Automated RESTful API Sequence Construction with Cross-Document Inconsistencies

RESTful APIs have become the dominant interaction mechanism for modern web services and the adoption of microservice architecture introduces new security challenges, particularly concerning stateful REST API vulnerabilities that require sequential calls to exploit. Existing methods operate on a single OpenAPI Specification (OAS) document, rendering them incapable of discovering the inter-service REST API dependencies inherent in a microservice architecture where it is ideal for each service to maintain its own independent OAS document. This lack of visibility prevents automated REST API dependency extraction in a multi-document environment. To address this gap, we propose a novel, automated method for extracting a global REST API dependency graph from multiple, distributed, and potentially inconsistent OAS documents. Our algorithm parses all provided OAS documents and employs an approach of exact matching and semantic similarity matching to resolve cross-document inconsistencies and identify REST API dependencies across service boundaries.