# Open Problems in Fuzzing RESTful APIs: A Comparison of Tools

arXiv: https://arxiv.org/abs/2205.05325 · HTML: https://mlsanity.com/paper/2205.05325/

## Key facts

- Cited by 5 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 11 May 2022.

## Built on by (most cited first, 5 of 5)

- [A Multi-Agent Approach for REST API Testing with Semantic Graphs and LLM-Driven Inputs](https://mlsanity.com/paper/2411.07098/) (2024)
- [LogiAgent: Automated Logical Testing for REST Systems with LLM-Based Multi-Agents](https://mlsanity.com/paper/2503.15079/) (2025)
- [LlamaRestTest: Effective REST API Testing with Small Language Models](https://mlsanity.com/paper/2501.08598/) (2025)
- [Towards Reliable LLM-Driven Fuzz Testing: Vision and Road Ahead](https://mlsanity.com/paper/2503.00795/) (2025)
- [LLM-Based Robustness Testing of Microservice Applications: An Empirical Study](https://mlsanity.com/paper/2605.14202/) (2026)

## Abstract (arXiv)

RESTful APIs are a type of web services that are widely used in industry. In the last few years, a lot of effort in the research community has been spent in designing novel techniques to automatically fuzz those APIs to find faults in them. Many real faults were automatically found in a large variety of RESTful APIs. However, usually the analyzed fuzzers treat the APIs as black-box, and no analysis of what is actually covered in these systems is done. Therefore, although these fuzzers are clearly useful for practitioners, we do not know what are their current limitations and actual effectiveness. Solving this is a necessary step to be able to design better, more efficient and effective techniques. To address this issue, in this paper we compare seven state-of-the-art fuzzers on 18 open-source and one industrial RESTful APIs. We then analyzed the source code of which parts of these APIs the fuzzers fail to generate tests for. This analysis points to clear limitations of these current fuzzers, listing concrete challenges for the research community to follow up on.