REST APIs are the de facto standard for web service interaction, praised for flexibility and simplicity of adoption. Nevertheless, the lack of mandatory implementation guidelines for REST APIs has led to the diffusion of poor-quality and difficult-to-maintain web services. A key concern in this context is the misuse of CRUD (Create, Read, Update, and Delete) semantics of API operations. While best practices suggest mapping CRUD verbs to HTTP methods ($\mathtt{POST}$, $\mathtt{GET}$, $\mathtt{PUT}$/$\mathtt{PATCH}$, and $\mathtt{DELETE}$, respectively), many implementations fail to adhere to such a guideline. This common \emph{anti-pattern} makes interaction with the API ambiguous, hindering maintainability and decreasing the effectiveness of automated REST API testing.

In this paper, we propose $\mathsf{CRUDinfer}$, a novel approach to automatically infer REST API operation CRUD semantics by leveraging (black-box) interactions with the API. The approach incrementally refines the knowledge about API operations’ CRUD semantics via \emph{CRUD test scenarios}. Specifically, it employs interaction patterns typical of each CRUD semantics verb to craft test scenarios (i.e., HTTP interactions) for API operations with the aim of confirming their semantics. Testing failures indicate a mismatch between the intended CRUD semantics and the actual implementation. Thus, it refines API operations’ CRUD semantics knowledge through improved test scenarios.

Empirical evaluation indicates high inference capabilities for \tool, with an overall precision higher than 95% on the considered benchmark REST APIs.