Automated API Endpoint Extraction from Source Code

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Discovering all endpoints associated with REST APIs is challenging due to the lack of general description documents, which can lead to difficulties for outside web applications and security scanners in interacting with these APIs, potentially resulting in missed security vulnerabilities.

Innovation Solution

Automatically extracting API endpoint data from source code and translating it into a usable format, such as the Swagger format, to facilitate interaction with web services and security scans.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Adaptability or versatility

If REST APIs do not have general description documents (such as WSDL), then API flexibility and modern web development are improved, but endpoint discovery and documentation become difficult

Engineering Contradiction:

ImproveAPI flexibilityVSAvoidendpoint discovery difficulty

Core Design Contradiction:

Adaptability or versatilityVSLoss of information

Solution Approach 1:

The patent extracts API endpoint information directly from source code files, removing the dependency on separate documentation files. The system parses source code to identify endpoint definitions, parameters, and responses, thereby obtaining the necessary API information without requiring WSDL or other description documents.

Inventive Principle:

Principle #2Taking out (Extraction)

Solution Approach 2:

The patent introduces source code parsing as an intermediary mechanism between the API implementation and the consumer. Instead of relying on explicit documentation, the system uses automated parsing tools as intermediaries to extract endpoint information from source code, bridging the gap between flexible API design and discoverability.

Inventive Principle:

Principle #24Intermediary (Mediator)

2Loss of information

If automated endpoint extraction from source code is implemented, then endpoint discovery is improved, but source code parsing complexity increases

Engineering Contradiction:

Improveendpoint discovery capabilityVSAvoidparsing system complexity

Core Design Contradiction:

Loss of informationVSDevice complexity

Solution Approach 1:

The patent segments the source code into specific regions containing endpoint definitions, parameters, and responses. By dividing the complex task of extracting all API information into discrete, manageable segments (endpoint declarations, request parameters, response structures), the system reduces the complexity of the parsing process while maintaining comprehensive extraction capability.

Inventive Principle:

Principle #1Segmentation

3Loss of information

If manual API documentation is required, then information accuracy is improved, but development time and resource consumption increase

Engineering Contradiction:

ImproveAPI information completenessVSAvoiddocumentation time

Core Design Contradiction:

Loss of informationVSLoss of time

Solution Approach 1:

The patent enables the API system to document itself automatically by extracting endpoint information from its own source code. Instead of requiring developers to manually create and maintain documentation, the system performs self-documentation through automated source code parsing, eliminating the time-consuming manual process while ensuring information completeness.

Inventive Principle:

Principle #25Self-service

Data Source

PatentUS10754628B2Extracting web API endpoint data from source code to identify potential security threats

Publication Date: 2020.08.25 MICROSOFT TECHNOLOGY LICENSING LLC

AI summary

Embodiments disclosed herein are related to computing systems, and methods for extracting web API endpoint data from source code. Source code for various web services may be accessed. The source code may include portions of web Application Programming Interface (API) endpoint data that includes data necessary to invoke the underlying API. The source code may be automatically parsed to identify the portions of web API endpoint data. The identified portions of web API endpoint data may be translated into a format different from the source code that is usable by various applications that interact with the web services via the web API endpoint data.