# RESTful API Automated Test Case Generation

## TL;DR

This paper presents EVOMASTER, an automated white-box testing tool for RESTful APIs using evolutionary algorithms, successfully identifying bugs but with room for improved code coverage.

## Contribution

It introduces a novel automated white-box testing approach for RESTful APIs using evolutionary algorithms, implemented in the open-source EVOMASTER tool.

## Key findings

- Automatically found 38 real bugs in tested services.
- Achieved lower code coverage than manual test suites.
- Demonstrated effectiveness on open-source and industrial RESTful services.

## Abstract

Nowadays, web services play a major role in the development of enterprise applications. Many such applications are now developed using a service-oriented architecture (SOA), where microservices is one of its most popular kind. A RESTful web service will provide data via an API over the network using HTTP, possibly interacting with databases and other web services. Testing a RESTful API poses challenges, as inputs/outputs are sequences of HTTP requests/responses to a remote server. Many approaches in the literature do black-box testing, as the tested API is a remote service whose code is not available. In this paper, we consider testing from the point of view of the developers, which do have full access to the code that they are writing. Therefore, we propose a fully automated white-box testing approach, where test cases are automatically generated using an evolutionary algorithm. Tests are rewarded based on code coverage and fault finding metrics. We implemented our technique in a tool called EVOMASTER, which is open-source. Experiments on two open-source, yet non-trivial RESTful services and an industrial one, do show that our novel technique did automatically find 38 real bugs in those applications. However, obtained code coverage is lower than the one achieved by the manually written test suites already existing in those services. Research directions on how to further improve such approach are therefore discussed.