  Nowadays, web services play a major role in the development of enterprise
applications. Many such applications are now developed using a service-oriented
architecture (SOA), where microservices is one of its most popular kind. A
RESTful web service will provide data via an API over the network using HTTP,
possibly interacting with databases and other web services. Testing a RESTful
API poses challenges, as inputs/outputs are sequences of HTTP
requests/responses to a remote server. Many approaches in the literature do
black-box testing, as the tested API is a remote service whose code is not
available. In this paper, we consider testing from the point of view of the
developers, which do have full access to the code that they are writing.
Therefore, we propose a fully automated white-box testing approach, where test
cases are automatically generated using an evolutionary algorithm. Tests are
rewarded based on code coverage and fault finding metrics. We implemented our
technique in a tool called EVOMASTER, which is open-source. Experiments on two
open-source, yet non-trivial RESTful services and an industrial one, do show
that our novel technique did automatically find 38 real bugs in those
applications. However, obtained code coverage is lower than the one achieved by
the manually written test suites already existing in those services. Research
directions on how to further improve such approach are therefore discussed.
