  The focus of this paper is on automating the security testing of RESTful
APIs. The testing stage of this specific kind of components is often performed
manually, and this is yet considered as a long and difficult activity. This
paper proposes an automated approach to help developers generate test cases for
experimenting with each service in isolation. This approach is based upon the
notion of test case mutation, which automatically generates new test cases from
an original test case set. Test case mutation operators perform slight test
case modifications to mimic possible failures or to test the component under
test with new interactions. In this paper, we examine test case mutation
operators for RESTful APIs and define 17 operators specialised in security
testing. Then, we present our test case mutation algorithm. We evaluate its
effectiveness and performance on four web service compositions.
