Validation of inter-parameter dependencies in API gateways

Abstract

Web APIs usually include inter-parameter dependencies that constrain how input parameters can be combined to form valid calls to the services. API calls often violate these dependencies, resulting in unnecessary message exchanges, wasted time, and quota usage. Additionally, services may fail to adequately validate whether input requests meet these dependencies, causing critical failures or generating uninformative error messages. In this article, we propose extending API gateways to detect and explain inter-parameter dependency violations. We leverage the Inter-parameter Dependency Language (IDL) for specifying dependencies between input parameters in web APIs, and IDLReasoner, a constraint-based IDL analysis engine. We implemented our approach into a prototype tool, IDLFilter, on top of Spring Cloud Gateway. Evaluation results with 12 industrial API operations and about 30K automatically and manually generated API calls show that our approach effectively blocks invalid calls due to dependency violations, providing informative error messages and minimizing potential input validation failures. IDLFilter introduces a small 7% overhead when processing valid API calls, while reducing the response time of requests violating dependencies by 59%.