After investigation, varnish has parameter to limit the size of HTTP request : http_req_size.
But it doesn't specify on which HTTP verb this applies. In theory, the API should accept body only on POST/PUT/PATCH request so it should do the job.

My bad, the Web API is running behind HTTP reverse proxy (varnish). I'll propose a more appropriate solution.

According the django documentation, the DATA_UPLOAD_MAX_MEMORY_SIZE variable should do the job.
By default, the variable is set to 2.5 MB. From my experience, 1 MB is sufficient (for example, it's also the limit for some JS library).