Searcharxiv⌕ Search

arXiv subjects

Andreas Faes

Publications and source records attributed to Andreas Faes.

2 recordsLinked to original sources
arXiv2026

Using OAI Overlay to Enhance REST API Fuzzing

REST APIs are widely used in industry. Therefore, a lot of research has been focused on how to automatically generate test cases for REST APIs, with few different open-source fuzzers existing in the literature. For a thorough testing, especially in black-box scenarios, just relying on the information provided in the OpenAPI schemas is not enough. Testers typically need to provide extra input data to help steer the fuzzers in the right direction. Dedicated formats specific to each different fuzzer would work, but they would create a vendor lock-in, as well as increasing cognitive load. The OpenAPI Initiative (OAI) standard Overlay might be a solution to this problem. Such standard enables to define transformations on the OpenAPI schemas, where testers can provide input data in Overlay files where such data is provided as ``examples'' entries. In this paper, we have extended the state-of-the-art fuzzer EvoMaster to support Overlay files natively. Experiments are carried out in industry on five APIs from five enterprises from around the world (e.g., Belgium, China, Germany and T\"urkiye), including two Fortune500 enterprises as well as a 3-man startup. Our industrial results show that Overlay is a viable solution to better enable black-box fuzzing of REST APIs in industry.

cs.SE↗
arXiv2026

Prompt-Based REST API Test Amplification in Industry: An Experience Report

Large Language Models (LLMs) are increasingly used to support software testing tasks, yet there is little evidence of their effectiveness for REST API testing in industrial settings. To address this gap, we replicate our earlier work on LLM-based REST API test amplification within an industrial context at one of the largest logistics companies in Belgium. We apply LLM-based test amplification to six representative endpoints of a production microservice embedded in a large-scale, security-sensitive system, where there is in-depth complexity in authentication, stateful behavior, and organizational constraints. Our experience shows that LLM-based test amplification remains practically useful in industry by increasing coverage and revealing various observations and anomalies.

cs.SE↗