diff --git a/swh/web/api/views/origin.py b/swh/web/api/views/origin.py
--- a/swh/web/api/views/origin.py
+++ b/swh/web/api/views/origin.py
@@ -218,7 +218,7 @@
     """
     result = {}
     offset = int(request.query_params.get('offset', '0'))
-    limit = int(request.query_params.get('limit', '70'))
+    limit = min(int(request.query_params.get('limit', '70')), 100)
     regexp = request.query_params.get('regexp', 'false')
     with_visit = request.query_params.get('with_visit', 'false')
 
diff --git a/swh/web/tests/api/views/test_origin.py b/swh/web/tests/api/views/test_origin.py
--- a/swh/web/tests/api/views/test_origin.py
+++ b/swh/web/tests/api/views/test_origin.py
@@ -474,6 +474,20 @@
         self.assertEqual({origin['url'] for origin in results},
                          expected_origins)
 
+    def test_api_origin_search_limit(self):
+        self.storage.origin_add([
+            {'url': 'http://foobar/{}'.format(i)}
+            for i in range(200)
+        ])
+
+        url = reverse('api-1-origin-search',
+                      url_args={'url_pattern': 'foobar'},
+                      query_params={'limit': 150})
+        rv = self.client.get(url)
+        self.assertEqual(rv.status_code, 200, rv.data)
+        self.assertEqual(rv['Content-Type'], 'application/json')
+        self.assertEqual(len(rv.data), 100)
+
     @given(origin())
     def test_api_origin_metadata_search(self, origin):
         with patch('swh.web.common.service.idx_storage') as mock_idx_storage: