Analyzing Status Code Misuses in REST API Specifications

Many web APIs rely on the REST architectural style, exploiting HTTP for client-server interactions. Clients typically interpret server responses using status codes, such as 200 OK (success) or 404 Not Found (unavailable resource). As REST does not enforce HTTP standards, servers may misuse status codes (e.g., using 500 for a client error instead of 4xx). Such misuses cause false positives during testing and confuse clients. In this paper, we explore the prevalence of status code misuses in REST APIs. We introduce SCOAS, a tool that detects status code misuses in OpenAPI specifications using 24 rules derived from HTTP standards. We demonstrate that status code misuses are systematic in REST APIs, with 17,767 rule violations detected across 60 specifications. We further discuss their implications and provide recommendations for testers and clients.