CheckOps home

Tools directory

R

CheckOps

RESTler

RESTler is Microsoft Research's MIT-licensed stateful REST API fuzzer that infers dependencies from an OpenAPI spec and exercises cloud services to find security and reliability bugs.

Visit website

Latest public signals

Not refreshed yet. Refresh reads the public site and, when the entry has a GitHub repository, the latest release.

Visit Website

Introduction

RESTler describes itself as the first stateful REST API fuzzing tool for automatically testing cloud services through their REST APIs and finding security and reliability bugs. It analyses an OpenAPI specification to infer producer-consumer dependencies between requests, then generates sequences that exercise deeper service states.

The source code is at microsoft/restler-fuzzer on GitHub under the MIT licence, with about 3,000 stars; the most recent commit was on 10 June 2026.

Features

  1. Stateful fuzzing: Chains requests using inferred dependencies.
  2. Spec compilation: Compiles OpenAPI into a fuzzing grammar.
  3. Modes: Test, fuzz-lean and fuzz modes.
  4. Checkers: Detect bugs such as resource leaks and use-after-free style API issues.
  5. Bug buckets: Groups findings for triage.

Pros

  1. Free to use: Open source under MIT.
  2. Maintained: Commits as recent as 10 June 2026.

Cons

  1. Setup effort: Needs .NET and Python and spec compilation.
  2. Last commit June 2026: Check activity before adopting.
restler compile --api_spec openapi.json
restler test --grammar_file Compile/grammar.py --dictionary_file Compile/dict.json --settings Compile/engine_settings.json

Resources:

Pricing

RESTler is free and open source under the MIT licence.

  1. Cloud service teams with OpenAPI specs.
  2. Security engineers fuzzing APIs statefully.
  3. Not a fit for simple contract checks.

Conclusion

RESTler brings stateful fuzzing to REST APIs, from Microsoft Research.

Alternatives

Other tools on CheckOps that cover similar ground. Open a page, or compare one with RESTler side by side.