# RESTful API Testing Methodologies: Rationale, Challenges, and Solution Directions
## 4 Results
### RQ3--What Are the Existing Solutions Available to Meet Testing and Unit Test Generation Challenges?
\begin{table}
\begin{tabular}{l l c c} \hline \hline
**Ref. Title** & **Tool** & **Approach/ Methodology** & **Framework/ Model** \\ \hline \multirow{2}{*}{[20]} & Property-based Testing of JSON based & \(\square\) & \(\boxtimes\) & \(\square\) \\  & Web Services & \(\square\) & \(\boxtimes\) & \(\square\) \\ \hline \multirow{2}{*}{[21]} & Model-driven Testing of RESTful APIs & \(\square\) & \(\boxtimes\) & \(\square\) \\ \hline \multirow{2}{*}{[22]} & RESTful API Automated Test Case Generation & \(\boxtimes\) & \(\square\) & \(\square\) \\ \hline \multirow{2}{*}{[23]} & Study on REST API Test Model Supporting Web & \(\square\) & \(\square\) & \(\boxtimes\) \\  & Service Integration & \(\square\) & \(\square\) & \(\boxtimes\) \\ \hline \multirow{2}{*}{[24]} & Automatic Generation of Test Cases for REST & \(\square\) & \(\boxtimes\) & \(\square\) \\  & APIs: a Specification-Based Approach & \(\square\) & \(\boxtimes\) & \(\square\) \\ \hline \multirow{2}{*}{[25]} & Metamorphic Testing of RESTful Web APIs & \(\square\) & \(\boxtimes\) & \(\square\) \\ \hline \multirow{2}{*}{[26]} & Automated API Testing & \(\boxtimes\) & \(\square\) & \(\square\) \\ \hline \multirow{2}{*}{[27]} & RESTler: Stateful REST API Fuzzing & \(\boxtimes\) & \(\square\) & \(\square\) \\ \hline \multirow{2}{*}{[28]} & QuickREST: Property-based Test Generation of & \(\boxtimes\) & \(\boxtimes\) & \(\square\) \\  & OpenAPI-Described RESTful APIs & \(\boxtimes\) & \(\boxtimes\) & \(\square\) \\ \hline \multirow{2}{*}{[29]} & AI-Driven Web API Testing & \(\square\) & \(\boxtimes\) & \(\square\) \\ \hline \multirow{3}{*}{[30]} & A simple, lightweight framework for testing & \(\square\) & \(\square\) & \(\boxtimes\) \\  & RESTful services with TTCN-3 & \(\square\) & \(\boxtimes\) & \(\boxtimes\) \\ \hline \multirow{3}{*}{[31]} & Differential Regression Testing for REST APIs & \(\square\) & \(\boxtimes\) & \(\square\) \\ \hline \multirow{3}{*}{[32]} & RESTTESTGEN: Automated Black-Box Testing of & \(\boxtimes\) & \(\square\) & \(\square\) \\  & RESTful APIs & \(\square\) & \(\square\) & \(\square\) \\ \hline \multirow{3}{*}{[33]} & Deep Learning-Based Prediction of Test Input & \(\boxtimes\) & \(\square\) & \(\square\) \\  & Validity for RESTful APIs & \(\square\) & \(\boxtimes\) & \(\square\) \\ \hline \multirow{3}{*}{[34]} & RESTest: Automated Black-Box Testing of & \(\square\) & \(\square\) & \(\boxtimes\) \\  & RESTfulWeb APIs & \(\square\) & \(\square\) & \(\boxtimes\) \\ \hline \multirow{3}{*}{[35]} & A Black Box Tool for Robustness Testing of & \(\boxtimes\) & \(\square\) & \(\square\) \\ \cline{1-1}  & REST Services & & & \(\square\) \\ \hline \hline \end{tabular}
\end{table} 
Table 3: Primary studies in terms of the proposed solution. request-response sessions like a token-based approach. However, the creation of the cookie depends on the framework being used for RESTful API development. A cookie is created after successful login using credentials and has an expiry time. There are many options available to choose the framework. * API keys-based authentication: API keys-based authentication does not require the use of credentials (i.e., username and password) to be authenticated. Instead, we need to use an already issued secret API key from the host of RESTful APIs to be able to use its services. The key is issued either freely or by using paid membership, for example, using map services or social media services. As this is a secret key and is usually not shared, it would be impossible to create unit tests for such services and test them appropriately. During our analysis, we did not come across any study that proposes a solution that takes care of the protected RESTful APIs when it comes to unit test generation, which implies that a major part of the RESTful APIs would have to be manually tested using manually generated unit tests. This also helps to infer that developing an authentication-enabled testing framework for RESTful APIs is an area with a huge scope of research.