<Step>
<Name>RF-Content-Length-Exceeds-Limit</Name>
<Condition>(request.header.content-length > 1048576 and request.header.content-type = "application/json") OR
(request.header.content-length > 10485760)</Condition>
</Step>
But that won’t be sufficient, as for large payloads, clients use chunked transfer encoding, which means there is no content-length header. So you would need to also restrict your API from accepting that, as well.