RESTest 2.0.0

RESTest 2 is a complete rewrite of RESTest, a black-box testing tool for REST APIs. Give it an
OpenAPI document — 2.0, 3.0 or 3.1 — and the address of the API it describes: it invents requests
from the document, sends them for as long as you allow, checks every reply against what the document
promised, and reports each fault with a curl command that sends the same request again.

RESTest 2 is not compatible with RESTest 1.x. The command line, the files it reads and the
reports it writes are all new. The last version of 1.x is
1.6.0, and its code is on the
v1.x branch.

What a run does

• Nothing to configure. One command, a document and an address; the budget defaults to a minute
  and all of it is used.
• Values from several sources: the values the document states, values invented to fit what it
  says — dates, e-mail addresses, identifiers, the kind a name implies — what the API has already
  returned and accepted, and lists of values you hand over with --dictionary.
• More than ordinary requests: values nobody sensible would send; accepted requests sent again
  with exactly one thing changed; and short series around the things a run creates — delete it and
  read it again, create it twice.
• Faults named by a shared catalogue. A reply of 500 (F100) and a reply whose body is not the
  shape the document promised (F200), from the Web Fuzzing Commons catalogue, on the screen as they
  are found and in report.json; --store keeps every request and reply in a SQLite file.
• Yours to change: a plan file for where values come from and which operations may be touched,
  settings for how the tool behaves — every behaviour with a switch — and --auth for an API that
  asks for a key or a token, which is written into nothing the run leaves behind.
• Made for a build: 0 when nothing was wrong, 1 when a fault was found, other numbers when
  the run could not do its job; Ctrl-C, kill and docker stop keep what a run had found.

Install

Java 21 or later, and git:

git clone https://github.com/isa-group/RESTest.git
cd RESTest
./mvnw -q install -DskipTests
./restest run https://petstore3.swagger.io/api/v3/openapi.json \
    --url https://petstore3.swagger.io/api/v3 --budget 10s

Documentation

• The README: installing, a first run,
  and how to read what it prints.
• The manual, read from
  beginning to end against a practice API on your own machine — also attached below as a PDF.
• The reference pages: every
  option, every line a run prints, every key of its report, the plan, dictionaries, settings and
  switches.