A Catalogue of Inter-parameter Dependencies in RESTful Web APIs

Abstract

Web services often impose dependency constraints that restrict the way in which two or more input parameters can be combined to form valid calls to the service. Unfortunately, current specification languages for web services like the OpenAPI Specification provide no support for the formal description of such dependencies, which makes it hardly possible to automatically discover and interact with services without human intervention. Researchers and practitioners are openly requesting support for modelling and validating dependencies among input parameters in web APIs, but this is not possible unless we share a deep understanding of how dependencies emerge in practice-the aim of this work. In this paper, we present a thorough study on the presence of dependency constraints among input parameters in web APIs in industry. The study is based on a review of more than 2.5K operations from 40 real-world RESTful APIs from multiple application domains. Overall, our findings show that input dependencies are the norm, rather than the exception, with 85% of the reviewed APIs having some kind of dependency among their input parameters. As the main outcome of our study, we present a catalogue of seven types of dependencies consistently found in RESTful web APIs.

Deep Learning-Based Prediction of Test Input Validity for RESTful APIs

“…-For each number and string column, an auxiliary boolean column will be created informing whether the value is empty or not. Columns representing free string parameters will be deleted since dependencies typically constrain their presence or absence exclusively [3]. -For each enum column, a string fake_value will be assigned to empty values (e.g., "None0"), making sure that such values do not exist in the dataset already.…”

“…Specifically, we selected API operations with different characteristics in terms of numbers of parameters (from 5 to 31), parameter types (e.g., strings, numeric, enums), number of inter-parameter dependencies (from 2 to 16), and type of dependencies. In this regards, it is worth mentioning that the selected API operations include instances of all the eight dependency patterns identified in web APIs [3].…”

“…The handling of inter-parameter dependencies is key for ensuring the validity of RESTful API inputs, as shown in a recent study on 40 industrial APIs [3]. Two previous papers have addressed this issue up to a certain degree: Wu et al [23] proposed a method for inferring these dependencies by leveraging several resources of the API.…”

“…Likewise, when querying the GitHub API [2] to retrieve the authenticated user's repositories, the optional parameters type and visibility must not be used together in the same API request, otherwise an error will be returned. A recent study [3] revealed that these dependencies are extremely common and pervasive-they appear in 4 out of every 5 APIs across all application domains and types of operations. Unfortunately, current API specification languages like the OpenAPI Specification (OAS) [4] provide no support for the formal description of this type of dependencies, despite being a highly demanded feature by practitioners 1 .…”

Automated Specification-Based Testing of REST APIs

“…The drawback of the OpenAPI specification language is that it does not cover the dependencies between the parameters. Parameter dependencies are common for web services as constraints could be applied on certain parameters to restrict their interactions or to require a combination of parameters to form a valid request [ 11 ]. There are a few versions of OpenAPI, the most used one being the OpenAPI 2.0 version, while the latest version available on the market is OpenAPI version 3.x [ 4 ].…”