req)
+	queries, err := ListUserGrantsRequestToQuery(ctx, s.systemDefaults, req)
 	if err != nil {
 		return nil, err
 	}

internal/api/grpc/management/user_grant_converter.go

@@ -6,6 +6,7 @@ import (
 	"github.com/zitadel/zitadel/internal/api/authz"
 	"github.com/zitadel/zitadel/internal/api/grpc/object"
 	user_grpc "github.com/zitadel/zitadel/internal/api/grpc/user"
+	"github.com/zitadel/zitadel/internal/config/systemdefaults"
 	"github.com/zitadel/zitadel/internal/domain"
 	"github.com/zitadel/zitadel/internal/eventstore/v1/models"
 	"github.com/zitadel/zitadel/internal/query"
@@ -13,7 +14,7 @@ import (
 	"github.com/zitadel/zitadel/pkg/grpc/user"
 )
 
-func ListUserGrantsRequestToQuery(ctx context.Context, req *mgmt_pb.ListUserGrantRequest) (*query.UserGrantsQueries, error) {
+func ListUserGrantsRequestToQuery(ctx context.Context, defaults systemdefaults.SystemDefaults, req *mgmt_pb.ListUserGrantRequest) (*query.UserGrantsQueries, error) {
 	queries, err := user_grpc.UserGrantQueriesToQuery(ctx, req.Queries)
 	if err != nil {
 		return nil, err
@@ -27,7 +28,10 @@ func ListUserGrantsRequestToQuery(ctx context.Context, req *mgmt_pb.ListUserGran
 		queries = append(queries, ownerQuery)
 	}
 
-	offset, limit, asc := object.ListQueryToModel(req.Query)
+	offset, limit, asc, err := object.ListQueryToModel(defaults, req.Query)
+	if err != nil {
+		return nil, err
+	}
 	request := &query.UserGrantsQueries{
 		SearchRequest: query.SearchRequest{
 			Offset: offset,

internal/api/grpc/object/converter.go

@@ -5,6 +5,7 @@ import (
 
 	"google.golang.org/protobuf/types/known/timestamppb"
 
+	"github.com/zitadel/zitadel/internal/config/systemdefaults"
 	"github.com/zitadel/zitadel/internal/domain"
 	"github.com/zitadel/zitadel/internal/query"
 	object_pb "github.com/zitadel/zitadel/pkg/grpc/object"
@@ -120,9 +121,12 @@ func TextMethodToQuery(method object_pb.TextQueryMethod) query.TextComparison {
 	}
 }
 
-func ListQueryToModel(query *object_pb.ListQuery) (offset, limit uint64, asc bool) {
-	if query == nil {
-		return 0, 0, false
+// ListQueryToModel converts the list query into offset, limit and sorting order.
+// The limit is defaulted and checked by [systemdefaults.SystemDefaults.V1QueryLimit].
+func ListQueryToModel(defaults systemdefaults.SystemDefaults, query *object_pb.ListQuery) (offset, limit uint64, asc bool, err error) {
+	limit, err = defaults.V1QueryLimit(uint64(query.GetLimit()))
+	if err != nil {
+		return 0, 0, false, err
 	}
-	return query.Offset, uint64(query.Limit), query.Asc
+	return query.GetOffset(), limit, query.GetAsc(), nil
 }

internal/api/grpc/object/converter_test.go

@@ -5,16 +5,23 @@ import (
 
 	"github.com/stretchr/testify/assert"
 
+	"github.com/zitadel/zitadel/internal/config/systemdefaults"
+	"github.com/zitadel/zitadel/internal/zerrors"
 	object_pb "github.com/zitadel/zitadel/pkg/grpc/object"
 )
 
 func Test_ListQueryToModel(t *testing.T) {
+	defaults := systemdefaults.SystemDefaults{
+		DefaultQueryLimit: 100,
+		MaxQueryLimit:     1000,
+	}
 	type args struct {
 		req *object_pb.ListQuery
 	}
 	type res struct {
 		offset, limit uint64
 		asc           bool
+		err           error
 	}
 	tests := []struct {
 		name string
@@ -37,7 +44,7 @@ func Test_ListQueryToModel(t *testing.T) {
 			},
 		},
 		{
-			name: "all fields empty",
+			name: "all fields empty, max limit as default",
 			args: args{
 				req: &object_pb.ListQuery{
 					Offset: 0,
@@ -47,14 +54,39 @@ func Test_ListQueryToModel(t *testing.T) {
 			},
 			res: res{
 				offset: 0,
-				limit:  0,
+				limit:  1000,
 				asc:    false,
 			},
 		},
+		{
+			name: "nil query, max limit as default",
+			args: args{
+				req: nil,
+			},
+			res: res{
+				offset: 0,
+				limit:  1000,
+				asc:    false,
+			},
+		},
+		{
+			name: "limit exceeds max",
+			args: args{
+				req: &object_pb.ListQuery{
+					Offset: 10,
+					Limit:  1001,
+					Asc:    true,
+				},
+			},
+			res: res{
+				err: zerrors.ThrowInvalidArgument(nil, "QUERY-4M0fs", "Errors.Query.LimitExceeded"),
+			},
+		},
 	}
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
-			offset, limit, asc := ListQueryToModel(tt.args.req)
+			offset, limit, asc, err := ListQueryToModel(defaults, tt.args.req)
+			assert.ErrorIs(t, err, tt.res.err)
 			assert.Equal(t, tt.res.offset, offset)
 			assert.Equal(t, tt.res.limit, limit)
 			assert.Equal(t, tt.res.asc, asc)

internal/api/grpc/system/instance.go

@@ -12,7 +12,7 @@ import (
 )
 
 func (s *Server) ListInstances(ctx context.Context, req *system_pb.ListInstancesRequest) (*system_pb.ListInstancesResponse, error) {
-	queries, err := ListInstancesRequestToModel(req)
+	queries, err := ListInstancesRequestToModel(s.systemDefaults, req)
 	if err != nil {
 		return nil, err
 	}
@@ -93,7 +93,7 @@ func (s *Server) RemoveInstance(ctx context.Context, req *system_pb.RemoveInstan
 }
 
 func (s *Server) ListIAMMembers(ctx context.Context, req *system_pb.ListIAMMembersRequest) (*system_pb.ListIAMMembersResponse, error) {
-	queries, err := ListIAMMembersRequestToQuery(req)
+	queries, err := ListIAMMembersRequestToQuery(s.systemDefaults, req)
 	if err != nil {
 		return nil, err
 	}
@@ -133,7 +133,7 @@ func (s *Server) ExistsDomain(ctx context.Context, req *system_pb.ExistsDomainRe
 }
 
 func (s *Server) ListDomains(ctx context.Context, req *system_pb.ListDomainsRequest) (*system_pb.ListDomainsResponse, error) {
-	queries, err := ListInstanceDomainsRequestToModel(req)
+	queries, err := ListInstanceDomainsRequestToModel(s.systemDefaults, req)
 	if err != nil {
 		return nil, err
 	}

internal/api/grpc/system/instance_converter.go

@@ -12,6 +12,7 @@ import (
 	"github.com/zitadel/zitadel/internal/api/grpc/object"
 	z_oidc "github.com/zitadel/zitadel/internal/api/oidc"
 	"github.com/zitadel/zitadel/internal/command"
+	"github.com/zitadel/zitadel/internal/config/systemdefaults"
 	"github.com/zitadel/zitadel/internal/domain"
 	"github.com/zitadel/zitadel/internal/query"
 	instance_pb "github.com/zitadel/zitadel/pkg/grpc/instance"
@@ -201,8 +202,11 @@ func AddInstancePbToSetupInstance(req *system_pb.AddInstanceRequest, defaultInst
 	return &instance
 }
 
-func ListInstancesRequestToModel(req *system_pb.ListInstancesRequest) (*query.InstanceSearchQueries, error) {
-	offset, limit, asc := object.ListQueryToModel(req.Query)
+func ListInstancesRequestToModel(defaults systemdefaults.SystemDefaults, req *system_pb.ListInstancesRequest) (*query.InstanceSearchQueries, error) {
+	offset, limit, asc, err := object.ListQueryToModel(defaults, req.Query)
+	if err != nil {
+		return nil, err
+	}
 	queries, err := instance_grpc.InstanceQueriesToModel(req.Queries)
 	if err != nil {
 		return nil, err
@@ -231,8 +235,11 @@ func fieldNameToInstanceColumn(fieldName instance_pb.FieldName) query.Column {
 	}
 }
 
-func ListInstanceDomainsRequestToModel(req *system_pb.ListDomainsRequest) (*query.InstanceDomainSearchQueries, error) {
-	offset, limit, asc := object.ListQueryToModel(req.Query)
+func ListInstanceDomainsRequestToModel(defaults systemdefaults.SystemDefaults, req *system_pb.ListDomainsRequest) (*query.InstanceDomainSearchQueries, error) {
+	offset, limit, asc, err := object.ListQueryToModel(defaults, req.Query)
+	if err != nil {
+		return nil, err
+	}
 	queries, err := instance_grpc.DomainQueriesToModel(req.Queries)
 	if err != nil {
 		return nil, err
@@ -263,8 +270,11 @@ func fieldNameToInstanceDomainColumn(fieldName instance_pb.DomainFieldName) quer
 	}
 }
 
-func ListIAMMembersRequestToQuery(req *system_pb.ListIAMMembersRequest) (*query.IAMMembersQuery, error) {
-	offset, limit, asc := object.ListQueryToModel(req.Query)
+func ListIAMMembersRequestToQuery(defaults systemdefaults.SystemDefaults, req *system_pb.ListIAMMembersRequest) (*query.IAMMembersQuery, error) {
+	offset, limit, asc, err := object.ListQueryToModel(defaults, req.Query)
+	if err != nil {
+		return nil, err
+	}
 	queries, err := member_grpc.MemberQueriesToQuery(req.Queries)
 	if err != nil {
 		return nil, err

internal/api/grpc/system/integration_test/list_limit_test.go

@@ -0,0 +1,24 @@
+//go:build integration
+
+package system_test
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/require"
+	"google.golang.org/grpc/codes"
+	"google.golang.org/grpc/status"
+
+	"github.com/zitadel/zitadel/internal/integration"
+	"github.com/zitadel/zitadel/pkg/grpc/object"
+	"github.com/zitadel/zitadel/pkg/grpc/system"
+)
+
+func TestServer_ListInstances_LimitExceeded(t *testing.T) {
+	t.Parallel()
+
+	_, err := integration.SystemClient().ListInstances(CTX, &system.ListInstancesRequest{
+		Query: &object.ListQuery{Limit: 1001},
+	})
+	require.Equal(t, codes.InvalidArgument, status.Code(err))
+}

internal/api/grpc/system/server.go

@@ -7,6 +7,7 @@ import (
 	"github.com/zitadel/zitadel/internal/api/authz"
 	"github.com/zitadel/zitadel/internal/api/grpc/server"
 	"github.com/zitadel/zitadel/internal/command"
+	"github.com/zitadel/zitadel/internal/config/systemdefaults"
 	"github.com/zitadel/zitadel/internal/query"
 	"github.com/zitadel/zitadel/pkg/grpc/system"
 )
@@ -20,6 +21,7 @@ var _ system.SystemServiceServer = (*Server)(nil)
 type Server struct {
 	system.UnimplementedSystemServiceServer
 	database        string
+	systemDefaults  systemdefaults.SystemDefaults
 	command         *command.Commands
 	query           *query.Queries
 	defaultInstance command.InstanceSetup
@@ -31,6 +33,7 @@ type Config struct {
 }
 
 func CreateServer(
+	systemDefaults systemdefaults.SystemDefaults,
 	command *command.Commands,
 	query *query.Queries,
 	database string,
@@ -38,6 +41,7 @@ func CreateServer(
 	externalDomain string,
 ) *Server {
 	return &Server{
+		systemDefaults:  systemDefaults,
 		command:         command,
 		query:           query,
 		database:        database,

internal/auth/repository/eventsourcing/eventstore/org.go

@@ -14,8 +14,6 @@ import (
 )
 
 type OrgRepository struct {
-	SearchLimit uint64
-
 	Eventstore     *eventstore.Eventstore
 	View           *auth_view.View
 	SystemDefaults systemdefaults.SystemDefaults

internal/auth/repository/eventsourcing/eventstore/user.go

@@ -18,7 +18,6 @@ import (
 )
 
 type UserRepo struct {
-	SearchLimit    uint64
 	Eventstore     *eventstore.Eventstore
 	View           *view.View
 	Query          *query.Queries

internal/auth/repository/eventsourcing/repository.go

@@ -18,7 +18,6 @@ import (
 )
 
 type Config struct {
-	SearchLimit                uint64
 	Spooler                    auth_handler.Config
 	AmountOfCachedAuthRequests uint16
 }
@@ -44,7 +43,6 @@ func Start(ctx context.Context, conf Config, systemDefaults sd.SystemDefaults, c
 	authReq := cache.Start(dbClient, conf.AmountOfCachedAuthRequests)
 
 	userRepo := eventstore.UserRepo{
-		SearchLimit:    conf.SearchLimit,
 		Eventstore:     esV2,
 		View:           view,
 		Query:          queries,
@@ -90,14 +88,13 @@ func Start(ctx context.Context, conf Config, systemDefaults sd.SystemDefaults, c
 		eventstore.RefreshTokenRepo{
 			View:         view,
 			Eventstore:   esV2,
-			SearchLimit:  conf.SearchLimit,
+			SearchLimit:  systemDefaults.MaxQueryLimit,
 			KeyAlgorithm: oidcEncryption,
 		},
 		eventstore.UserSessionRepo{
 			View: view,
 		},
 		eventstore.OrgRepository{
-			SearchLimit:    conf.SearchLimit,
 			View:           view,
 			SystemDefaults: systemDefaults,
 			Eventstore:     esV2,

internal/config/systemdefaults/system_defaults.go

@@ -59,6 +59,16 @@ func (s SystemDefaults) PaginationToQuery(pagination Pagination) (offset, limit
 	return pagination.GetOffset(), limit, pagination.GetAsc(), nil
 }
 
+// V1QueryLimit returns the limit to apply to a list query of the v1 APIs.
+// Unlike [SystemDefaults.QueryLimit], the MaxQueryLimit is also used as default if no limit is requested,
+// which corresponds to the previous behavior of the v1 APIs.
+func (s SystemDefaults) V1QueryLimit(requested uint64) (uint64, error) {
+	return SystemDefaults{
+		DefaultQueryLimit: s.MaxQueryLimit,
+		MaxQueryLimit:     s.MaxQueryLimit,
+	}.QueryLimit(requested)
+}
+
 type SecretGenerators struct {
 	MachineKeySize     uint32
 	ApplicationKeySize uint32

internal/config/systemdefaults/system_defaults_test.go

@@ -133,3 +133,48 @@ func TestSystemDefaults_PaginationToQuery(t *testing.T) {
 		})
 	}
 }
+
+func TestSystemDefaults_V1QueryLimit(t *testing.T) {
+	t.Parallel()
+
+	tests := []struct {
+		name      string
+		defaults  SystemDefaults
+		requested uint64
+		want      uint64
+		wantErr   error
+	}{
+		{
+			name:      "no limit requested, max applied",
+			defaults:  SystemDefaults{DefaultQueryLimit: 100, MaxQueryLimit: 1000},
+			requested: 0,
+			want:      1000,
+		},
+		{
+			name:      "limit below max",
+			defaults:  SystemDefaults{DefaultQueryLimit: 100, MaxQueryLimit: 1000},
+			requested: 500,
+			want:      500,
+		},
+		{
+			name:      "limit exceeds max",
+			defaults:  SystemDefaults{DefaultQueryLimit: 100, MaxQueryLimit: 1000},
+			requested: 1001,
+			wantErr:   zerrors.ThrowInvalidArgument(nil, "QUERY-4M0fs", "Errors.Query.LimitExceeded"),
+		},
+		{
+			name:      "no max configured",
+			defaults:  SystemDefaults{DefaultQueryLimit: 100},
+			requested: 0,
+			want:      0,
+		},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			t.Parallel()
+			got, err := tt.defaults.V1QueryLimit(tt.requested)
+			assert.ErrorIs(t, err, tt.wantErr)
+			assert.Equal(t, tt.want, got)
+		})
+	}
+}

internal/domain/metadata.go

@@ -4,7 +4,6 @@ import (
 	"time"
 
 	es_models "github.com/zitadel/zitadel/internal/eventstore/v1/models"
-	"github.com/zitadel/zitadel/internal/zerrors"
 )
 
 type Metadata struct {
@@ -64,16 +63,6 @@ type MetadataSearchResponse struct {
 	Timestamp   time.Time
 }
 
-func (r *MetadataSearchRequest) EnsureLimit(limit uint64) error {
-	if r.Limit > limit {
-		return zerrors.ThrowInvalidArgument(nil, "SEARCH-0ds32", "Errors.Limit.ExceedsDefault")
-	}
-	if r.Limit == 0 {
-		r.Limit = limit
-	}
-	return nil
-}
-
 func (r *MetadataSearchRequest) AppendAggregateIDQuery(aggregateID string) {
 	r.Queries = append(r.Queries, &MetadataSearchQuery{Key: MetadataSearchKeyAggregateID, Method: SearchMethodEquals, Value: aggregateID})
 }

internal/eventstore/eventstore.go

@@ -189,12 +189,15 @@ func (es *Eventstore) Search(ctx context.Context, conditions ...map[FieldType]an
 	return es.searcher.Search(ctx, conditions...)
 }
 
+// maxFilterCapacity limits the initial capacity of the events in [Eventstore.Filter].
+const maxFilterCapacity = 1000
+
 // Filter filters the stored events based on the searchQuery
 // and maps the events to the defined event structs
 //
 // Deprecated: Use [FilterToQueryReducer] instead to avoid allocations.
 func (es *Eventstore) Filter(ctx context.Context, searchQuery *SearchQueryBuilder) ([]Event, error) {
-	events := make([]Event, 0, searchQuery.GetLimit())
+	events := make([]Event, 0, min(searchQuery.GetLimit(), maxFilterCapacity))
 	searchQuery.ensureInstanceID(ctx)
 	err := es.querier.FilterToReducer(ctx, searchQuery, func(event Event) error {
 		event, err := es.mapEvent(event)

internal/query/event.go

@@ -27,6 +27,15 @@ type EventEditor struct {
 	AvatarKey         string
 }
 
+// maxEditorsCapacity limits the initial capacity of the editors map of the [eventsReducer].
+// The map only holds the distinct editors of the events, which are usually far less than the limit of the query.
+const maxEditorsCapacity = 100
+
+// editorsCapacity returns the initial capacity of the editors map for the given limit of the query.
+func editorsCapacity(limit uint64) uint64 {
+	return min(limit, maxEditorsCapacity)
+}
+
 type eventsReducer struct {
 	ctx     context.Context
 	q       *Queries
@@ -50,7 +59,7 @@ func (q *Queries) SearchEvents(ctx context.Context, query *eventstore.SearchQuer
 	if auditLogRetention != 0 {
 		query = filterAuditLogRetention(ctx, auditLogRetention, query)
 	}
-	reducer := &eventsReducer{ctx: ctx, q: q, editors: make(map[string]*EventEditor, query.GetLimit())}
+	reducer := &eventsReducer{ctx: ctx, q: q, editors: make(map[string]*EventEditor, editorsCapacity(query.GetLimit()))}
 	if err = q.eventstore.FilterToReducer(ctx, query, reducer); err != nil {
 		return nil, err
 	}

internal/query/event_test.go

@@ -0,0 +1,36 @@
+package query
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+)
+
+func Test_editorsCapacity(t *testing.T) {
+	tests := []struct {
+		name  string
+		limit uint64
+		want  uint64
+	}{
+		{
+			name:  "no limit",
+			limit: 0,
+			want:  0,
+		},
+		{
+			name:  "limit below max",
+			limit: 20,
+			want:  20,
+		},
+		{
+			name:  "limit above max",
+			limit: 1 << 32,
+			want:  maxEditorsCapacity,
+		},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			assert.Equal(t, tt.want, editorsCapacity(tt.limit))
+		})
+	}
+}

internal/user/model/external_idp_view.go

@@ -4,7 +4,6 @@ import (
 	"time"
 
 	"github.com/zitadel/zitadel/internal/domain"
-	"github.com/zitadel/zitadel/internal/zerrors"
 )
 
 type ExternalIDPView struct {
@@ -54,16 +53,6 @@ type ExternalIDPSearchResponse struct {
 	Timestamp   time.Time
 }
 
-func (r *ExternalIDPSearchRequest) EnsureLimit(limit uint64) error {
-	if r.Limit > limit {
-		return zerrors.ThrowInvalidArgument(nil, "SEARCH-3n8fM", "Errors.Limit.ExceedsDefault")
-	}
-	if r.Limit == 0 {
-		r.Limit = limit
-	}
-	return nil
-}
-
 func (r *ExternalIDPSearchRequest) AppendUserQuery(userID string) {
 	r.Queries = append(r.Queries, &ExternalIDPSearchQuery{Key: ExternalIDPSearchKeyUserID, Method: domain.SearchMethodEquals, Value: userID})
 }

internal/user/model/token_view.go

@@ -4,7 +4,6 @@ import (
 	"time"
 
 	"github.com/zitadel/zitadel/internal/domain"
-	"github.com/zitadel/zitadel/internal/zerrors"
 )
 
 type TokenView struct {
@@ -60,13 +59,3 @@ type TokenSearchResponse struct {
 	TotalResult uint64
 	Result      []*Token
 }
-
-func (r *TokenSearchRequest) EnsureLimit(limit uint64) error {
-	if r.Limit > limit {
-		return zerrors.ThrowInvalidArgument(nil, "SEARCH-M0fse", "Errors.Limit.ExceedsDefault")
-	}
-	if r.Limit == 0 {
-		r.Limit = limit
-	}
-	return nil
-}

internal/user/model/user_membership_view.go

@@ -4,7 +4,6 @@ import (
 	"time"
 
 	"github.com/zitadel/zitadel/internal/domain"
-	"github.com/zitadel/zitadel/internal/zerrors"
 )
 
 type UserMembershipView struct {
@@ -68,16 +67,6 @@ type UserMembershipSearchResponse struct {
 	Timestamp   time.Time
 }
 
-func (r *UserMembershipSearchRequest) EnsureLimit(limit uint64) error {
-	if r.Limit > limit {
-		return zerrors.ThrowInvalidArgument(nil, "SEARCH-288fJ", "Errors.Limit.ExceedsDefault")
-	}
-	if r.Limit == 0 {
-		r.Limit = limit
-	}
-	return nil
-}
-
 func (r *UserMembershipSearchRequest) GetSearchQuery(key UserMembershipSearchKey) (int, *UserMembershipSearchQuery) {
 	for i, q := range r.Queries {
 		if q.Key == key {

internal/user/model/user_session_view.go

@@ -4,7 +4,6 @@ import (
 	"time"
 
 	"github.com/zitadel/zitadel/internal/domain"
-	"github.com/zitadel/zitadel/internal/zerrors"
 )
 
 type UserSessionView struct {
@@ -62,13 +61,3 @@ type UserSessionSearchResponse struct {
 	TotalResult uint64
 	Result      []*UserSessionView
 }
-
-func (r *UserSessionSearchRequest) EnsureLimit(limit uint64) error {
-	if r.Limit > limit {
-		return zerrors.ThrowInvalidArgument(nil, "SEARCH-27ifs", "Errors.Limit.ExceedsDefault")
-	}
-	if r.Limit == 0 {
-		r.Limit = limit
-	}
-	return nil
-}

internal/user/model/user_view.go

@@ -135,16 +135,6 @@ const (
 	GenderDiverse
 )
 
-func (r *UserSearchRequest) EnsureLimit(limit uint64) error {
-	if r.Limit > limit {
-		return zerrors.ThrowInvalidArgument(nil, "SEARCH-zz62F", "Errors.Limit.ExceedsDefault")
-	}
-	if r.Limit == 0 {
-		r.Limit = limit
-	}
-	return nil
-}
-
 func (r *UserSearchRequest) AppendMyOrgQuery(orgID string) {
 	r.Queries = append(r.Queries, &UserSearchQuery{Key: UserSearchKeyResourceOwner, Method: domain.SearchMethodEquals, Value: orgID})
 }

proto/zitadel/change.proto

@@ -69,7 +69,7 @@ message ChangeQuery {
     uint32 limit = 2 [
         (grpc.gateway.protoc_gen_openapiv2.options.openapiv2_field) = {
             example: "20";
-            description: "Maximum amount of events returned. The default is set to 1000 in https://github.com/zitadel/zitadel/blob/new-eventstore/cmd/zitadel/startup.yaml. If no limit is set or the limit exceeds the maximum configured Zitadel will throw an error. If no limit is present the default is taken.";
+            description: "Maximum amount of events returned. If no limit is present, the configured maximum (SystemDefaults.MaxQueryLimit, 1000 by default) is taken. If the limit exceeds the configured maximum, ZITADEL returns an InvalidArgument error.";
         }
     ];
     bool asc = 3 [

proto/zitadel/management.proto

@@ -10860,8 +10860,10 @@ message RemoveProjectGrantResponse {
 }
 
 message ListProjectGrantMemberRolesRequest {
-    zitadel.v1.ListQuery query = 1;
-    repeated string result = 2;
+    // Deprecated: not used, all roles are always returned
+    zitadel.v1.ListQuery query = 1 [deprecated = true];
+    // Deprecated: not used, all roles are always returned
+    repeated string result = 2 [deprecated = true];
 }
 
 message ListProjectGrantMemberRolesResponse {

proto/zitadel/object.proto

@@ -53,7 +53,7 @@ message ListQuery {
     uint32 limit = 2 [
         (grpc.gateway.protoc_gen_openapiv2.options.openapiv2_field) = {
             example: "100";
-            description: "Maximum amount of events returned. The default is set to 1000 in https://github.com/zitadel/zitadel/blob/new-eventstore/cmd/zitadel/startup.yaml. If the limit exceeds the maximum configured Zitadel will throw an error. If no limit is present the default is taken.";
+            description: "Maximum amount of results returned. If no limit is present, the configured maximum (SystemDefaults.MaxQueryLimit, 1000 by default) is taken. If the limit exceeds the configured maximum, ZITADEL returns an InvalidArgument error.";
         }
     ];
     bool asc = 3 [