Extending OpenAPI for semantic checking of API usage

No ratings

Presented at LangSec Workshop 2025 by

Jacob Torrey

This WIP talk explores how to add semantic contracts for RESTful API types and functionality. RPC protocols historically have supported automated synthesis of statically-typed client stubs. The move to RESTful web APIs lost that powerful feature, until the standardization of OpenAPI. However, all previous schemes at most allowed for the expression of data types from a machine perspective (str, int, etc.). By annotating web APIs with the ontic or human-centric types of data and exposing an API contract, developers can use formal reasoning when consuming the API. This is demonstrated in a proof-of-concept model with an ontic/human-centric type registry along with verifiable conversions between them. An OpenAPI extension is used to annotate API endpoints with their registered types, and also offer semantic contracts on their behavior. A demonstration of a simple API is provided to show how such a scheme improves safety of consuming the API without adding developer effort.