{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,6,30]],"date-time":"2026-06-30T19:46:34Z","timestamp":1782848794752,"version":"3.54.5"},"reference-count":54,"publisher":"Association for Computing Machinery (ACM)","issue":"FSE","license":[{"start":{"date-parts":[[2026,6,30]],"date-time":"2026-06-30T00:00:00Z","timestamp":1782777600000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/2.zoppoz.workers.dev:443\/https\/creativecommons.org\/licenses\/by-nc-nd\/4.0\/legalcode"}],"funder":[{"DOI":"10.13039\/501100001809","name":"Chinese National Natural Science Foundation","doi-asserted-by":"crossref","award":["#62302500"],"award-info":[{"award-number":["#62302500"]}],"id":[{"id":"10.13039\/501100001809","id-type":"DOI","asserted-by":"crossref"}]}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":["Proc. ACM Softw. Eng."],"published-print":{"date-parts":[[2026,6,30]]},"abstract":"<jats:p>HTTP API specifications are essential for modern web development, yet existing tools fail in production environments due to multi-layer routing. Production deployments employ infrastructure-level and framework-level routing that apply sequential rewrite and dispatch rules, creating a gap between client-visible external paths and internal paths. To address this challenge, we present SpecWeaver, the first tool to automatically extract and unify heterogeneous configuration-defined routing rules with code-level handlers. Our approach combines routing component information gathering, iterative configuration discovery using LLMs, and routing extraction from diverse configuration files to construct a routing graph representation that captures end-to-end routing relationships. Evaluated on 10 production applications, SpecWeaver extracts 36,361 rewrite rules and 48,394 dispatch rules with 99.44%\/100% precision, materializes 8,288 external API paths, contributes 5,162 previously undocumented APIs with 160 unauthenticated endpoints, helps an existing testing tool improve testing coverage by 328.6% compared to the baseline, and discovers 305 bugs.<\/jats:p>","DOI":"10.1145\/3808202","type":"journal-article","created":{"date-parts":[[2026,6,30]],"date-time":"2026-06-30T17:06:14Z","timestamp":1782839174000},"page":"4437-4458","source":"Crossref","is-referenced-by-count":0,"title":["SpecWeaver: End-to-End HTTP API Specification Inference across Multi-layer Routing in Production Web Services"],"prefix":"10.1145","volume":"3","author":[{"ORCID":"https:\/\/2.zoppoz.workers.dev:443\/https\/orcid.org\/0009-0007-2625-7575","authenticated-orcid":false,"given":"Wenbo","family":"Hu","sequence":"first","affiliation":[{"name":"Institute of Information Engineering at Chinese Academy of Sciences, Beijing, China"},{"name":"University of Chinese Academy of Sciences, School of Cyber Security, Beijing, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/2.zoppoz.workers.dev:443\/https\/orcid.org\/0000-0002-4162-0404","authenticated-orcid":false,"given":"Jie","family":"Lu","sequence":"additional","affiliation":[{"name":"Institute of Computing Technology at Chinese Academy of Sciences, State Key Laboratory of Processors (SKLP), Beijing, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/2.zoppoz.workers.dev:443\/https\/orcid.org\/0000-0001-9806-9054","authenticated-orcid":false,"given":"Jingting","family":"Chen","sequence":"additional","affiliation":[{"name":"Institute of Information Engineering at Chinese Academy of Sciences, Beijing, China"},{"name":"University of Chinese Academy of Sciences, School of Cyber Security, Beijing, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/2.zoppoz.workers.dev:443\/https\/orcid.org\/0009-0008-2126-663X","authenticated-orcid":false,"given":"Feng","family":"Li","sequence":"additional","affiliation":[{"name":"Institute of Information Engineering at Chinese Academy of Sciences, Beijing, China"},{"name":"University of Chinese Academy of Sciences, School of Cyber Security, Beijing, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/2.zoppoz.workers.dev:443\/https\/orcid.org\/0009-0003-3055-8929","authenticated-orcid":false,"given":"Chenghang","family":"Shi","sequence":"additional","affiliation":[{"name":"Institute of Computing Technology at Chinese Academy of Sciences, State Key Laboratory of Processors (SKLP), Beijing, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/2.zoppoz.workers.dev:443\/https\/orcid.org\/0009-0001-1222-2044","authenticated-orcid":false,"given":"Xiaonan","family":"Shi","sequence":"additional","affiliation":[{"name":"Institute of Information Engineering at Chinese Academy of Sciences, Beijing, China"},{"name":"University of Chinese Academy of Sciences, School of Cyber Security, Beijing, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/2.zoppoz.workers.dev:443\/https\/orcid.org\/0009-0001-4731-7780","authenticated-orcid":false,"given":"Jinchen","family":"Wang","sequence":"additional","affiliation":[{"name":"Institute of Information Engineering at Chinese Academy of Sciences, Beijing, China"},{"name":"University of Chinese Academy of Sciences, School of Cyber Security, Beijing, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/2.zoppoz.workers.dev:443\/https\/orcid.org\/0009-0000-7121-1196","authenticated-orcid":false,"given":"Wei","family":"Huo","sequence":"additional","affiliation":[{"name":"Institute of Information Engineering at Chinese Academy of Sciences, Beijing, China"},{"name":"University of Chinese Academy of Sciences, School of Cyber Security, Beijing, China"}],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"320","published-online":{"date-parts":[[2026,6,30]]},"reference":[{"key":"e_1_2_1_1_1","unstructured":"2023. yudao-cloud: Java Microservices Framework. https:\/\/2.zoppoz.workers.dev:443\/https\/github.com\/YunaiV\/yudao-cloud"},{"key":"e_1_2_1_2_1","volume-title":"Jakarta EE Platform","author":"Eclipse Foundation","year":"2025","unstructured":"Eclipse Foundation 2024. Jakarta EE Platform. Eclipse Foundation. https:\/\/2.zoppoz.workers.dev:443\/https\/jakarta.ee\/ Accessed: 2025-09-12."},{"key":"e_1_2_1_3_1","volume-title":"Jakarta RESTful Web Services (JAX-RS) Specification","author":"Eclipse Foundation","year":"2025","unstructured":"Eclipse Foundation 2024. Jakarta RESTful Web Services (JAX-RS) Specification. Eclipse Foundation. https:\/\/2.zoppoz.workers.dev:443\/https\/jakarta. ee\/specifications\/restful-ws\/ Accessed: 2025-09-12."},{"key":"e_1_2_1_4_1","volume-title":"Jakarta Servlet Specification","author":"Eclipse Foundation","year":"2025","unstructured":"Eclipse Foundation 2024. Jakarta Servlet Specification. Eclipse Foundation. https:\/\/2.zoppoz.workers.dev:443\/https\/jakarta.ee\/specifications\/servlet\/ Accessed: 2025-09-12."},{"key":"e_1_2_1_5_1","unstructured":"2025. Apache Struts -MVC Web Framework. https:\/\/2.zoppoz.workers.dev:443\/https\/struts.apache.org\/. Accessed: 2025-09-08."},{"key":"e_1_2_1_6_1","unstructured":"Apache Software Foundation 2025. Apache Struts 2. Apache Software Foundation. https:\/\/2.zoppoz.workers.dev:443\/https\/struts.apache.org\/ Accessed: 2025-09-12."},{"key":"e_1_2_1_7_1","unstructured":"2025. Apache Tomcat -Servlet & JSP Container. https:\/\/2.zoppoz.workers.dev:443\/https\/tomcat.apache.org\/. Accessed: 2025-09-08."},{"key":"e_1_2_1_8_1","unstructured":"2025. API Documentation & Design Tools for Teams -Swagger. https:\/\/2.zoppoz.workers.dev:443\/https\/swagger.io\/ Accessed: 2025-09-05."},{"key":"e_1_2_1_9_1","unstructured":"2025. AppMap. https:\/\/2.zoppoz.workers.dev:443\/https\/appmap.io\/ Accessed: 2025-09-05."},{"key":"e_1_2_1_10_1","unstructured":"2025. Envoy Proxy -Cloud-Native API Gateway & Load Balancer. https:\/\/2.zoppoz.workers.dev:443\/https\/www.envoyproxy.io\/. Accessed: 2025-09- 08."},{"key":"e_1_2_1_11_1","unstructured":"2025. HAProxy -The Reliable High-Performance Load Balancer. https:\/\/2.zoppoz.workers.dev:443\/https\/www.haproxy.org\/. Accessed: 2025-09-08."},{"key":"e_1_2_1_12_1","unstructured":"2025. Jersey -RESTful Web Services in Java. Java framework. https:\/\/2.zoppoz.workers.dev:443\/https\/eclipse-ee4j.github.io\/jersey\/ Accessed: 2025-09-05."},{"key":"e_1_2_1_13_1","unstructured":"2025. Most APIs Suffer from Specification Drift. https:\/\/2.zoppoz.workers.dev:443\/https\/nordicapis.com\/most-apis-suffer-from-specification-drift\/ Accessed: 2025-09-05."},{"key":"e_1_2_1_14_1","unstructured":"2025. Nginx Web Server & API Gateway. https:\/\/2.zoppoz.workers.dev:443\/https\/nginx.org\/. Accessed: 2025-09-08."},{"key":"e_1_2_1_15_1","unstructured":"VMware 2025. Spring Framework. VMware. https:\/\/2.zoppoz.workers.dev:443\/https\/spring.io\/projects\/spring-framework Accessed: 2025-09-12."},{"key":"e_1_2_1_16_1","unstructured":"2025. springdoc-openapi: OpenAPI 3 documentation for Spring Boot. https:\/\/2.zoppoz.workers.dev:443\/https\/springdoc.org\/ Accessed: 2025-09-05."},{"key":"e_1_2_1_17_1","unstructured":"2025. SpringFox: Automated JSON API documentation for APIs built with Spring. https:\/\/2.zoppoz.workers.dev:443\/https\/springfox.github.io\/springfox\/ Accessed: 2025-09-05."},{"key":"e_1_2_1_18_1","volume-title":"Arthas: Alibaba Java Diagnostic Tool. https:\/\/2.zoppoz.workers.dev:443\/https\/github.com\/alibaba\/arthas. GitHub repository, accessed 2026-02-22.","year":"2026","unstructured":"Alibaba. 2026. Arthas: Alibaba Java Diagnostic Tool. https:\/\/2.zoppoz.workers.dev:443\/https\/github.com\/alibaba\/arthas. GitHub repository, accessed 2026-02-22."},{"key":"e_1_2_1_19_1","unstructured":"Alibaba Cloud. 2024. Qwen2.5: A Party of Foundation Models. https:\/\/2.zoppoz.workers.dev:443\/https\/qwenlm.github.io\/zh\/blog\/qwen2.5\/. Largescale language model series with parameters ranging from 0.5B to 72B including specialized variants for coding and mathematics."},{"key":"e_1_2_1_20_1","doi-asserted-by":"publisher","DOI":"10.1109\/ICSE.2019.00083"},{"key":"e_1_2_1_21_1","unstructured":"Tom Brown Benjamin Mann Nick Ryder Melanie Subbiah Jared D Kaplan Prafulla Dhariwal Arvind Neelakantan Pranav Shyam Girish Sastry Amanda Askell et al. 2020. Language models are few-shot learners. Advances in neural information processing systems 33 (2020) 1877-1901."},{"key":"e_1_2_1_22_1","unstructured":"Check Point Software Technologies. 2023. Check Point Security Management: Centralized Security Platform. https: \/\/www.checkpoint.com\/products\/security-management"},{"key":"e_1_2_1_23_1","volume-title":"You can rest now: Automated specification inference and black-box testing of restful apis with large language models. arXiv preprint arXiv:2402.05102","author":"Decrop Alix","year":"2024","unstructured":"Alix Decrop, Gilles Perrouin, Mike Papadakis, Xavier Devroey, and Pierre-Yves Schobbens. 2024. You can rest now: Automated specification inference and black-box testing of restful apis with large language models. arXiv preprint arXiv:2402.05102 (2024)."},{"key":"e_1_2_1_24_1","unstructured":"DeepSeek-AI. 2025. DeepSeek-V3.2: Efficient Reasoning & Agentic AI. https:\/\/2.zoppoz.workers.dev:443\/https\/huggingface.co\/deepseek-ai\/DeepSeek- V3.2. Hugging Face model repository. License: MIT. Accessed: 2026-02-23."},{"key":"e_1_2_1_25_1","volume-title":"LRASGen: LLM-based RESTful API Specification Generation. arXiv preprint arXiv:2504.16833","author":"Deng Sida","year":"2025","unstructured":"Sida Deng, Rubing Huang, Man Zhang, Chenhui Cui, Dave Towey, and Rongcun Wang. 2025. LRASGen: LLM-based RESTful API Specification Generation. arXiv preprint arXiv:2504.16833 (2025)."},{"key":"e_1_2_1_26_1","unstructured":"EclEmma. 2024. JaCoCo Java Code Coverage Library -Counters. https:\/\/2.zoppoz.workers.dev:443\/https\/www.eclemma.org\/jacoco\/trunk\/doc\/ counters.html. Accessed: 2025-09-10."},{"key":"e_1_2_1_27_1","doi-asserted-by":"publisher","DOI":"10.1145\/3597503.3639137"},{"key":"e_1_2_1_28_1","first-page":"465","volume-title":"Proceedings of the ACM on Software Engineering 2, FSE","author":"Kim Myeongsoo","year":"2025","unstructured":"Myeongsoo Kim, Saurabh Sinha, and Alessandro Orso. 2025. Llamaresttest: Effective rest api testing with small language models. Proceedings of the ACM on Software Engineering 2, FSE (2025), 465-488."},{"key":"e_1_2_1_29_1","volume-title":"A multi-agent approach for rest api testing with semantic graphs and llm-driven inputs. arXiv preprint arXiv:2411.07098","author":"Kim Myeongsoo","year":"2024","unstructured":"Myeongsoo Kim, Tyler Stennett, Saurabh Sinha, and Alessandro Orso. 2024. A multi-agent approach for rest api testing with semantic graphs and llm-driven inputs. arXiv preprint arXiv:2411.07098 (2024)."},{"key":"e_1_2_1_30_1","doi-asserted-by":"publisher","DOI":"10.1145\/3533767.3534401"},{"key":"e_1_2_1_31_1","volume-title":"Generating accurate openapi descriptions from java source code. arXiv preprint arXiv:2410.23873","author":"Lercher Alexander","year":"2024","unstructured":"Alexander Lercher, Christian Macho, Clemens Bauer, and Martin Pinzger. 2024. Generating accurate openapi descriptions from java source code. arXiv preprint arXiv:2410.23873 (2024)."},{"key":"e_1_2_1_32_1","volume-title":"Aurora: Personal Blog System Based on SpringBoot+Vue. https:\/\/2.zoppoz.workers.dev:443\/https\/github.com\/linhaojun857\/ aurora Accessed: 2025-09-11.","year":"2023","unstructured":"linhaojun857. 2023. Aurora: Personal Blog System Based on SpringBoot+Vue. https:\/\/2.zoppoz.workers.dev:443\/https\/github.com\/linhaojun857\/ aurora Accessed: 2025-09-11."},{"key":"e_1_2_1_33_1","volume-title":"Piggymetrics: Microservices Architecture Demo. https:\/\/2.zoppoz.workers.dev:443\/https\/github.com\/sqshq\/ piggymetrics","author":"Lukyanchikov Alexander","year":"2023","unstructured":"Alexander Lukyanchikov. 2023. Piggymetrics: Microservices Architecture Demo. https:\/\/2.zoppoz.workers.dev:443\/https\/github.com\/sqshq\/ piggymetrics"},{"key":"e_1_2_1_34_1","volume-title":"2021 IEEE 32nd International Symposium on Software Reliability Engineering (ISSRE). IEEE, 231-241","author":"Martin-Lopez Alberto","year":"2021","unstructured":"Alberto Martin-Lopez, Andrea Arcuri, Sergio Segura, and Antonio Ruiz-Cort\u00e9s. 2021. Black-box and white-box test case generation for restful apis: Enemies or allies?. In 2021 IEEE 32nd International Symposium on Software Reliability Engineering (ISSRE). IEEE, 231-241."},{"key":"e_1_2_1_35_1","doi-asserted-by":"publisher","DOI":"10.1145\/3540250.3549144"},{"key":"e_1_2_1_36_1","unstructured":"Microsoft. 2024. RESTler Fuzzer: Checkers Documentation. https:\/\/2.zoppoz.workers.dev:443\/https\/github.com\/microsoft\/restler-fuzzer\/blob\/main\/ docs\/user-guide\/Checkers.md. Accessed: 2025-09-05."},{"key":"e_1_2_1_37_1","unstructured":"OpenAI. 2024. GPT-4.1 mini: Advanced Small Model Capabilities. https:\/\/2.zoppoz.workers.dev:443\/https\/platform.openai.com\/docs\/models\/gpt-4.1- mini. Latest iteration of GPT-4o model family optimized for coding and instruction following."},{"key":"e_1_2_1_38_1","unstructured":"OpenAI. 2024. The Official Python Library for the OpenAI API. https:\/\/2.zoppoz.workers.dev:443\/https\/github.com\/openai\/openai-python. Python library providing convenient access to the OpenAI REST API from Python 3.8+ applications."},{"key":"e_1_2_1_39_1","volume-title":"Apitestgenie: Automated api test generation through generative ai. arXiv preprint arXiv:2409.03838","author":"Pereira Andr\u00e9","year":"2024","unstructured":"Andr\u00e9 Pereira, Bruno Lima, and Jo\u00e3o Pascoal Faria. 2024. Apitestgenie: Automated api test generation through generative ai. arXiv preprint arXiv:2409.03838 (2024)."},{"key":"e_1_2_1_40_1","unstructured":"Pivotal Software Inc. 2025. Spring Boot. https:\/\/2.zoppoz.workers.dev:443\/https\/spring.io\/projects\/spring-boot. Spring Boot makes it easy to create stand-alone production-grade Spring based Applications. Version 3.5.5. Accessed: 2025-09-05."},{"key":"e_1_2_1_41_1","doi-asserted-by":"publisher","DOI":"10.1145\/3717383.3717388"},{"key":"e_1_2_1_42_1","volume-title":"European Conference on Software Architecture. Springer, 29-44","author":"Serbout Souhaila","year":"2022","unstructured":"Souhaila Serbout, Alessandro Romanelli, and Cesare Pautasso. 2022. Expresso: From express. js implementation code to openapi interface descriptions. In European Conference on Software Architecture. Springer, 29-44."},{"key":"e_1_2_1_43_1","unstructured":"SonicWall Inc. 2023. SonicWall Global Management System. https:\/\/2.zoppoz.workers.dev:443\/https\/www.sonicwall.com\/products\/managementand-reporting\/global-management-system"},{"key":"e_1_2_1_44_1","unstructured":"Swagger. 2024. OpenAPI Specification. Online specification. https:\/\/2.zoppoz.workers.dev:443\/https\/swagger.io\/specification\/ Accessed: 2025-09-05."},{"key":"e_1_2_1_45_1","unstructured":"ThingsBoard Team. 2023. ThingsBoard: Open-source IoT Platform. https:\/\/2.zoppoz.workers.dev:443\/https\/github.com\/thingsboard\/thingsboard"},{"key":"e_1_2_1_46_1","unstructured":"Nikita Tsvetkov. [n. d.]. Always up-to-date API docs are real (and no it's not AI). https:\/\/2.zoppoz.workers.dev:443\/https\/dev.to\/tsv1\/always-up-todate-api-docs-are-real-and-no-its-not-ai-256g Accessed: 2025-09-05."},{"key":"e_1_2_1_47_1","volume-title":"Attention is all you need. Advances in neural information processing systems 30","author":"Vaswani Ashish","year":"2017","unstructured":"Ashish Vaswani, Noam Shazeer, Niki Parmar, Jakob Uszkoreit, Llion Jones, Aidan N Gomez, \u0141ukasz Kaiser, and Illia Polosukhin. 2017. Attention is all you need. Advances in neural information processing systems 30 (2017)."},{"key":"e_1_2_1_48_1","unstructured":"VMware. 2023. VMware Aria Operations. https:\/\/2.zoppoz.workers.dev:443\/https\/www.vmware.com\/products\/aria-operations.html Accessed: 2024- 01-15."},{"key":"e_1_2_1_49_1","unstructured":"VMware Inc. 2023. VMware SDDC: Software-Defined Data Center. https:\/\/2.zoppoz.workers.dev:443\/https\/www.vmware.com\/solutions\/softwaredefined-datacenter"},{"key":"e_1_2_1_50_1","unstructured":"VMware Inc. 2023. VMware vCenter Server: Centralized Management Platform. https:\/\/2.zoppoz.workers.dev:443\/https\/www.vmware.com\/products\/ cloud-infrastructure\/vsphere"},{"key":"e_1_2_1_51_1","unstructured":"VMware Inc. 2023. VMware vRealize Operations: Performance Monitoring and Analytics. https:\/\/2.zoppoz.workers.dev:443\/https\/www.vmware. com\/products\/vrealize-operations"},{"key":"e_1_2_1_52_1","unstructured":"VMware Inc. 2023. VMware Workspace ONE Access: Identity and Access Management. https:\/\/2.zoppoz.workers.dev:443\/https\/www.vmware.com\/ products\/workspace-one\/access"},{"key":"e_1_2_1_53_1","doi-asserted-by":"publisher","DOI":"10.1109\/ICSE48619.2023.00167"},{"key":"e_1_2_1_54_1","unstructured":"Wayne Xin Zhao Kun Zhou Junyi Li Tianyi Tang Xiaolei Wang Yupeng Hou Yingqian Min Beichen Zhang Junjie Zhang Zican Dong et al. 2023. A survey of large language models. arXiv preprint arXiv:2303.18223 1 2 (2023)."}],"container-title":["Proceedings of the ACM on Software Engineering"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/2.zoppoz.workers.dev:443\/https\/dl.acm.org\/doi\/pdf\/10.1145\/3808202","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2026,6,30]],"date-time":"2026-06-30T18:57:28Z","timestamp":1782845848000},"score":1,"resource":{"primary":{"URL":"https:\/\/2.zoppoz.workers.dev:443\/https\/dl.acm.org\/doi\/10.1145\/3808202"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2026,6,30]]},"references-count":54,"journal-issue":{"issue":"FSE","published-print":{"date-parts":[[2026,6,30]]}},"alternative-id":["10.1145\/3808202"],"URL":"https:\/\/2.zoppoz.workers.dev:443\/https\/doi.org\/10.1145\/3808202","relation":{},"ISSN":["2994-970X"],"issn-type":[{"value":"2994-970X","type":"electronic"}],"subject":[],"published":{"date-parts":[[2026,6,30]]}}}