The REST API specification (v.2.12) states that it is 200 characters.
See the chapter 4.2, page 7:
There is another API (it is not currently used by my Magento 2 extension) which limits a similar parameter (txn_id) to 30 characters:
https://developer.qiwi.com/ru/pull-payments/index.html#wf
