大型语言模型（LLMs）越来越多地作为API规范的消费者，无论用于代码生成、自主代理交互还是API辅助推理。事实上的API描述标准OpenAPI最初是为文档工具和代码生成器设计的，因此在用作LLM上下文时会产生显著的token开销。我们提出了LAPIS（轻量级智能系统API规范），一种为LLM消费优化的领域特定格式，该格式在保留API推理所需的语义信息的同时最小化token使用。通过针对五个真实生产API规范（包括GitHub（1,080个端点）、Twilio（197个端点）、DigitalOcean（545个端点）、Petstore和HTTPBin）的实证评估，我们证明与OpenAPI YAML相比平均token减少85.5%，与OpenAPI JSON相比减少88.6%，使用cl100k_base tokenizer测量。LAPIS引入了领域特定的结构创新，包括集中化的错误定义、webhook触发条件、结构化的速率限制描述以及操作流程声明信息，这些在OpenAPI中要么被冗余地重复，要么无法表示。该格式可通过自动化转换器从OpenAPI 3.x完全转换，不需要专门的解析器即可用于LLM消费，并以CC BY 4.0开放规范发布。
英文摘要：
Large Language Models (LLMs) increasingly serve as consumers of API specifications, whether for code generation, autonomous agent interaction, or API-assisted reasoning. The de facto standard for API description, OpenAPI, was designed for documentation tools and code generators, resulting in substantial token overhead when used as LLM context.
We present LAPIS (Lightweight API Specification for Intelligent Systems), a domain-specific format optimized for LLM consumption that preserves the semantic information necessary for API reasoning while minimizing token usage. Through empirical evaluation against five real-world production API specifications including GitHub (1,080 endpoints), Twilio (197 endpoints), DigitalOcean (545 endpoints), Petstore, and HTTPBin we demonstrate an average token reduction of 85.5% compared to OpenAPI YAML and 88.6% compared to OpenAPI JSON, measured with the cl100k_base tokenizer. LAPIS introduces domain-specific structural innovations, including centralized error definitions, webhook trigger conditions, structured rate limit descriptions, and operation flow declarations information that OpenAPI either duplicates redundantly or cannot represent at all.
The format is fully convertible from OpenAPI 3.x via an automated converter, requires no special parser for LLM consumption, and is released as an open specification under CC BY 4.0.
Web API specifications are machine-readable descriptions of APIs. These specifications, in combination with related tooling, simplify and support the consumption of APIs. However, despite the increased distribution of web APIs, specifications are rare and their creation and maintenance heavily relies on manual efforts by third parties. In this paper, we propose an automatic approach and an associated tool called D2Spec for extracting specifications from web API documentation pages. Given a seed online documentation page on an API, D2Spec first crawls all documentation pages on the API, and the…
APITestGenie: Generating Web API Tests from Requirements and API Specifications with LLMs
Deloitte（德勤）；Faculty of Engineering, University of Porto（波尔图大学工程学院）；LIACC, Faculty of Engineering, University of Porto（波尔图大学工程学院 LIACC）；INESC TEC, Faculty of Engineering, University of Porto（波尔图大学工程学院 INESC TEC）
LRASGen: LLM-based RESTful API Specification Generation
Macau University of Science and Technology（澳门科技大学）；Macau University of Science and Technology Zhuhai MUST Science and Technology Research Institute（澳门科技大学珠海慕思科学技术研究院）；Beihang University（北京航空航天大学）；University of Nottingham Ningbo China（宁波诺丁汉大学）；China University of Mining and Technology（中国矿业大学）
Cloud high quality API (Application Programming Interface) testing is essential for supporting the API economy. Autotest is a random test generator that addresses this need. It reads the API specification and deduces a model used in the test generation. This paper describes Autotest. It also address the topic of API specification pitfalls which Autotest may reveal when reading the specification. A best practice is to add an appropriate test to the regression once a problem is revealed and solved. How to do that in the context of Autotest's random test generation is covered.
REpresentational State Transfer (REST) is considered as one standard software architectural style to build web APIs that can integrate software systems over the internet. However, while connecting systems, RESTful APIs might also break the dependent applications that rely on their services when they introduce breaking changes, e.g., an older version of the API is no longer supported. To warn developers promptly and thus prevent critical impact on downstream applications, a deprecated-removed model should be followed, and deprecation-related information such as alternative approaches should als…
APIs are the primary mechanism for developers to gain access to externally defined services and tools. However, previous research has revealed API misuses that violate the contract of APIs to be prevalent. Such misuses can have harmful consequences, especially in the context of cryptographic libraries. Various API misuse detectors have been proposed to address this issue including CogniCrypt, one of the most versatile of such detectors and that uses a language CrySL to specify cryptographic API usage contracts. Nonetheless, existing approaches to detect API misuse had not been designed for sys…
When Specifications Meet Reality: Uncovering API Inconsistencies in Ethereum Infrastructure
Beihang University（北京航空航天大学）；Zhongguancun Laboratory（中关村实验室）；The Hong Kong Polytechnic University（香港理工大学）；Beijing Institute of Technology（北京理工大学）；Amber Group（安比集团）；Huazhong University of Science and Technology（华中科技大学）
OOPS: Automated generation of REST API specification via LLMs
Beihang University（北京航空航天大学）；Sino-German Joint Software Institute, Beihang University（北京航空航天大学中德工程学院）；School of Computer Science and Engineering, Beihang University（北京航空航天大学计算机科学与工程学院）；School of Cyber Science and Technology, Beihang University（北京航空航天网络空间安全学院）；Beijing Key Laboratory of Networking Technology（北京市网络技术重点实验室）
Cloud services have recently exploded with the advent of powerful cloud-computing platforms such as Amazon Web Services and Microsoft Azure. Today, most cloud services are accessed through REST APIs, and Swagger is arguably the most popular interface-description language for REST APIs. A Swagger specification describes how to access a cloud service through its REST API (e.g., what requests the service can handle and what responses may be expected). This paper introduces REST-ler, the first automatic intelligent REST API security-testing tool. REST-ler analyzes a Swagger specification and gener…
Detecting HTTP Status Code Misuses in REST APIs via Static and Dynamic Analysis
University of Namur（南纳慕尔大学）；Kristiania University of Applied Sciences（克里斯蒂安应用科学大学）；Oslo Metropolitan University（奥斯陆大都会大学）；SnT, University of Luxembourg（卢森堡大学科学与技术中心）
Deductive verification of software has not yet found its way into industry, as complexity and scalability issues require highly specialized experts. The long-term perspective is, however, to develop verification tools aiding industrial software developers to find bugs or bottlenecks in software systems faster and more easily. The KeY project constitutes a framework for specifying and verifying software systems, aiming at making formal verification tools applicable for mainstream software development. To help the developers of KeY, its users, and the deductive verification community, we summari…
RESTful APIs are an increasingly common way to expose software systems functionality and it is therefore of high interest to find methods to automatically test and verify such APIs. To lower the barrier for industry adoption, such methods needs to be straightforward to use with a low effort. This paper introduces a method to explore the behaviour of a RESTful API. This is done by using automatic property-based tests produced from OpenAPI documents that describe the REST API under test. We describe how this method creates artifacts that can be leveraged both as property-based test generators an…
Mitigating Errors in LLM-Generated Web API Invocations via Retrieval-Augmented Generation and Constrained Decoding
Technische Universität Darmstadt（德累斯顿技术大学）；Hessian Center for Artificial Intelligence (hessian.AI)（黑森人工智能中心）；Pariton AI；National Research Center for Applied Cybersecurity ATHENE（应用网络安全国家研究中心ATHENE）
Doc2Spec: Synthesizing Formal Programming Specifications from Natural Language via Grammar Induction
The Pennsylvania State University（宾夕法尼亚州立大学）；University of the Chinese Academy of Sciences（中国科学院大学）；Institute of Computing Technology, Chinese Academy of Sciences（中国科学院计算技术研究所）
FuzzTheREST: An Intelligent Automated Black-box RESTful API Fuzzer
Porto School of Engineering (ISEP)（波尔图工程学院（ISEP））；Research Group on Intelligent Engineering and Computing for Advanced Innovation and Development (GECAD)（智能工程与先进创新发展计算研究组（GECAD））
