[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"doc-detail-83796-en":3,"doc-seo-83796-105":29,"detail-sidebar-cat-0-en-105":90},{"code":4,"msg":5,"data":6},0,"success",{"doc_id":7,"user_id":8,"nickname":9,"user_avatar":10,"doc_module":4,"category_id":11,"category_name":12,"doc_title":13,"doc_description":14,"doc_content":15,"file_id":16,"file_url":17,"file_type":18,"file_size":19,"view_count":4,"is_deleted":4,"is_public":20,"is_downloadable":20,"audit_status":20,"page_count":21,"language":22,"language_code":23,"site_id":24,"html_lang":23,"table_of_contents":25,"faqs":26,"seo_title":13,"seo_description":14,"update_tm":27,"read_time":28},83796,5909877438554,"Maeve","https://ap-avatar.wpscdn.com/avatar/5600025385ad2bf12a7?_k=1778553567797529272",6,"Technology","Using OAI Overlay to Enhance REST API Fuzzing","REST APIs are widely adopted in industry, motivating automatic test-case generation through fuzzing. In black-box settings, schema information alone is often insufficient to reach strong testing effectiveness, because testers must provide additional input data, including parameter-specific values and payloads with complex constraints. The OpenAPI Initiative’s Overlay standard can define transformations over OpenAPI schemas using “examples” entries from Overlay files. This work extends EvoMaster to support Overlay natively and evaluates it on five industry APIs, showing Overlay enables more effective black-box REST API fuzzing.","arXiv :2607 .04325v 1 [ cs . SE] 5 Jul 2026  \nUsing OAI Overlay to Enhance REST API Fuzzing  \nOmur Sahin 1,2,8 , Man Zhang3 , Alexander Poth4 , Olsi Rrjolli4 , Andreas Faes5 , Piyun Teng6 , Kaiming Xue6 , Wenjuan Ma9 , and Andrea Arcuri2,7  \n1 Erciyes University, T¨urkiye  \n2 Kristiania University College, Norway  \n3 Beihang University, China  \n4Volkswagen AG, Germany  \n5 Independent, Belgium  \n6 Meituan, China  \n7 Oslo Metropolitan University, Norway  \n8 UniMetrik Teknoloji Ltd. S¸ti. , T¨urkiye  \n9 Independent, China  \nAbstract  \nREST APIs are widely used in industry. Therefore, a lot of research has been focused on how to automatically generate test cases for REST APIs, with few different open-source fuzzers existing in the literature. For a thorough testing, especially in black-box scenarios, just relying on the information provided in the OpenAPI schemas is not enough. Testers typically need to provide extra input data to help steering the fuzzers in the right direction. Dedicated formats specific to each different fuzzer would work, but they would create a vendor lock-in, as well as increasing cognitive load. The OpenAPI Initiative (OAI) standard Overlay might be a solution to this problem. Such standard enables to define transformations on the OpenAPI schemas, where testers can provide input data in Overlay files where such data is provided as ‘‘examples’’entries. In this paper, we have extended the state-of-the-art fuzzer EvoMaster to support Overlay files natively. Experiments are carried out in industry on five APIs from five enterprises from around the world (e.g., Belgium, China, Germany and T¨urkiye), including two Fortune500 enterprises as well as a 3-man startup. Our industrial results show that Overlay is a viable solution to better enable black-box fuzzing of REST APIs in industry.  \nKeywords: REST, API, fuzzing, black-box, testing  \n1 Introduction  \nIn black-box testing of REST APIs, the main source of information for a fuzzer would be the schema (e.g. , expressed in OpenAPI1 format) and the feedback from responses of its [HTTP calls](HTTP calls) towards the tested API (e.g. , status codes and body payloads) .  \nWith only this type of information available, it might not be possible for a fuzzer to achieve high testing effectiveness. This would be due to difficulty of creating the right test data and determining the right dependencies between operations. There are several existing fuzzers in the literature [12], with significant research progress, but still none achieve high enough test quality to fully replace a human tester [17, 31, 25] .  \nStill, existing fuzzers can be of practical value for practitioners in industry [2, 33 , 9] . Even if they cannot fully automate the generation of all needed testing scenarios, they can speed up the work of the test engineers, taking care of at least the easy, tedious parts, and possibly as well finding new, unexpected results. Once afuzzer has completed its job, still the test engineer has to do the manual work to test all the other remaining uncovered scenarios.  \nIf the engineer/tester still has to do the work of writing the missing tests manually, the question is if it would payoff to use some of that time to provide ‘‘hints’’ to the fuzzer. These could be for example data for different query parameters, as well as specific object payloads (e.g., in JSON format) with complex constraint dependencies among parameters that are not specified in the schema. Or provide valid ids (e.g., in UUID format) for existing data in the test environment’s databases.  \nCurrently, most REST API fuzzers already can support this feature, as they can use ‘‘example’’ and‘‘examples’’ entries in the OpenAPI schema when generating input data. The problem, though, is that this  \n1[https://spec.openapis.org/oas/latest.html](https://spec.openapis.org/oas/latest.html)  \nwould require to modify the schema with test data. This is not viable in the long run. As soon as there is anew update in the sch","cbCairSAJj4lWFtt","https://ap.wps.com/l/cbCairSAJj4lWFtt","pdf",492903,1,10,"English","en",105,"# Introduction\n## Black-box REST API fuzzing and schema limitations\n## Providing fuzzing “hints” and the role of examples\n## OpenAPI Overlay approach and proposed solution\n## Extending EvoMaster with Overlay support\n## Industrial evaluation setup and outcomes","[{\"question\":\"Why is OpenAPI schema information alone insufficient for black-box REST API fuzzing?\",\"answer\":\"Black-box fuzzers depend mainly on the OpenAPI schema plus feedback from HTTP responses (e.g., status codes and payloads). Without additional steering data, it can be difficult to generate correct test inputs and determine dependencies between operations, reducing testing effectiveness.\"},{\"question\":\"What problem does OAI Overlay solve compared with modifying the OpenAPI schema directly?\",\"answer\":\"Directly modifying the schema with test examples is not viable long-term because schema updates require re-adding examples manually, and large schemas can make managing example entries unmanageable. Overlay keeps test data in a standard transformation layer rather than rewriting the base schema.\"},{\"question\":\"How does the paper extend EvoMaster and what evidence is provided?\",\"answer\":\"The paper extends EvoMaster to support Overlay files natively, enabling “examples” entries to be provided via Overlay transformations. Experiments are run in industry on five APIs from five enterprises worldwide, including Fortune 500 companies and a startup, showing Overlay is a viable way to better enable black-box fuzzing.\"}]",1784190468,25,{"code":4,"msg":30,"data":31},"ok",{"site_id":24,"language":23,"slug":32,"title":13,"keywords":33,"description":14,"schema_data":34,"social_meta":85,"head_meta":87,"extra_data":89,"updated_unix":27},"using-oai-overlay-to-enhance-rest-api-fuzzing","",{"@graph":35,"@context":84},[36,53,67],{"@type":37,"itemListElement":38},"BreadcrumbList",[39,43,47,50],{"item":40,"name":41,"@type":42,"position":20},"https://docshare.wps.com","Home","ListItem",{"item":44,"name":45,"@type":42,"position":46},"https://docshare.wps.com/document/","Document",2,{"item":48,"name":12,"@type":42,"position":49},"https://docshare.wps.com/document/technology/",3,{"item":51,"name":13,"@type":42,"position":52},"https://docshare.wps.com/document/using-oai-overlay-to-enhance-rest-api-fuzzing/83796/",4,{"url":51,"name":13,"@type":54,"author":55,"headline":13,"publisher":57,"fileFormat":60,"inLanguage":23,"description":14,"dateModified":61,"datePublished":61,"encodingFormat":60,"isAccessibleForFree":62,"interactionStatistic":63},"DigitalDocument",{"name":9,"@type":56},"Person",{"url":40,"name":58,"@type":59},"DocShare","Organization","application/pdf","2026-07-16",true,{"@type":64,"interactionType":65,"userInteractionCount":4},"InteractionCounter",{"@type":66},"ViewAction",{"@type":68,"mainEntity":69},"FAQPage",[70,76,80],{"name":71,"@type":72,"acceptedAnswer":73},"Why is OpenAPI schema information alone insufficient for black-box REST API fuzzing?","Question",{"text":74,"@type":75},"Black-box fuzzers depend mainly on the OpenAPI schema plus feedback from HTTP responses (e.g., status codes and payloads). Without additional steering data, it can be difficult to generate correct test inputs and determine dependencies between operations, reducing testing effectiveness.","Answer",{"name":77,"@type":72,"acceptedAnswer":78},"What problem does OAI Overlay solve compared with modifying the OpenAPI schema directly?",{"text":79,"@type":75},"Directly modifying the schema with test examples is not viable long-term because schema updates require re-adding examples manually, and large schemas can make managing example entries unmanageable. Overlay keeps test data in a standard transformation layer rather than rewriting the base schema.",{"name":81,"@type":72,"acceptedAnswer":82},"How does the paper extend EvoMaster and what evidence is provided?",{"text":83,"@type":75},"The paper extends EvoMaster to support Overlay files natively, enabling “examples” entries to be provided via Overlay transformations. Experiments are run in industry on five APIs from five enterprises worldwide, including Fortune 500 companies and a startup, showing Overlay is a viable way to better enable black-box fuzzing.","https://schema.org",{"og:url":51,"og:type":86,"og:title":13,"og:site_name":58,"og:description":14},"article",{"robots":88,"canonical":51},"index,follow",{"doc_id":7,"site_id":24},{"code":4,"msg":5,"data":91},[92,96,100,104,109,112,117,122,127,130,133],{"id":20,"doc_module":4,"doc_module_name":45,"category_name":93,"show_sort_weight":94,"slug":95},"Story & Novel",90,"story-novel",{"id":46,"doc_module":4,"doc_module_name":45,"category_name":97,"show_sort_weight":98,"slug":99},"Literature",80,"literature",{"id":52,"doc_module":4,"doc_module_name":45,"category_name":101,"show_sort_weight":102,"slug":103},"Exam",70,"exam",{"id":105,"doc_module":4,"doc_module_name":45,"category_name":106,"show_sort_weight":107,"slug":108},5,"Comic",60,"comic",{"id":11,"doc_module":4,"doc_module_name":45,"category_name":12,"show_sort_weight":110,"slug":111},50,"technology",{"id":113,"doc_module":4,"doc_module_name":45,"category_name":114,"show_sort_weight":115,"slug":116},7,"Healthcare",40,"healthcare",{"id":118,"doc_module":4,"doc_module_name":45,"category_name":119,"show_sort_weight":120,"slug":121},8,"Research & Report",30,"research-report",{"id":123,"doc_module":4,"doc_module_name":45,"category_name":124,"show_sort_weight":125,"slug":126},9,"Religion & Spirituality",20,"religion-spirituality",{"id":125,"doc_module":4,"doc_module_name":45,"category_name":128,"show_sort_weight":125,"slug":129},"World Cup","world-cup",{"id":21,"doc_module":4,"doc_module_name":45,"category_name":131,"show_sort_weight":21,"slug":132},"Lifestyle","lifestyle",{"id":134,"doc_module":4,"doc_module_name":45,"category_name":135,"show_sort_weight":105,"slug":136},19,"General","general"]