diff --git a/src/GraphQL/Queries/GetClaimsQuery.php b/src/GraphQL/Queries/GetClaimsQuery.php
index 473fa2a..330b65a 100644
--- a/src/GraphQL/Queries/GetClaimsQuery.php
+++ b/src/GraphQL/Queries/GetClaimsQuery.php
@@ -54,12 +54,12 @@ public function args(): array
             'codes' => [
                 'type' => GraphQL::type('[String]'),
                 'description' => __('enjin-platform-beam::mutation.claim_beam.args.code'),
-                'rules' => ['prohibits:ids'],
+                'rules' => ['prohibits:ids', 'array', 'max:100'],
             ],
             'singleUseCodes' => [
                 'type' => GraphQL::type('[String]'),
                 'description' => __('enjin-platform-beam::mutation.claim_beam.args.single_use_code'),
-                'rules' => ['prohibits:ids'],
+                'rules' => ['prohibits:ids', 'array', 'max:100'],
             ],
             'accounts' => [
                 'type' => GraphQL::type('[String]'),
@@ -101,7 +101,8 @@ protected function rules(array $args = []): array
     {
         return [
             'ids.*' => [new MinBigInt(1), new MaxBigInt()],
-            'codes.*' => ['max:1024'],
+            'codes.*' => ['max:32'],
+            'singleUseCodes.*' => ['max:512'],
             'accounts.*' => [new ValidSubstrateAccount()],
         ];
     }
diff --git a/tests/Feature/GraphQL/Queries/GetClaimsTest.php b/tests/Feature/GraphQL/Queries/GetClaimsTest.php
index 2d022c7..6d365da 100644
--- a/tests/Feature/GraphQL/Queries/GetClaimsTest.php
+++ b/tests/Feature/GraphQL/Queries/GetClaimsTest.php
@@ -92,15 +92,38 @@ public function test_it_can_get_claims_with_statuses(): void
      */
     public function test_will_fail_with_invalid_parameters(): void
     {
+        $codes = array_fill(0, 10, fake()->text(32));
+        $codes[0] = fake()->text(2000);
         $response = $this->graphql($this->method, [
             'ids' => [1],
-            'codes' => [fake()->text(2000)],
+            'codes' => $codes,
+            'singleUseCodes' => [fake()->text(2000)],
         ], true);
 
         $this->assertArraySubset([
             'ids' => ['The ids field prohibits codes from being present.'],
             'codes' => ['The codes field prohibits ids from being present.'],
-            'codes.0' => ['The codes.0 field must not be greater than 1024 characters.'],
+            'codes.0' => ['The codes.0 field must not be greater than 32 characters.'],
+            'singleUseCodes' => ['The single use codes field prohibits ids from being present.'],
+            'singleUseCodes.0' => ['The singleUseCodes.0 field must not be greater than 512 characters.'],
+        ], $response['error']);
+    }
+
+    /**
+     * Test get claims too many codes.
+     */
+    public function test_will_fail_with_too_many_codes(): void
+    {
+        $codes = array_fill(0, 101, fake()->text(32));
+        $singleUseCodes = array_fill(0, 101, fake()->text(384));
+        $response = $this->graphql($this->method, [
+            'codes' => $codes,
+            'singleUseCodes' => $singleUseCodes,
+        ], true);
+
+        $this->assertArraySubset([
+            'codes' => ['The codes field must not have more than 100 items.'],
+            'singleUseCodes' => ['The single use codes field must not have more than 100 items.'],
         ], $response['error']);
     }
 }