[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"doc-detail-82579-en":3,"doc-seo-82579-105":29,"detail-sidebar-cat-0-en-105":90},{"code":4,"msg":5,"data":6},0,"success",{"doc_id":7,"user_id":8,"nickname":9,"user_avatar":10,"doc_module":4,"category_id":11,"category_name":12,"doc_title":13,"doc_description":14,"doc_content":15,"file_id":16,"file_url":17,"file_type":18,"file_size":19,"view_count":20,"is_deleted":4,"is_public":20,"is_downloadable":20,"audit_status":20,"page_count":21,"language":22,"language_code":23,"site_id":24,"html_lang":23,"table_of_contents":25,"faqs":26,"seo_title":13,"seo_description":14,"update_tm":27,"read_time":28},82579,34359740700684,"Finn","https://ap-avatar.wpscdn.com/avatar/1f400023980c374ae676?_k=1777273430885731487",6,"Technology","AutoRestTest at the SBFT 2026 Tool Competition","Large input spaces and complex inter-operation dependencies make black-box REST API testing difficult. AutoRestTest integrates a Semantic Property Dependency Graph, multi-agent reinforcement learning, and large language model–driven value generation to systematically explore API input configurations. In the SBFT 2026 REST League, AutoRestTest ranked first in fault detection, overall efficiency, and overall effectiveness across 11 APIs (317 operations) under a one-hour budget, reporting 67.09 unique server errors and 17.27 successfully processed operations per API.","AutoRestTest at the SBFT 2026 Tool Competition  \nTyler Stennett  \n[tyler.stennett@gatech.edu](tyler.stennett@gatech.edu)[ ](tyler.stennett@gatech.edu)Georgia Institute of Technology Atlanta, Georgia, USA  \nMyeongsoo Kim  \n[mysoo@amazon.com](mysoo@amazon.com)[ ](mysoo@amazon.com)AWS AI Labs  \nSanta Clara, California, USA  \nSaurabh Sinha  \n[sinhas@us.ibm.com](sinhas@us.ibm.com)[ ](sinhas@us.ibm.com)IBM Research  \nYorktown Heights, New York, USA  \nAlessandro Orso  \n[orso@uga.edu](orso@uga.edu)[ ](orso@uga.edu)University of Georgia Athens, Georgia, USA  \narXiv :2607 .0 1063v 1 [ cs . SE] 1 Jul 2026  \nAbstract  \nLarge input spaces and complex inter-operation dependencies make black-box REST API testing challenging. AutoRestTest combines a Semantic Property Dependency Graph, multi-agent reinforcement learning, and large language models to intelligently explore large API input spaces. In the SBFT 2026 REST League, AutoRestTest ranked first in all three evaluation categories—fault detection, overall efficiency, and overall effectiveness—on 11 APIs (317 operations, approximately 29 per API), averaging 67.09 unique server errors and 17.27 successfully processed operations per API under a one-hour testing budget.  \nKeywords  \nAutomated REST API Testing, Multi-Agent Reinforcement Learning, Large Language Models  \nACM Reference Format:  \nTyler Stennett, Myeongsoo Kim, Saurabh Sinha, and Alessandro Orso. 2026. AutoRestTest at the SBFT 2026 Tool Competition. In 19th Search-Based and Fuzz Testing Workshop (SBFT’26), April 12–18, 2026, Rio de Janeiro, Brazil. ACM, New York, NY, USA, 2 pages. [https://doi.org/10.1145/3786155.3795701](https://doi.org/10.1145/3786155.3795701)  \n1 Introduction  \nREST APIs are central to modern web services, making automated testing of these APIs a critical research area. Most of the tools in this space implement a black-box testing approach: they use the OpenAPI Specification (OAS) [3] to exercise endpoints without source code access. To evaluate and distinguish leading tools, the REST League competition [4] at SBFT 2026 provides a standardized benchmark featuring diverse services and robust evaluation criteria.  \nCompeting against five other state-of-the-art black-box REST API testing tools, AutoRestTest achieved first place across all three evaluation categories—fault detection, overall efficiency, and overall effectiveness. Its success stems from three key components: a Semantic Property Dependency Graph (SPDG) that captures  \nThis work is licensed under a Creative Commons Attribution 4 .0 International License. SBFT’26, Rio de Janeiro, Brazil  \n© 2026 Copyright held by the owner/author(s) .  \nACM ISBN 979-8-4007-2387-2/2026/04  \n[https://doi.org/10.1145/3786155.3795701](https://doi.org/10.1145/3786155.3795701)  \ninter-operation dependencies, a multi-agent reinforcement learning (MARL) system with four specialized agents, and a large language model (LLM)-driven value generation module that produces domain-aware inputs. AutoRestTest is publicly available [6] .  \n2 AutoRestTest  \nAutoRestTest’s workflow is depicted in Figure 1 . Since its initial presentation [2, 7], AutoRestTest has been refined in several ways. LLM preprocessing is now parallelized across operations, reducing setup time. The parameter agent explicitly includes all required parameters and applies stratified sampling over optional parameters for balanced coverage. New boundary value mutations target edge cases (e.g., empty strings, extreme numeric values) to trigger server errors. Finally, broader LLM-provider compatibility supports cheaper and open-source models, and improved OAS parsing increases robustness across diverse specifications.  \n2.1 Semantic Property Dependency Graph  \nAutoRestTest parses the OAS and constructs a graph with each API operation as a vertex. Using a lightweight GloVe embedding model [5], it measures semantic similarity between parameters, request bodies, and responses across operation pairs, adding edges where similarit","cbCaihtLEMBpRz05","https://ap.wps.com/l/cbCaihtLEMBpRz05","pdf",586528,1,2,"English","en",105,"# Introduction\n# AutoRestTest\n## Semantic Property Dependency Graph\n## REST Agents\n## LLM-Driven Value Generation\n## Request Generation","[{\"question\":\"What makes black-box REST API testing challenging, according to the document?\",\"answer\":\"Large input spaces and complex inter-operation dependencies make it hard to effectively explore API behaviors without source code access.\"},{\"question\":\"How does AutoRestTest model dependencies between API operations?\",\"answer\":\"It builds a Semantic Property Dependency Graph from the OpenAPI Specification, linking operation pairs when semantic similarity between parameters, request bodies, and responses exceeds a threshold, and updating it dynamically during testing.\"},{\"question\":\"What are the main components and agents used by AutoRestTest?\",\"answer\":\"AutoRestTest uses four specialized agents—operation, parameter, value, and dependency—combined with LLM-driven value generation and multi-agent reinforcement learning to guide request construction and exploration.\"}]",1784181619,5,{"code":4,"msg":30,"data":31},"ok",{"site_id":24,"language":23,"slug":32,"title":13,"keywords":33,"description":14,"schema_data":34,"social_meta":85,"head_meta":87,"extra_data":89,"updated_unix":27},"autoresttest-at-the-sbft-2026-tool-competition","",{"@graph":35,"@context":84},[36,52,67],{"@type":37,"itemListElement":38},"BreadcrumbList",[39,43,46,49],{"item":40,"name":41,"@type":42,"position":20},"https://docshare.wps.com","Home","ListItem",{"item":44,"name":45,"@type":42,"position":21},"https://docshare.wps.com/document/","Document",{"item":47,"name":12,"@type":42,"position":48},"https://docshare.wps.com/document/technology/",3,{"item":50,"name":13,"@type":42,"position":51},"https://docshare.wps.com/document/autoresttest-at-the-sbft-2026-tool-competition/82579/",4,{"url":50,"name":13,"@type":53,"author":54,"headline":13,"publisher":56,"fileFormat":59,"inLanguage":23,"description":14,"dateModified":60,"datePublished":61,"encodingFormat":59,"isAccessibleForFree":62,"interactionStatistic":63},"DigitalDocument",{"name":9,"@type":55},"Person",{"url":40,"name":57,"@type":58},"DocShare","Organization","application/pdf","2026-07-17","2026-07-16",true,{"@type":64,"interactionType":65,"userInteractionCount":20},"InteractionCounter",{"@type":66},"ViewAction",{"@type":68,"mainEntity":69},"FAQPage",[70,76,80],{"name":71,"@type":72,"acceptedAnswer":73},"What makes black-box REST API testing challenging, according to the document?","Question",{"text":74,"@type":75},"Large input spaces and complex inter-operation dependencies make it hard to effectively explore API behaviors without source code access.","Answer",{"name":77,"@type":72,"acceptedAnswer":78},"How does AutoRestTest model dependencies between API operations?",{"text":79,"@type":75},"It builds a Semantic Property Dependency Graph from the OpenAPI Specification, linking operation pairs when semantic similarity between parameters, request bodies, and responses exceeds a threshold, and updating it dynamically during testing.",{"name":81,"@type":72,"acceptedAnswer":82},"What are the main components and agents used by AutoRestTest?",{"text":83,"@type":75},"AutoRestTest uses four specialized agents—operation, parameter, value, and dependency—combined with LLM-driven value generation and multi-agent reinforcement learning to guide request construction and exploration.","https://schema.org",{"og:url":50,"og:type":86,"og:title":13,"og:site_name":57,"og:description":14},"article",{"robots":88,"canonical":50},"index,follow",{"doc_id":7,"site_id":24},{"code":4,"msg":5,"data":91},[92,96,100,104,108,111,116,121,126,129,133],{"id":20,"doc_module":4,"doc_module_name":45,"category_name":93,"show_sort_weight":94,"slug":95},"Story & Novel",90,"story-novel",{"id":21,"doc_module":4,"doc_module_name":45,"category_name":97,"show_sort_weight":98,"slug":99},"Literature",80,"literature",{"id":51,"doc_module":4,"doc_module_name":45,"category_name":101,"show_sort_weight":102,"slug":103},"Exam",70,"exam",{"id":28,"doc_module":4,"doc_module_name":45,"category_name":105,"show_sort_weight":106,"slug":107},"Comic",60,"comic",{"id":11,"doc_module":4,"doc_module_name":45,"category_name":12,"show_sort_weight":109,"slug":110},50,"technology",{"id":112,"doc_module":4,"doc_module_name":45,"category_name":113,"show_sort_weight":114,"slug":115},7,"Healthcare",40,"healthcare",{"id":117,"doc_module":4,"doc_module_name":45,"category_name":118,"show_sort_weight":119,"slug":120},8,"Research & Report",30,"research-report",{"id":122,"doc_module":4,"doc_module_name":45,"category_name":123,"show_sort_weight":124,"slug":125},9,"Religion & Spirituality",20,"religion-spirituality",{"id":124,"doc_module":4,"doc_module_name":45,"category_name":127,"show_sort_weight":124,"slug":128},"World Cup","world-cup",{"id":130,"doc_module":4,"doc_module_name":45,"category_name":131,"show_sort_weight":130,"slug":132},10,"Lifestyle","lifestyle",{"id":134,"doc_module":4,"doc_module_name":45,"category_name":135,"show_sort_weight":28,"slug":136},19,"General","general"]