Modern web applications make extensive use of API calls to update the UI state in response to user events or server-side changes. For such applications, API-level testing can play an important role, in-between unit-level testing and UI-level (or end-to-end) testing. Existing API testing tools require API specifications (e.g., OpenAPI), which often may not be available or, when available, be inconsistent with the API implementation, thus limiting the applicability of automated API testing to web applications. In this paper, we present an approach that leverages UI testing to enable API-level testing for web applications. Our technique navigates the web application under test and automatically generates an API-level test suite, along with an OpenAPI specification that describes the application's server-side APIs (for REST-based web applications). A key element of our solution is a dynamic approach for inferring API endpoints with path parameters via UI navigation and directed API probing. We evaluated the technique for its accuracy in inferring API specifications and the effectiveness of the "carved" API tests. Our results on seven open-source web applications show that the technique achieves 98% precision and 56% recall in inferring endpoints. The carved API tests, when added to test suites generated by two automated REST API testing tools, increase statement coverage by 52% and 29% and branch coverage by 99% and 75%, on average. The main benefits of our technique are: (1) it enables API-level testing of web applications in cases where existing API testing tools are inapplicable and (2) it creates API-level test suites that cover server-side code efficiently while exercising APIs as they would be invoked from an application's web UI, and that can augment existing API test suites.

翻译：现代Web应用广泛利用API调用，以响应用户事件或服务器端变化来更新UI状态。对于此类应用，API级测试可在单元级测试与UI级（或端到端）测试之间发挥重要作用。现有API测试工具需要API规范（如OpenAPI），但这些规范往往不可用，或即便存在也与API实现不一致，从而限制了自动化API测试在Web应用中的适用性。本文提出一种利用UI测试实现Web应用API级测试的方法。该技术通过导航待测Web应用，自动生成API级测试套件，同时生成描述应用服务器端API（适用于REST型Web应用）的OpenAPI规范。本方案的关键要素是：通过UI导航与定向API探测，动态推断包含路径参数的API端点。我们评估了该技术在推断API规范时的准确性，以及"雕刻"出的API测试的有效性。在七个开源Web应用上的实验结果表明：该技术在端点推断上达到98%的精确率和56%的召回率。当将雕刻出的API测试添加至两个自动化REST API测试工具生成的测试套件时，语句覆盖率平均分别提升52%和29%，分支覆盖率平均分别提升99%和75%。本技术的主要优势在于：（1）在现有API测试工具不可用的情况下，实现了Web应用的API级测试；（2）生成的API级测试套件能高效覆盖服务器端代码，并以Web应用UI实际调用API的方式执行测试，从而可增强现有API测试套件。