Detecting HTTP Status Code Misuses in REST APIs via Static and Dynamic Analysis

• URL: http://arxiv.org/abs/2609.12770v1
• Date: Fri, 11 Sep 2026 12:24:08 GMT
• Title: Detecting HTTP Status Code Misuses in REST APIs via Static and Dynamic Analysis
• Abstract summary: We study 2,625 real-world REST API specifications to identify relevant status codes and derive a set of 30 usage rules.<n>We then implement tools to identify such rule violations in OpenAPI specifications and in API behavior.<n>Our evaluation finds that status code misuses are frequent and systematic in REST APIs, with both static and dynamic approaches detecting various misuses.
• Score: 6.313931079988986
• License: http://creativecommons.org/licenses/by-nc-nd/4.0/
• Abstract: REST APIs are widely used on the web for client-server communications. As REST is based on HTTP, server responses contain status codes to indicate the outcome of requests (e.g., 200 OK for a success and 404 Not Found for an unavailable resource). While HTTP status codes are standardized, their semantics are not enforced in REST, leading to many misuses in practice (e.g., using 500 Internal Server Error to describe a client error). Such misuses may have nefarious consequences, such as reducing interoperability, misleading API clients, or causing false positives in testing tools. In this paper, we present a combined static and dynamic analysis approach for detecting HTTP status code misuses in REST APIs. We first study 2,625 real-world REST API specifications to identify relevant status codes and derive a set of 30 usage rules based on HTTP standards and REST API principles. We then implement tools to identify such rule violations in OpenAPI specifications (static analysis) and in API behavior (dynamic analysis). Our evaluation finds that status code misuses are frequent and systematic in REST APIs, with both static and dynamic approaches detecting various misuses. We highlight that both approaches may be used in a complementary manner, and also provide insight for REST API testers and users alike.

Related papers

• RESTCov: A Tool for Structural Coverage Analysis of REST APIs [0.6445605125467572]
  RESTCov is a tool that computes structural REST API coverage from an OpenAPI specification.<n>It produces both machine-readable results and a human-readable HTML report.
  arXiv  Detail & Related papers  (2026-08-28T09:23:36Z)
• Validating HTTP Semantics in REST APIs With Constructed Call Sequence Scenarios [3.345985238464945]
  Failures in following the specifications of HTTP can lead to confusing and hard to use REST APIs.<n>We extend the state-of-the-art fuzzer EvoMaster with 9 new oracles to detect HTTP semanticslevel faults.
  arXiv  Detail & Related papers  (2026-08-17T08:16:31Z)
• Multi-Agent LLM-based Metamorphic Testing for REST APIs [1.7616042687330637]
  We present ARMeta, a tool-supported approach that uses an LLM-based multi-agent workflow to support metamorphic testing of REST APIs.<n>We evaluate ARMeta on two publicly available web applications that expose REST interfaces and compare its performance with a scenario-based testing baseline.
  arXiv  Detail & Related papers  (2026-05-27T11:24:46Z)
• AutoRestTest: A Tool for Automated REST API Testing Using LLMs and MARL [46.65963514391019]
  AutoRestTest is a novel tool that integrates the Semantic Property Dependency Graph (SPDG) with Multi-Agent Reinforcement Learning (MARL) and large language models (LLMs) for effective REST API testing.
  arXiv  Detail & Related papers  (2025-01-15T05:54:33Z)
• LlamaRestTest: Effective REST API Testing with Small Language Models [50.058600784556816]
  We present LlamaRestTest, a novel approach that employs two custom Large Language Models (LLMs) to generate realistic test inputs.<n>We evaluate it against several state-of-the-art REST API testing tools, including RESTGPT, a GPT-powered specification-enhancement tool.<n>Our study shows that small language models can perform as well as, or better than, large language models in REST API testing.
  arXiv  Detail & Related papers  (2025-01-15T05:51:20Z)
• APIRL: Deep Reinforcement Learning for REST API Fuzzing [3.053989095162017]
  APIRL is a fully automated deep reinforcement learning tool for testing REST APIs.<n>We show APIRL can find significantly more bugs than the state-of-the-art in real world REST APIs.
  arXiv  Detail & Related papers  (2024-12-20T15:40:51Z)
• A Multi-Agent Approach for REST API Testing with Semantic Graphs and LLM-Driven Inputs [46.65963514391019]
  We present AutoRestTest, the first black-box tool to adopt a dependency-embedded multi-agent approach for REST API testing.<n>Our approach treats REST API testing as a separable problem, where four agents collaborate to optimize API exploration.<n>Our evaluation of AutoRestTest on 12 real-world REST services shows that it outperforms the four leading black-box REST API testing tools.
  arXiv  Detail & Related papers  (2024-11-11T16:20:27Z)
• A Systematic Evaluation of Large Code Models in API Suggestion: When, Which, and How [53.65636914757381]
  API suggestion is a critical task in modern software development. Recent advancements in large code models (LCMs) have shown promise in the API suggestion task.
  arXiv  Detail & Related papers  (2024-09-20T03:12:35Z)
• You Can REST Now: Automated REST API Documentation and Testing via LLM-Assisted Request Mutations [8.158964648211002]
  We present RESTSpecIT, the first automated approach that infers documentation and performs black-box testing of REST APIs.<n>Our approach requires minimal user input compared to state-of-the-art tools.<n>We evaluate the quality of our tool with three state-of-the-art LLMs: DeepSeek V3, GPT-4.1, and GPT-3.5.
  arXiv  Detail & Related papers  (2024-02-07T18:55:41Z)
• Leveraging Large Language Models to Improve REST API Testing [51.284096009803406]
  RESTGPT takes as input an API specification, extracts machine-interpretable rules, and generates example parameter values from natural-language descriptions in the specification. Our evaluations indicate that RESTGPT outperforms existing techniques in both rule extraction and value generation.
  arXiv  Detail & Related papers  (2023-12-01T19:53:23Z)
• Exploring Behaviours of RESTful APIs in an Industrial Setting [0.43012765978447565]
  We propose a set of behavioural properties, common to REST APIs, which are used to generate examples of behaviours that these APIs exhibit. These examples can be used both (i) to further the understanding of the API and (ii) as a source of automatic test cases. Our approach can generate examples deemed relevant for understanding the system and for a source of test generation by practitioners.
  arXiv  Detail & Related papers  (2023-10-26T11:33:11Z)
• Adaptive REST API Testing with Reinforcement Learning [54.68542517176757]
  Current testing tools lack efficient exploration mechanisms, treating all operations and parameters equally. Current tools struggle when response schemas are absent in the specification or exhibit variants. We present an adaptive REST API testing technique incorporates reinforcement learning to prioritize operations during exploration.
  arXiv  Detail & Related papers  (2023-09-08T20:27:05Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.