From d1ad3cebe268f77cd29a347efb142140777fb4c4 Mon Sep 17 00:00:00 2001
From: AlexGPlay <alex.garcia@elastic.co>
Date: Tue, 17 Feb 2026 12:14:34 +0100
Subject: [PATCH 1/2] Add maxSize to unbounded arrays

---
 .../data/server/search/routes/response_schema.ts  | 15 +++++++++++----
 .../shared/data/server/search/routes/session.ts   |  7 +++++--
 2 files changed, 16 insertions(+), 6 deletions(-)

diff --git a/src/platform/plugins/shared/data/server/search/routes/response_schema.ts b/src/platform/plugins/shared/data/server/search/routes/response_schema.ts
index 7f54ca4fff15a..9ff0f1fc3f880 100644
--- a/src/platform/plugins/shared/data/server/search/routes/response_schema.ts
+++ b/src/platform/plugins/shared/data/server/search/routes/response_schema.ts
@@ -15,6 +15,12 @@ const searchSessionRequestInfoSchema = schema.object({
   status: schema.maybe(schema.string()),
   startedAt: schema.maybe(schema.string()),
   completedAt: schema.maybe(schema.string()),
+  error: schema.maybe(
+    schema.object({
+      code: schema.number(),
+      message: schema.maybe(schema.string()),
+    })
+  ),
 });
 
 const serializeableSchema = schema.mapOf(schema.string(), schema.any());
@@ -50,7 +56,7 @@ const status = schema.object({
     schema.literal('cancelled'),
     schema.literal('expired'),
   ]),
-  errors: schema.maybe(schema.arrayOf(schema.string())),
+  errors: schema.maybe(schema.arrayOf(schema.string(), { maxSize: 10000 })),
 });
 
 export const searchSessionStatusSchema = status;
@@ -61,12 +67,13 @@ export const searchSessionStatusesSchema = schema.object({
 
 export const searchSessionsFindSchema = schema.object({
   total: schema.number(),
-  saved_objects: schema.arrayOf(searchSessionSchema),
+  saved_objects: schema.arrayOf(searchSessionSchema, { maxSize: 10000 }),
   statuses: schema.recordOf(schema.string(), searchSessionStatusSchema),
 });
 
 const referencesSchema = schema.arrayOf(
-  schema.object({ id: schema.string(), type: schema.string(), name: schema.string() })
+  schema.object({ id: schema.string(), type: schema.string(), name: schema.string() }),
+  { maxSize: 10 }
 );
 
 export const searchSessionsUpdateSchema = schema.object({
@@ -75,7 +82,7 @@ export const searchSessionsUpdateSchema = schema.object({
   updated_at: schema.maybe(schema.string()),
   updated_by: schema.maybe(schema.string()),
   version: schema.maybe(schema.string()),
-  namespaces: schema.maybe(schema.arrayOf(schema.string())),
+  namespaces: schema.maybe(schema.arrayOf(schema.string(), { maxSize: 1 })),
   references: schema.maybe(referencesSchema),
   attributes: schema.object({
     name: schema.maybe(schema.string()),
diff --git a/src/platform/plugins/shared/data/server/search/routes/session.ts b/src/platform/plugins/shared/data/server/search/routes/session.ts
index 069df2cc114e5..406c9032aeef1 100644
--- a/src/platform/plugins/shared/data/server/search/routes/session.ts
+++ b/src/platform/plugins/shared/data/server/search/routes/session.ts
@@ -196,7 +196,7 @@ export function registerSessionRoutes(router: DataPluginRouter, logger: Logger):
                 schema.oneOf([schema.literal('desc'), schema.literal('asc')])
               ),
               filter: schema.maybe(schema.string()),
-              searchFields: schema.maybe(schema.arrayOf(schema.string())),
+              searchFields: schema.maybe(schema.arrayOf(schema.string(), { maxSize: 10 })),
               search: schema.maybe(schema.string()),
             }),
           },
@@ -412,7 +412,10 @@ export function registerSessionRoutes(router: DataPluginRouter, logger: Logger):
         validate: {
           request: {
             body: schema.object({
-              sessionIds: schema.arrayOf(schema.string()),
+              // When a search is sent to the background the client starts polling for its status. All the searches that
+              // are in progress are sent to the server to get their updated status until they are in a completed status.
+              // For this endpoint the assumption is that the client won't have more than 100 searches in progress at the same time.
+              sessionIds: schema.arrayOf(schema.string(), { maxSize: 100 }),
             }),
           },
           response: {

From cbe82f4fce61d5ee37f538463018c9e177dc2378 Mon Sep 17 00:00:00 2001
From: AlexGPlay <alex.garcia@elastic.co>
Date: Thu, 19 Feb 2026 08:46:06 +0100
Subject: [PATCH 2/2] Add namespaces comment

---
 .../plugins/shared/data/server/search/routes/response_schema.ts  | 1 +
 1 file changed, 1 insertion(+)

diff --git a/src/platform/plugins/shared/data/server/search/routes/response_schema.ts b/src/platform/plugins/shared/data/server/search/routes/response_schema.ts
index 9ff0f1fc3f880..b4757bf35722c 100644
--- a/src/platform/plugins/shared/data/server/search/routes/response_schema.ts
+++ b/src/platform/plugins/shared/data/server/search/routes/response_schema.ts
@@ -82,6 +82,7 @@ export const searchSessionsUpdateSchema = schema.object({
   updated_at: schema.maybe(schema.string()),
   updated_by: schema.maybe(schema.string()),
   version: schema.maybe(schema.string()),
+  // The search-sessions saved object definition specifies that the namespaces are 'single', that means only one space is allowed.
   namespaces: schema.maybe(schema.arrayOf(schema.string(), { maxSize: 1 })),
   references: schema.maybe(referencesSchema),
   attributes: schema.object({