Introducing Black-Box Fuzz Testing for REST APIs in Industry: Challenges and Solutions

REST APIs are widely used in industry, in all different kinds of domains. An example is Volkswagen AG, a German automobile manufacturer. Established testing approaches for REST APIs are time consuming, and require expertise from professional test engineers. Due to its cost and importance, in the scientific literature several approaches have been proposed to automatically test REST APIs. The open-source, search-based fuzzer EVOMASTER is one of such tools proposed in the academic literature. However, how academic prototypes can be integrated in industry and have real impact to software engineering practice requires more investigation. In this paper, we report on our experience in using EVOMASTER at Volkswagen. We share our learnt lessons, and identify real-world research challenges that need to be solved.