Using OAI Overlay to Enhance REST API Fuzzing

2026-07-05

AI Summary

This work addresses the limitations of relying solely on OpenAPI specifications for black-box REST API fuzzing, which often fails to provide sufficient test guidance, while existing supplementary data lacks a standardized, vendor-neutral format. To overcome this, the study introduces the first native integration of the OpenAPI Initiative (OAI) Overlay standard into the industrial-grade fuzzer EvoMaster, enabling structured injection of test example data via standardized Overlay files. This approach significantly enhances black-box testing capabilities without vendor lock-in and reduces cognitive overhead for testers. The effectiveness of the method is empirically validated on five real-world enterprise APIs, including two from Fortune 500 companies, demonstrating its practical utility and advancing the standardization of extensible techniques in REST API fuzzing.

Abstract

REST APIs are widely used in industry. Therefore, a lot of research has been focused on how to automatically generate test cases for REST APIs, with few different open-source fuzzers existing in the literature. For a thorough testing, especially in black-box scenarios, just relying on the information provided in the OpenAPI schemas is not enough. Testers typically need to provide extra input data to help steer the fuzzers in the right direction. Dedicated formats specific to each different fuzzer would work, but they would create a vendor lock-in, as well as increasing cognitive load. The OpenAPI Initiative (OAI) standard Overlay might be a solution to this problem. Such standard enables to define transformations on the OpenAPI schemas, where testers can provide input data in Overlay files where such data is provided as ``examples'' entries. In this paper, we have extended the state-of-the-art fuzzer EvoMaster to support Overlay files natively. Experiments are carried out in industry on five APIs from five enterprises from around the world (e.g., Belgium, China, Germany and Türkiye), including two Fortune500 enterprises as well as a 3-man startup. Our industrial results show that Overlay is a viable solution to better enable black-box fuzzing of REST APIs in industry.

Problem

• REST API
• black-box fuzzing
• OpenAPI
• input data
• vendor lock-in

Innovation

• OAI Overlay
• REST API fuzzing
• black-box testing
• EvoMaster
• OpenAPI schema