mlsanityData to 14 Oct 2026

APIRL: Deep Reinforcement Learning for REST API Fuzzing

arXiv 2412.15991 ↗First posted 20 Dec 2024cs.SE cs.AI cs.NIcited by 4

On the map: Deep reinforcement learning methods → RL training of language and agent models

Abstract (arXiv)

REST APIs have become key components of web services. However, they often contain logic flaws resulting in server side errors or security vulnerabilities. HTTP requests are used as test cases to find and mitigate such issues. Existing methods to modify requests, including those using deep learning, suffer from limited performance and precision, relying on undirected search or making limited usage of the contextual information. In this paper we propose APIRL, a fully automated deep reinforcement learning tool for testing REST APIs. A key novelty of our approach is the use of feedback from a transformer module pre-trained on JSON-structured data, akin to that used in API responses. This allows APIRL to learn the subtleties relating to test outcomes, and generalise to unseen API endpoints. We show APIRL can find significantly more bugs than the state-of-the-art in real world REST APIs while minimising the number of required test cases. We also study how reward functions, and other key design choices, affect learnt policies in a thorough ablation study.

Key facts. Cited by 4 papers in the map (data through 14 Oct 2026). Placed in RL training of language and agent models, one of 15 directions in Deep reinforcement learning methods. Builds on 11 of its 42 references that are in the map. First posted on arXiv 20 Dec 2024.

Builds on

11 of 42 references.

References · 11

  1. 2018BERT: Pre-training of Deep Bidirectional Transformers for Language Understandingcited by 40,399
  2. 2017Proximal Policy Optimization Algorithmscited by 15,215
  3. 2019RoBERTa: A Robustly Optimized BERT Pretraining Approachcited by 13,372
  4. 2017A Unified Approach to Interpreting Model Predictionscited by 6,555
  5. 2015Prioritized Experience Replaycited by 1,099
  6. 2022Morest: Model-based RESTful API Testing with Execution Feedbackcited by 11
  7. 2024DeepREST: Automated Test Case Generation for REST APIs Exploiting Deep Reinforcement Learningcited by 8
  8. 2023Adaptive REST API Testing with Reinforcement Learningcited by 7
  9. 2020Pythia: Grammar-Based Fuzzing of REST APIs with Coverage-guided Feedback and Learning-based Mutationscited by 5
  10. 2022Automatic detection of access control vulnerabilities via API specification processingcited by 1
  11. 2023MINER: A Hybrid Data-Driven Approach for REST API Fuzzingcited by 1

Built on by

Cited by year (2026 to 14 Oct)

Citing papers per year: 2025: 2; 2026: 2.

4 papers.

  1. 2025DRMD: Deep Reinforcement Learning for Malware Detection under Concept Driftcited by 7
  2. 2026SoK: The Pitfalls of Deep Reinforcement Learning for Cybersecuritycited by 4
  3. 2026Building Better Environments for Autonomous Cyber Defencecited by 3
  4. 2025Clutch Control: An Attention-based Combinatorial Bandit for Efficient Mutation in JavaScript Engine Fuzzingcited by 0

Similar, not cited

Close in wording, no citation either way

  1. 2026RESTOR: Automated Test Oracle Generation for RESTful APIs via Reinforcement Learning ↗
  2. 2025AutoRestTest: A Tool for Automated REST API Testing Using LLMs and MARL
  3. 2024A Multi-Agent Approach for REST API Testing with Semantic Graphs and LLM-Driven Inputs
  4. 2025Test Amplification for REST APIs via Single and Multi-Agent LLM Systems
  5. 2025LlamaRestTest: Effective REST API Testing with Small Language Models
  6. 2026Beyond Next-Token Prediction: An RLVR Proof of Concept for Tool-Use Agents on Atlassian Workflows
  7. 2025Combining TSL and LLM to Automate REST API Testing: A Comparative Study
  8. 2026REST API Testing with Verified LLM-Inferred Dependencies and Response-Driven Refinement ↗