A common way of exposing functionality in contemporary systems is by providing a Web-API based on the REST API architectural guidelines. To describe REST APIs, the industry standard is currently OpenAPI-specifications. Test generation and fuzzing methods targeting OpenAPI-described REST APIs have been a very active research area in recent years. An open research challenge is to aid users in better understanding their API, in addition to finding faults and to cover all the code. In this paper, we address this challenge by proposing a set of behavioural properties, common to REST APIs, which are used to generate examples of behaviours that these APIs exhibit. These examples can be used both (i) to further the understanding of the API and (ii) as a source of automatic test cases. Our evaluation shows that our approach can generate examples deemed relevant for understanding the system and for a source of test generation by practitioners. In addition, we show that basing test generation on behavioural properties provides tests that are less dependent on the state of the system, while at the same time yielding a similar code coverage as state-of-the-art methods in REST API fuzzing in a given time limit.

翻译：当代系统通常通过提供基于REST API架构规范的Web-API来暴露功能。描述REST API的行业标准目前是OpenAPI规范。近年来，针对基于OpenAPI描述的REST API的测试生成与模糊测试方法已成为非常活跃的研究领域。一个开放性的研究挑战是：除了发现缺陷和覆盖全部代码外，如何帮助用户更好地理解其API。本文通过提出一组适用于REST API的通用行为属性来应对这一挑战，并利用这些属性生成API所展现行为的示例。这些示例既可用于（i）加深对API的理解，也可作为（ii）自动化测试用例的来源。实验评估表明，我们的方法能够生成实践者认为对理解系统和测试生成具有相关性的示例。此外，我们证明基于行为属性的测试生成方法能产出对系统状态依赖性较低的测试用例，同时在设定的时间限制内，其代码覆盖率与REST API模糊测试领域的前沿方法相当。