In our use case, it'll be small, but we should design with bigger datasets in mind.

This might be a good opportunity for you two to discuss a generic paging strategy in the API. In any case, it would seem prudent to have a default recordset size limit to avoid pushing too much data over the wires (DB->API, API->client) .