  Modern web applications make extensive use of API calls to update the UI
state in response to user events or server-side changes. For such applications,
API-level testing can play an important role, in-between unit-level testing and
UI-level (or end-to-end) testing. Existing API testing tools require API
specifications (e.g., OpenAPI), which often may not be available or, when
available, be inconsistent with the API implementation, thus limiting the
applicability of automated API testing to web applications. In this paper, we
present an approach that leverages UI testing to enable API-level testing for
web applications. Our technique navigates the web application under test and
automatically generates an API-level test suite, along with an OpenAPI
specification that describes the application's server-side APIs (for REST-based
web applications). A key element of our solution is a dynamic approach for
inferring API endpoints with path parameters via UI navigation and directed API
probing. We evaluated the technique for its accuracy in inferring API
specifications and the effectiveness of the "carved" API tests. Our results on
seven open-source web applications show that the technique achieves 98%
precision and 56% recall in inferring endpoints. The carved API tests, when
added to test suites generated by two automated REST API testing tools,
increase statement coverage by 52% and 29% and branch coverage by 99% and 75%,
on average. The main benefits of our technique are: (1) it enables API-level
testing of web applications in cases where existing API testing tools are
inapplicable and (2) it creates API-level test suites that cover server-side
code efficiently while exercising APIs as they would be invoked from an
application's web UI, and that can augment existing API test suites.
