diff --git a/api-reference/pipecat-cloud/rest-reference/openapi-start.json b/api-reference/pipecat-cloud/rest-reference/openapi-start.json
index 916d3b3a..dd4c1d00 100644
--- a/api-reference/pipecat-cloud/rest-reference/openapi-start.json
+++ b/api-reference/pipecat-cloud/rest-reference/openapi-start.json
@@ -109,7 +109,7 @@
           },
           "body": {
             "type": "object",
-            "description": "Arbitrary user data / configuration object to pass to the service instance. Accessible as the first parameter of the `bot` method or custom entry point.\n\nSee the [`Starting Sessions` docs](../../fundamentals/active-sessions#passing-data) for more information.",
+            "description": "Arbitrary user data / configuration object to pass to the service instance. Accessible as the first parameter of the `bot` method or custom entry point. Maximum size 1 MB. For `transport: \"websocket\"`, the service must be deployed with `websocket_auth = \"token\"`. See the [`Starting Sessions` docs](/pipecat-cloud/fundamentals/active-sessions#passing-data) for details.",
             "example": { "foo": "bar" }
           }
         }
diff --git a/pipecat-cloud/fundamentals/active-sessions.mdx b/pipecat-cloud/fundamentals/active-sessions.mdx
index 2263faf9..c1b60139 100644
--- a/pipecat-cloud/fundamentals/active-sessions.mdx
+++ b/pipecat-cloud/fundamentals/active-sessions.mdx
@@ -218,6 +218,16 @@ For more advanced data requirements, your application should run its own data fe
 
 If you require your agent to fetch it's own data, be mindful of any blocking requests that could slow down the start process.
 
+### Size limits
+
+The maximum body size is **1 MB of JSON** across all transports. Requests exceeding this limit are rejected with `413 Payload Too Large` before any bot is started.
+
+<Note>
+  For `transport: "websocket"`, passing a `body` requires the service to be deployed with `websocket_auth = "token"` (see [WebSocket Authentication](/pipecat-cloud/guides/websocket-authentication)). The body is delivered to the bot through the authenticated session, not encoded into the WebSocket URL — so the returned `wsUrl` stays compact and there are no URL-construction concerns on your client side.
+
+  A `/start` call with a `body` and `websocket_auth = "none"` is rejected with `400 Bad Request`.
+</Note>
+
 ## Agent capacity
 
 Deployments have an upper limit for the number of sessions that can be started concurrently.
diff --git a/pipecat-cloud/guides/generic-websocket.mdx b/pipecat-cloud/guides/generic-websocket.mdx
index 4491bc50..27c514bc 100644
--- a/pipecat-cloud/guides/generic-websocket.mdx
+++ b/pipecat-cloud/guides/generic-websocket.mdx
@@ -47,3 +47,22 @@ wscat -c "wss://us-west.api.pipecat.daily.co/ws/generic/my-agent.my-org"
 The generic endpoint supports both text and binary WebSocket frames. Your bot receives messages exactly as sent by the client — no protocol-specific parsing or transformation is applied.
 
 Your bot code is responsible for handling the client's message format. Use the appropriate [serializer](/api-reference/server/services/serializers/introduction) for your client's protocol, or implement custom message handling for non-standard clients.
+
+## Passing parameters to the bot
+
+When your service is deployed with `websocket_auth = "token"`, you can pass arbitrary JSON data to your bot at session start by including a `body` in the `/start` request:
+
+```bash
+curl -X POST "https://api.pipecat.daily.co/v1/public/my-agent/start" \
+  -H "Authorization: Bearer pk_your_public_key" \
+  -H "Content-Type: application/json" \
+  -d '{"transport": "websocket", "body": {"caller_id": "abc123"}}'
+```
+
+The body is delivered to your bot as `args.body` — the same way it works for `daily` and `webrtc` transports. See [Passing data](/pipecat-cloud/fundamentals/active-sessions#passing-data) for examples in your bot code.
+
+<Note>
+  Body delivery for `transport: "websocket"` requires `websocket_auth = "token"`. The body is held server-side and handed to the bot once the WebSocket upgrade authenticates the session token — the returned `wsUrl` itself is unchanged regardless of body size. Maximum body size is **1 MB of JSON**, matching the other transports.
+
+  A `/start` call with a `body` against a service that has `websocket_auth = "none"` is rejected with `400 Bad Request`.
+</Note>