diff --git a/swh/web/api/views/origin.py b/swh/web/api/views/origin.py
--- a/swh/web/api/views/origin.py
+++ b/swh/web/api/views/origin.py
@@ -195,6 +195,7 @@
 
         :param string url_pattern: a string pattern or a regular expression
         :query int limit: the maximum number of found origins to return
+            (bounded to 1000)
         :query boolean regexp: if true, consider provided pattern as a regular
             expression and search origins whose urls match it
         :query boolean with_visit: if true, only return origins with at least
@@ -218,7 +219,7 @@
     """
     result = {}
     offset = int(request.query_params.get('offset', '0'))
-    limit = int(request.query_params.get('limit', '70'))
+    limit = min(int(request.query_params.get('limit', '70')), 1000)
     regexp = request.query_params.get('regexp', 'false')
     with_visit = request.query_params.get('with_visit', 'false')
 
diff --git a/swh/web/browse/views/origin.py b/swh/web/browse/views/origin.py
--- a/swh/web/browse/views/origin.py
+++ b/swh/web/browse/views/origin.py
@@ -178,7 +178,7 @@
     The search is performed in a case insensitive way.
     """
     offset = int(request.GET.get('offset', '0'))
-    limit = int(request.GET.get('limit', '50'))
+    limit = min(int(request.GET.get('limit', '50')), 1000)
     regexp = request.GET.get('regexp', 'false')
     with_visit = request.GET.get('with_visit', 'false')
 
diff --git a/swh/web/tests/api/views/test_origin.py b/swh/web/tests/api/views/test_origin.py
--- a/swh/web/tests/api/views/test_origin.py
+++ b/swh/web/tests/api/views/test_origin.py
@@ -474,6 +474,20 @@
         self.assertEqual({origin['url'] for origin in results},
                          expected_origins)
 
+    def test_api_origin_search_limit(self):
+        self.storage.origin_add([
+            {'url': 'http://foobar/{}'.format(i)}
+            for i in range(2000)
+        ])
+
+        url = reverse('api-1-origin-search',
+                      url_args={'url_pattern': 'foobar'},
+                      query_params={'limit': 1050})
+        rv = self.client.get(url)
+        self.assertEqual(rv.status_code, 200, rv.data)
+        self.assertEqual(rv['Content-Type'], 'application/json')
+        self.assertEqual(len(rv.data), 1000)
+
     @given(origin())
     def test_api_origin_metadata_search(self, origin):
         with patch('swh.web.common.service.idx_storage') as mock_idx_storage: