RESTSpecIT: REST API Specification Generation with LLM-assisted Request Mutations

Abstract

In software engineering, documenting is a time-consuming and error-prone task. This is no exception for REST APIs, which are widely used for client-server communications on the web. The OpenAPI Specification (OAS) is an industry standard to document such APIs, and various tools have been developed to assist OAS generation. However, such approaches require advanced inputs such as source code, request samples, or HTML documentation, which are not always available. To address this problem, we present RESTSpecIT, a tool that automatically generates REST API specifications in the OAS format. Our tool takes an API name and endpoint as input and infers relevant documentation. This is done by generating and mutating HTTP requests using LLMs (serving as a vocabulary of API terms) and verifying their validity based on the server responses obtained. Our evaluation demonstrates that RESTSpecIT is effective (94% of routes and 93% of query parameters found on average), efficient (in terms of API requests, execution time, and LLM tokens), and capable of discovering undocumented routes and query parameters.

Xavier Devroey

Professor of Software Engineering

My research goal is to to ease software testing by exploring new paths to achieve a high level of automation for test case design, generation, selection, and prioritization. My main research interests include search-based and model-based software testing, test suite augmentation, DevOps, and variability-intensive systems.