Log-based, Business-aware REST API Testing
2026-04-09 • Software Engineering
Software Engineering
AI summaryⓘ
The authors developed LoBREST, a method to test REST APIs more thoroughly by using past request logs to better capture real business rules that are often missing from official API documents. They split these logs into manageable pieces, fix any gaps, and then use these improved logs to guide their testing process to uncover deeper issues. Compared to other tools, LoBREST found more bugs and achieved higher coverage on real-world services, making it better at testing complex API behaviors. This approach helps make sure important business functions don’t break due to API faults.
REST APImicroservicesAPI testingSwaggerOpenAPIhistorical request logsbusiness constraintsfuzzingoperation coverage5XX bugs
Authors
Ding Yang, Ruixiang Qian, Zhao Wei, Zhenyu Chen, Chunrong Fang
Abstract
REST APIs enable collaboration among microservices. A single fault in a REST API can bring down the entire microservice system and cause significant financial losses, underscoring the importance of REST API testing. Effectively testing REST APIs requires thoroughly exercising the functionalities behind them. To this end, existing techniques leverage REST specifications (e.g., Swagger or OpenAPI) to generate test cases. Using the resource constraints extracted from specifications, these techniques work well for testing simple, business-insensitive functionalities, such as resource creation, retrieval, update, and deletion. However, for complex, business-sensitive functionalities, these specification-based techniques often fall short, since exercising such functionalities requires additional business constraints that are typically absent from REST specifications. In this paper, we present LoBREST, a log-based, business-aware REST API testing technique that leverages historical request logs (HRLogs) to effectively exercise the business-sensitive functionalities behind REST APIs. To obtain compact operation sequences that preserve clean and complete business constraints, LoBREST first employs a locality-slicing strategy to partition HRLogs into smaller slices. Then, to ensure the effectiveness of the obtained slices, LoBREST enhances them in two steps: (1) adding slices for operations missing from HRLogs, and (2) completing missing resources within the slices. Finally, to improve test adequacy, LoBREST uses these enhanced slices as initial seeds to perform business-aware fuzzing. LoBREST outperformed eight tools (including Arat-rl, Morest, and Deeprest) across 17 real-world services. It achieved top operation coverage on 16 services and line coverage on 15, averaging 2.1x and 1.2x improvements over the runner-up. LoBREST detected 108 5XX bugs, including 38 found by no other tool.