Achieving successful 2xx coverage across REST API endpoints

Develop fuzz-testing techniques for REST APIs that reliably generate successful 2xx responses on every endpoint, including endpoints with complex input constraints.

Background

The paper’s HTTP-semantics oracles require suitable starting test cases, some of which must exercise endpoints successfully with 2xx responses. Generating such successful calls is difficult when REST API inputs have complex constraints, and insufficient 2xx coverage prevents certain oracle checks from being executed. The authors explicitly identify this as an open research problem in the context of REST API fuzzing.