Thirty Rules Derived From 2,625 Real API Specs Show HTTP Status Code Misuse Is Systematic, Not Occasional

arXiv 2609.12770·low signalXBlueskyLinkedInCopy link

HTTP status codes are standardized but REST does not enforce their semantics, so servers routinely return things like 500 Internal Server Error for what is plainly a client error, which breaks interoperability and produces false positives in testing tools. The authors studied 2,625 real-world REST API specifications to derive 30 usage rules from HTTP standards and REST principles, then built both a static checker for OpenAPI specifications and a dynamic checker for observed API behavior. Misuses turned out to be frequent and systematic, and the two analyses catch different violations, so they are worth running together.