For example,
Passing {"sysparm_limit":"1"} as the query when getting records from the incident table still returns all the records.
Passing {"state":"2","sysparm_fields":"sys_id,number,caller_id,opened_at,short_description,cmdb_ci"} as the query when getting records from the incident table will correctly filter down the returned results to only records that have state=2. However, all records fields are returned (not just the ones requested in the sysparm_fields parameter)